CVE Vulnerability Catalog

Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Affected versions are 11.1.1.7, 11.1.2.3, and 12.2.1.3.

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin before version 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, allowing remote attackers to execute arbitrary JavaScript in the host page.

In Apache HttpClient versions 4.3.x before 4.3.1, it does not ensure that X509HostnameVerifier is not null, which may allow attackers to exploit vulnerabilities involving hostname verification.

Apache Hadoop versions before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled. This makes it easier for attackers to crack secret keys via a brute-force attack.

An issue was discovered in Xen through 4.9.x related to grant copying code that relied on the incorrect assumption that any grant pin would have a suitable page reference. When such a grant copy operation is performed on a dying domain, this assumption proves wrong, potentially leading to hypervisor memory corruption.

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the frame_handlers array or set_dynamic_table_size function.

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.

The XSLTCompiledTransform function in Ektron Content Management System (CMS) before version 8.02 SP5 configures the XSL with enableDocumentFunction set to true. This allows remote attackers to read arbitrary files, potentially bypassing authentication, modifying viewstate, causing denial of service, or having unspecified other impacts.

Ektron Content Management System (CMS) before version 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, allowing remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.

Dulwich before version 0.18.5, when using an SSH subprocess, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname.

In the 'NQ Contacts Backup & Restore' application version 1.1 for Android, HTTPS is not used for transmitting login and synced user data. The username is transmitted in cleartext along with an SHA-1 hash of the password.

Rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions.

ZeeBuddy 2x allows SQL Injection via the groupid parameter in admin/editadgroup.php, which is a different vulnerability than CVE-2008-3604.

Vastal I-Tech Dating Zone version 0.9.9 allows SQL Injection via the 'product_id' parameter in add_to_cart.php. This is a different vulnerability than CVE-2008-4461.

tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.

Sokial Social Network Script version 1.0 is vulnerable to SQL Injection via the id parameter in admin/members_view.php.

SoftDatepro Dating Social Network version 1.3 is vulnerable to SQL Injection via the profid parameter in viewprofile.php, the sender_id parameter in viewmessage.php, and the Email field in the admin panel.

Same Sex Dating Software Pro version 1.0 is vulnerable to SQL Injection via the profid parameter in viewprofile.php, the sender_id parameter in viewmessage.php, and the Email field in the admin section.

PHP CityPortal version 2.0 is vulnerable to SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.