CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

Blue Coat Malware Analysis Appliance (MAA) before version 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protection mechanism, potentially leading to writing to arbitrary files, causing denial of service (host reboot or reset to factory defaults), or executing arbitrary code.

Kura before version 2.1.0 has a vulnerability that allows taking control over the device's firewall configuration, but does not allow setting IPv6 firewall rules. The Equinox console port 5002 remains open, allowing login to Kura without user credentials over unencrypted telnet and executing commands as 'root'.

EE 4GEE WiFi MBB devices (before version EE60_00_05.00_31) allow remote attackers to obtain sensitive information via a JSONP endpoint, potentially exposing passwords and SMS content.

A stack-based buffer overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before version 0.18.3. It could allow a remote denial of service or code execution attack.

SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.

SQL Injection exists in the EyesOfNetwork web interface (eonweb) 5.1-0 via the user_id cookie to header.php.

CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.

SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.

In the mboxlist_do_find function in Cyrus IMAP before version 3.0.4, an off-by-one error in prefix calculation for the LIST command led to the use of uninitialized memory. This may allow remote attackers to obtain sensitive information or cause a daemon crash.

A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, Integra 500, and iSite ATG consoles. An attacker may create an application user account to gain administrative privileges.

A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles. The application is vulnerable to injection of malicious SQL queries via the input from the client.

Multiple SQL injection vulnerabilities in Synology Photo Station before version 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

CVE-2015-5052 is an SQL injection vulnerability in Sefrengo before version 1.6.5 beta2.

Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.

There is an SQL injection vulnerability in Pragyan CMS 3.0, which may allow attackers to execute unauthorized queries against the database.

strongSwan versions 5.2.2 and 5.3.0 allow remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.

The WordPress Community Events plugin before version 1.4 contains a SQL injection vulnerability.

The WatuPRO plugin before version 5.5.3.7 for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which allows an attacker to restore a router to its factory settings by simply browsing to a specific link. Due to improper authentication on this page, the software accepts the request, allowing the attacker to reset the router to its default configurations.