CVE Vulnerability Catalog

ACTi cameras, including the D, B, I, and E series, using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unauthenticated, remote attacker can exploit this vulnerability by accessing the reset page directly.

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

K7 Antivirus 15.1.0309 has a vulnerability related to NULL pointer dereference in K7Sentry.sys version 15.1.0.59, which can be triggered by a DeviceIoControl request with code 0x950025c8.

K7 Antivirus 15.1.0309 has a vulnerability in K7Sentry.sys 15.1.0.59 that allows for a NULL pointer dereference via a DeviceIoControl request with value 0x950025a4.

K7 Antivirus 15.1.0309 has a vulnerability in K7Sentry.sys 15.1.0.59 that allows for a NULL pointer dereference via a DeviceIoControl request with the value 0x950025ac.

An XML External Entity (XXE) vulnerability was found in the Conserus Image Repository solution version 2.1.1.105. An unauthenticated user can send a modified HTTP SOAP request, allowing access to the local file system and transmitting the application service's account hashed credentials to a remote attacker.

In vBulletin versions up to 5.3.x, there is an unauthenticated deserialization vulnerability that can lead to arbitrary file deletion and, under certain circumstances, code execution. This issue arises from the unsafe usage of PHP's unserialize() function in the cacheTemplates() method of the vB_Library_Template class, which is publicly exposed.

vBulletin versions up to 5.3.x on Windows allows remote PHP code execution due to the accessibility of a require_once call with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname. The blocking of ../ traversal does not apply to ..\, allowing for exploitation of this vulnerability.

Entrepreneur Dating Script version 2.0.1 has an SQL Injection vulnerability via the marital, gender, country, or profileid parameter in the search_result.php file.

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker with the appropriate permissions can execute arbitrary code on systems running a vulnerable version of Bamboo Server.

There is a possibility of double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags. An attacker with restricted administrative rights to Bamboo can exploit this vulnerability to execute arbitrary Java code on systems running a vulnerable version of Bamboo.

Basic Job Site Script version 2.0.5 has a SQL Injection vulnerability via the keyword parameter to /job.

Resume Clone Script version 2.0.5 has a SQL Injection vulnerability via the id parameter in the preview.php file.

Advanced World Database version 2.0.5 has an SQL Injection vulnerability via the country or state parameter in city.php and the country parameter in state.php.

Muslim Matrimonial Script version 3.02 has an SQL Injection vulnerability via the succid parameter in the success-story.php file.

Groupon Clone Script version 3.01 has a SQL Injection vulnerability via the state_id parameter in the city_ajax.php file.

Car Rental Script version 2.0.4 has an SQL Injection vulnerability via the val parameter in the countrycode1.php file.

MLM Forced Matrix version 2.0.9 has a SQL Injection vulnerability via the newid parameter in the news-detail.php file.

MLM Forex Market Plan Script version 2.0.4 is vulnerable to SQL Injection via the newid parameter in news_detail.php and the eventid parameter in event_detail.php.