CVE Vulnerability Catalog

The IBM TRIRIGA Application Platform versions 3.3, 3.4, and 3.5 contain a vulnerability that could allow an authenticated user to execute a report they do not have access to.

Builder tools running in the IBM TRIRIGA Application Platform versions 3.3, 3.4, and 3.5 contain a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access to.

IBM Security Guardium versions 10.0 and 10.1 process patches, image backups, and other updates without sufficiently verifying the origin and integrity of the code.

A stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore versions 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary code via a long URI in a GET request.

The CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack user authentication for password changes via a crafted request to userSettings.view.

The panic_gate check in NTP before version 4.2.8p5 is only re-enabled after the first change to the system clock greater than 128 milliseconds. This allows remote attackers to set NTP to an arbitrary time when started with the -g option or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources.

The ULOGTOD function in ntp.d in SNTP before version 4.2.7p366 does not properly perform type conversions from a precision value to a double, allowing remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

The ntp_openssl.m4 in ntpd in NTP before version 4.2.7p112 has a vulnerability that allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

The log_config_command function in ntp_parser.y in ntpd in NTP before version 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

A cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.

Netlock Mokka versions before 2.7.8.1204 are vulnerable to XML signature wrapping attacks. Attackers can exploit an e-akta document with a ds:Object node that has a crafted payload prepended to a valid ds:Object.

Microsec e-Szigno versions before 3.2.7.12 are vulnerable to XML signature wrapping attacks. Attackers can exploit a crafted e-akta signed document to alter a valid ds:Object element.

libinfinity versions before 0.6.6-1 do not validate expired SSL certificates, allowing remote attackers to have unspecified impact via unknown vectors.

phpMyBackupPro version 2.5 and earlier does not properly escape the '.' character in request parameters, allowing remote authenticated users to inject and execute arbitrary PHP scripts.

phpMyBackupPro version 2.5 and earlier does not properly sanitize input strings, allowing remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file.

phpMyBackupPro before 2.5 does not validate integer input, allowing remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php.

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a '/' at the end of a URL.

In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the 'PING' feature within the web interface allows performing command injection via the 'pip' parameter.

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of 'admin' for the admin account.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, allowing unauthorized requests such as enabling UPnP.