CVE Vulnerability Catalog

The Content Timeline plugin version 4.4.2 for WordPress contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be conducted via the timeline and id parameters in the respective PHP files.

Podsystem relay DHCP w Cisco IOS w wersjach od 12.2 do 15.6 oraz w Cisco IOS XE zawiera podatność, która może pozwolić nieautoryzowanemu, zdalnemu atakującemu na wykonanie dowolnego kodu i uzyskanie pełnej kontroli nad systemem. Atakujący może również spowodować ponowne uruchomienie systemu, co prowadzi do stanu odmowy usługi (DoS).

A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 allows an unauthenticated, remote attacker to bypass authentication checks when registering an Endpoint Identifier (EID) to a Routing Locator (RLOC) in the map server/map resolver (MS/MR). A logic error in the code enables the attacker to send specific valid map-registration requests that will be accepted even if the authentication keys do not match.

A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 allows an unauthenticated remote attacker to bypass authentication to the REST API. The issue is due to insufficient input validation for the REST API.

A stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before version 5.24.3-RC1 and 5.26.x before version 5.26.1-RC1 allows attackers to execute arbitrary code via a long environment variable.

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a 'SYSTEM' entity containing a URL, the parser will attempt to connect to that URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before version 1.0.1.

On Broadcom BCM4355C0 Wi-Fi chips version 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects.

On Broadcom BCM4355C0 Wi-Fi chips version 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware.

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products may be vulnerable to Java deserialization issues. An unauthenticated remote attacker can exploit these vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.

The Event Espresso Lite plugin version 3.1.37.12.L for WordPress contains an SQL Injection vulnerability in the /includes/event-management/index.php file. The issue occurs via the recurrence_id parameter in requests to /wp-admin/admin.php.

The Support Ticket System plugin for WordPress before version 1.2.1 contains multiple SQL injection vulnerabilities in includes/update.php, allowing remote attackers to execute arbitrary SQL commands via the (1) user or (2) id parameter.

CVE-2015-7390 in TestLink before version 1.9.14 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the apikey parameter in lnl.php.

SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to search/.

A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account with a hardcoded password. An attacker can use this information to log into the system with high-privilege credentials.

A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing an unauthenticated user to execute arbitrary code and exfiltrate files.

A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing unauthenticated users to execute arbitrary SQL commands against the underlying database.

Password reset tokens in Magento CE before 1.9.2.2 and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, allowing remote attackers to obtain user passwords.

The redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager before version 3.6 allows remote authenticated users with the SuperUser role to execute arbitrary commands on any host in the RHEV environment.

There is a stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.