CVE Vulnerability Catalog

A use-after-free vulnerability in the XML-LibXML module through version 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.

A use after free vulnerability in Adobe Flash Player exists in versions before 20.0.0.267 across various platforms, including Desktop Runtime, Google Chrome, Microsoft Edge, and Internet Explorer. It may lead to unauthorized memory access and potential execution of malicious code.

The custom authentication realm used by karaf-tomcat's 'opendaylight' realm in Opendaylight before Helium SR3 will authenticate any username and password combination.

In Code42 CrashPlan 5.4.x, remote code execution is possible via the org.apache.commons.ssl.rmi.DateRMI class, which upon instantiation creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.

W PHPUnit przed wersją 4.8.28 oraz 5.x przed wersją 5.6.3 istnieje podatność, która pozwala zdalnym atakującym na wykonanie dowolnego kodu PHP poprzez dane POST HTTP zaczynające się od ciągu "<?php ". Przykład ataku dotyczy witryny z publicznie dostępnym folderem /vendor.

The Symantec Messaging Gateway can encounter an issue of remote code execution, allowing commands to be executed remotely on a target machine or in a target process.

Cognito Software Moneyworks versions 8.0.3 and earlier have a password exposure issue. Verbose logging writes the administrator password to a world-readable file.

The TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This resulted in incorrect access control, allowing attackers to gain read-write access to system settings through the protected router configuration service tddp.

CVE-2017-9848 is a SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0. It allows remote attackers to execute arbitrary SQL commands via a crafted ArticleIDs element within an XML document in a GetArticleHitsArray element.

'/cgi-bin/admin/testserver.cgi' of the web service in most VIVOTEK Network Cameras is vulnerable to shell command injection, allowing remote attackers to execute any shell command as root via a crafted HTTP request.

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.

InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.

In Redgate SQL Monitor before version 3.10 and 4.x before version 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, allowing for the execution of arbitrary SQL commands on monitored Microsoft SQL Server machines.

IdeaBlade Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization.

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, used in Sophos Anti-Virus Threat Detection Engine before 3.37.2, which can lead to arbitrary code execution. An integer overflow in DataSize+CurChannel results in a negative value for the 'DestPos' variable, allowing the attacker to write out of bounds.

The OpenWebif plugin up to version 1.2.4 for E2 devices has a vulnerability that allows unauthorized code execution. The saveConfig function in 'plugin/controllers/models/config.py' performs eval() on the contents of the 'key' HTTP GET parameter.

In EMC Avamar Server Software versions 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, and 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory, which could allow the attacker to execute arbitrary code on the Avamar Server system.

In EMC Avamar Server Software versions 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited to view sensitive information, perform software updates, or run maintenance workflows.

A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remotely execute arbitrary code in the form of SQL queries.