CVE Vulnerability Catalog

FS Amazon Clone version 1.0 has a SQL Injection vulnerability via the PATH_INFO parameter in the /VerAyari path.

FS Foodpanda Clone version 1.0 has a SQL Injection vulnerability via the keywords parameter in the /food path.

FS Expedia Clone version 1.0 has a SQL Injection vulnerability via the id parameter in pages.php or content.php, or the fl_orig or fl_dest parameter in show-flight-result.php.

A vulnerability in Device Guard in Windows 10 and Windows Server allows a security feature bypass due to improper handling of untrusted files.

An issue was discovered on Western Digital MyCloud PR4100 devices running version 2.30.172. The web administration component allows multipart uploads without authentication, enabling an attacker to upload a PHP shell to the device's file system.

The SAP Business Intelligence Promotion Management Application in versions 4.10, 4.20, and 4.30 does not perform authentication checks for functionalities that require user identity.

Node.js was affected by an OpenSSL vulnerability (CVE-2017-3737) related to the use of SSL_read() due to TLS handshake failure. An active network attacker could send application data to Node.js, bypassing TLS authentication and encryption.

Posty Readymade Classifieds Script version 1.0 allows an attacker to inject SQL commands via requests to listings.php?catid= or ads-details.php?ID=.

Techno Portfolio Management Panel version 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

Palo Alto Networks PAN-OS w wersjach przed 6.1.19, 7.0.x przed 7.0.19, 7.1.x przed 7.1.14 oraz 8.0.x przed 8.0.6 umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez interfejs zarządzania.

The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors.

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI), allowing remote code execution attacks through specially crafted serialized objects. Versions 3.0.1 and earlier (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) are vulnerable.

ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.

The ucnv_UTF8FromUTF8 function in the ICU library for C/C++ through version 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which can lead to stack-based buffer overflow and application crash.

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions related to reading data past the end of the target buffer. The use of an invalid pointer during access to internal data structure fields causes this vulnerability.

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions related to reading data past the end of the target buffer. The use of an invalid pointer during access to internal data structure fields causes this vulnerability.

A vulnerability exists in Adobe Acrobat and Reader related to use after free in the JavaScript engine. This affects versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.

A use-after-free vulnerability was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe InDesign 12.1.0 and earlier versions. Successful exploitation could lead to arbitrary code execution.