CVE Vulnerability Catalog

In LibTIFF version 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.

PHP Scripts Mall Single Theater Booking has an SQL Injection vulnerability via the movieid parameter in the admin/movieview.php file.

PHP Scripts Mall Single Theater Booking has a CSRF vulnerability via admin/sitesettings.php, which may allow attackers to perform unauthorized actions on behalf of a logged-in administrator.

Vanguard Marketplace Digital Products PHP has a CSRF vulnerability that occurs at the /search endpoint.

A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine.

There is an SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before version 2.5, allowing remote attackers to execute arbitrary SQL commands via the username and password parameters.

The AirLive BU-2015, BU-3026, MD-3025, WL-2000CAM, and POE-200CAM v2 devices have a vulnerability related to the use of hard-coded credentials in the embedded Boa web server. Attackers can gain access to user data through specially crafted HTTP requests.

The Easy2Map plugin before version 1.3.0 for WordPress contains multiple directory traversal vulnerabilities in the includes/MapImportCSV2.php and includes/MapImportCSV.php files, allowing remote attackers to include and execute arbitrary files via the csvfile parameter related to upload file functionality.

The RPC service in Tripwire IP360 VnE Manager versions 7.2.2 and earlier allows remote attackers to bypass authentication and enumerate users, reset passwords, or manipulate IP filter restrictions via crafted 'privileged commands'.

The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code via a crafted PDF file.

Ubiquiti UniFi Video before version 3.8.0 for Windows uses weak permissions for the installation directory, allowing local users to gain SYSTEM privileges via a Trojan horse taskkill.exe file.

A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations over the network.

An issue was discovered in certain Apple products, including macOS before version 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

An issue was discovered in certain Apple products related to the 'IOKit' component. Affects iOS before 11.2, macOS before 10.13.2, tvOS before 11.2, and watchOS before 4.2, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service via a crafted app.

An issue was discovered in certain Apple products affecting iOS before 11.2, Safari before 11.0.2, iCloud before 7.2 on Windows, iTunes before 12.7.2 on Windows, and tvOS before 11.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.

An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'IOAcceleratorFamily' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

An issue was discovered in certain Apple products, including iOS, Safari, iCloud, iTunes, and tvOS. The vulnerability in the 'WebKit' component allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.

An issue was discovered in certain Apple products related to the 'WebKit' component. Affects iOS before 11.2, Safari before 11.0.2, iCloud before 7.2 on Windows, iTunes before 12.7.2 on Windows, and tvOS before 11.2. This issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.

An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

The File_read_line function in Wireshark up to version 2.2.11 does not properly strip ' ' characters, allowing remote attackers to cause application crashes via crafted packets that trigger the processing of an empty line.