CVE Vulnerability Catalog

SQL injection vulnerability in MaLion for Windows and Mac versions 5.0.0 to 5.2.1 allows remote attackers to execute arbitrary SQL commands via Relay Service Server.

In the newusers tool in shadow before version 4.5, there is a possibility to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors.

Zoho ManageEngine OpManager versions 11 through 12.2 uses a custom encryption algorithm to protect the credentials used to access monitored devices. The implemented algorithm does not use a per-system key or even a salt, making it possible to create a universal decryptor.

Format Factory version 4.1.0 has a DLL Hijacking vulnerability due to the use of an untrusted search path for msimg32.dll, WindowsCodecs.dll, and dwmapi.dll.

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php.

A proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The flaw can be exploited by parsing the tr parameter within Proxy.php.

Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.

The vulnerability in the OnePlus 2 Primary Bootloader (PBL) is due to the lack of validation of the SBL1 partition before execution, even though it contains a certificate. This allows attackers with write access to that partition to disable signature validation.

Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory.

Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerNewReportScheduler.dll.

Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerStatusMonitor.dll.

Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in mdHandlerLicenseManager.dll.

Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue arises from a lack of proper user input validation in cmdHandlerTVCSCommander.dll.

In Razer Synapse 2.20.15.1104, there is a vulnerability that allows a specially crafted IOCTL to be sent to the rzpnk.sys driver. This can lead to opening a handle to an arbitrary process.

The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name.

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.

Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id.

IBM InfoSphere Information Server versions 9.1, 11.3, and 11.5 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

SQL injection vulnerability in SOL.Connect ISET-mpp meter version 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a login action.

The Etoile Ultimate Product Catalog plugin version 4.2.11 for WordPress has an SQL injection vulnerability in several POST actions in the wp-admin/admin-ajax.php file.