CVE Vulnerability Catalog

An issue was discovered in SMA Solar Technology products related to the Grid Guard system, which uses predictable codes. Such a code, when combined with the installer account, allows changing very sensitive parameters.

An issue was discovered in SMA Solar Technology products that allows plaintext passwords to be sniffed as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the device.

An issue was discovered in SMA Solar Technology products related to a very weak password policy for user and installer passwords. There are no complexity or length requirements, making it difficult to create strong passwords.

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords are rarely changed, leading to user passwords almost always being default, and installer passwords often being similar across installations.

Heap-based buffer overflow in the psf_binheader_writef function in common.c in libsndfile through version 1.0.28 allows remote attackers to cause application crashes or possibly have unspecified other impacts.

MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal Agent and spoof the Relay Service.

MaLion for Windows and Mac versions 5.0.0 to 5.2.1 allows remote attackers to bypass authentication to alter settings in Relay Service Server.

SQL injection vulnerability in MaLion for Windows and Mac versions 5.0.0 to 5.2.1 allows remote attackers to execute arbitrary SQL commands via Relay Service Server.

In the newusers tool in shadow before version 4.5, there is a possibility to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors.

Zoho ManageEngine OpManager versions 11 through 12.2 uses a custom encryption algorithm to protect the credentials used to access monitored devices. The implemented algorithm does not use a per-system key or even a salt, making it possible to create a universal decryptor.

Format Factory version 4.1.0 has a DLL Hijacking vulnerability due to the use of an untrusted search path for msimg32.dll, WindowsCodecs.dll, and dwmapi.dll.

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php.

A proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The flaw can be exploited by parsing the tr parameter within Proxy.php.

Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.

The vulnerability in the OnePlus 2 Primary Bootloader (PBL) is due to the lack of validation of the SBL1 partition before execution, even though it contains a certificate. This allows attackers with write access to that partition to disable signature validation.

Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory.

Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerNewReportScheduler.dll.

Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerStatusMonitor.dll.

Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in mdHandlerLicenseManager.dll.

Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue arises from a lack of proper user input validation in cmdHandlerTVCSCommander.dll.