CVE Vulnerability Catalog

In PlaySMS 1.4, the import feature (import.php) allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.

The HTTPServerILServlet.java in the JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server versions up to 4.X, does not restrict the classes for which it performs deserialization. This allows remote attackers to execute arbitrary code via crafted serialized data.

An Arbitrary File Upload issue was discovered in CODESYS Web Server by 3S-Smart Software Solutions GmbH. Versions 2.3 and prior of CODESYS Web Server are affected, allowing unauthorized upload of arbitrary files, potentially leading to remote code execution.

A Stack Buffer Overflow issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. This affects CODESYS Web Server Versions 2.3 and prior, where a malicious user could overflow the stack buffer by providing overly long strings to XML handling functions.

An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. This vulnerability may allow attackers to bypass access control, potentially leading to remote code execution.

An issue with improper neutralization of special elements in OS commands was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. Improper neutralization of these elements may allow an attacker to access root level operating system, potentially leading to remote code execution.

A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods.

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.

In libytnef in versions up to 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.

An issue, also known as DW201703-001, was discovered in libdwarf in the function dwarf_formsdata(). A few data types were not checked for being in bounds, leading to a heap-based buffer over-read.

An issue was discovered in the libdwarf library that leads to a heap-based buffer over-read. The problem occurs in the _dwarf_decode_s_leb128_chk() function, where a byte pointer is dereferenced before being checked for bounds.

An issue was discovered in libdwarf related to a heap-based buffer over-read in the _dwarf_read_loc_expr_op() function. This problem is due to a failure to check if a pointer is within bounds.

An issue was discovered in the libdwarf library related to a heap-based buffer over-read in the dwarf_formsdata() function. This problem arises from a failure to check if a pointer is in bounds in several places in this function and a failure in a check in the dwarf_attr_list() function.

Libav versions before 12.1 are vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.

Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20.

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

The WebUI component in Deluge before version 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

The Codextrous B2J Contact (b2j_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a 'safe file extension' protection mechanism, leading to remote code execution.

Stack buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request.

The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes. This page acts as a web shell, enabling command execution without client-side feedback from the web application.