CVE Vulnerability Catalog

IDERA Uptime Monitor version 7.8 has an SQL injection vulnerability in getxenmetrics.php via the element parameter.

OrientDB versions up to 2.2.22 do not enforce privilege requirements during 'where', 'fetchplan', or 'order by' usage, allowing remote attackers to execute arbitrary OS commands via a crafted request.

The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script.

The Screensavercc component in eLux RP before version 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel.

The XSS Protection API module in Apache Sling before version 1.0.12 uses an insecure SAX parser to validate the input string, allowing for XXE attacks in scripts using this method.

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

D-Link DIR-615 before v20.12PTb04 has a second admin account with a BACKDOOR value of 0x1, which might allow remote attackers to gain access via a TELNET connection.

The Humax Wi-Fi Router model HG100R-* version 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. This vulnerability can be exploited remotely when the router is configured to expose the management console.

A stack-based buffer overflow in ASUSwrt-Merlin firmware and ASUS firmware for various ASUS devices allows remote attackers to execute arbitrary code by sending long device information that is mishandled during a strcat to a device list.

Fiyo CMS version 2.0.7 has SQL injection vulnerability in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in article_list.php that uses the parameters $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in article_status.php that uses the $_GET['id'] parameter.

Fiyo CMS version 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in dapur/apps/app_comment/sys_comment.php, using data from $_POST and $_REQUEST.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in comment_status.php that uses the $_GET['id'] parameter.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in comment_status.php via the $_GET['id'] parameter.

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root.

The FR-GV-301 issue in FreeRADIUS 3.x before version 3.0.15 allows a buffer overflow in the 'data2vp_wimax()' function, potentially leading to a daemon crash or arbitrary code execution by remote attackers.