CVE Vulnerability Catalog

In Veritas NetBackup Appliance version 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process.

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process.

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution using the 'bprd' process.

EMC Mainframe Enablers ResourcePak versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.

The forgotpassword.php file in GeniXCMS 1.0.2 lacks a rate limit, which may allow remote attackers to cause a denial of service (login inability) or conduct Arbitrary User Password Reset attacks.

A Password in Configuration File issue was identified in Dahua devices such as DH-IPC-HDBW23A0RN-ZS and others. This vulnerability could allow a malicious user to assume the identity of a privileged user and gain access to sensitive information.

W urządzeniach Hikvision z serii DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx oraz DS-2CD63xx występuje problem z niewłaściwą autoryzacją. Wersje od V5.2.0 do V5.4.0 mogą pozwolić na eskalację uprawnień przez złośliwego użytkownika, co prowadzi do dostępu do wrażliwych informacji.

A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client authentication and redirect unauthorized users.

All iRODS versions before 4.1.11 and 4.2.1 are vulnerable, allowing other iRODS users (potentially anonymous) to execute remote shell commands via iRODS virtual pathnames. Exploiting this vulnerability involves retrieving a virtual iRODS pathname containing a semicolon using igetwild.

An issue was discovered on Accellion FTA devices before FTA_9_12_180 due to the misuse of mysql_real_escape_string. This allows SQL injection via the app_id parameter in seos/courier/communication_p2p.php.

An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to a regular expression that lacks an initial ^ character. This allows SSRF attacks with the file:///etc/passwd#https:// URL pattern.

An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to LDAP Injection. The POST parameter 'filter' in ldaptest.html can be exploited.

An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to an SQL injection vector via report_error.php?year='payload.

An issue was discovered on Accellion FTA devices before FTA_9_12_180 that allows Remote Code Execution using shell metacharacters in the method parameter seos/1000/find.api.

The pcre2test.c file in PCRE2 version 10.23 contains a vulnerability that allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command.

Quick Heal Internet Security, Quick Heal Total Security, and Quick Heal AntiVirus Pro are vulnerable to memory corruption while parsing a malformed Mach-O file.

Quick Heal Internet Security, Total Security, and AntiVirus Pro version 10.1.0.316 are vulnerable to memory corruption while parsing a malformed Mach-O file.

Quick Heal Internet Security, Total Security, and AntiVirus Pro version 10.1.0.316 are vulnerable to Out of Bounds Write on a Heap Buffer due to improper validation of dwCompressionSize of WIM Header. This vulnerability can be exploited for Remote Code Execution and Privilege Escalation.