CVE Vulnerability Catalog

Format Factory version 4.1.0 has a DLL Hijacking vulnerability due to the use of an untrusted search path for msimg32.dll, WindowsCodecs.dll, and dwmapi.dll.

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php.

A proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The flaw can be exploited by parsing the tr parameter within Proxy.php.

Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.

The vulnerability in the OnePlus 2 Primary Bootloader (PBL) is due to the lack of validation of the SBL1 partition before execution, even though it contains a certificate. This allows attackers with write access to that partition to disable signature validation.

Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory.

Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerNewReportScheduler.dll.

Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerStatusMonitor.dll.

Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in mdHandlerLicenseManager.dll.

Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue arises from a lack of proper user input validation in cmdHandlerTVCSCommander.dll.

In Razer Synapse 2.20.15.1104, there is a vulnerability that allows a specially crafted IOCTL to be sent to the rzpnk.sys driver. This can lead to opening a handle to an arbitrary process.

The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name.

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.

Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id.

IBM InfoSphere Information Server versions 9.1, 11.3, and 11.5 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

SQL injection vulnerability in SOL.Connect ISET-mpp meter version 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a login action.

The Etoile Ultimate Product Catalog plugin version 4.2.11 for WordPress has an SQL injection vulnerability in several POST actions in the wp-admin/admin-ajax.php file.

VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.

Backup archives in Trend Micro Deep Discovery Director 1.1 are encrypted with a static password, suggesting that the same password may be used across all virtual appliance instances.