CVE Vulnerability Catalog

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before version 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.

A specially crafted InPage document leads to arbitrary code execution in the InPage reader.

Cacti version 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root and then making a remote_agent.php request containing PHP code in a Client-ip header.

The mail-filter/assp package version 1.9.8.13030 and earlier allows local users to gain privileges by leveraging access to the assp user account to install a Trojan horse /usr/share/assp/assp.pl script.

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before version 2.0.0a12. The use of load instead of safe_load allows for arbitrary Python command execution by injecting code into loaded YAML.

An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before version 0.6.1. A YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used.

An exploitable vulnerability exists in the YAML parsing functionality in MLAlchemy before version 0.2.2, allowing arbitrary Python command execution due to the use of load instead of safe_load when processing YAML-based queries.

Ingenious School Management System version 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameter of a GET request in /view/friend_profile.php.

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's handling of 'front of' and 'back of' directives could be exploited by attackers to leak information from the interpreter.

A Plaintext Storage of a Password issue was discovered in WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in plaintext.

The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell metacharacters before use of backticks in External.pm, allowing for shell command injection and arbitrary command execution if untrusted input is used.

In Cacti 1.1.27, the lib/rrd.php file allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.

CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.

CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.

An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection by sending an HTTP request.

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten.

A vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1, allowing execution of arbitrary shell commands via a specially crafted SSID. An attacker needs to send a couple of HTTP requests and set up an access point reachable by the device to exploit this vulnerability.

An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass the authentication routine, causing the device to grant unintended administrative access.

An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service.