CVE Vulnerability Catalog

mrlg-lib.php in mrlg4php before version 1.0.8 allows remote attackers to execute arbitrary shell code.

JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service through heap-based out-of-bounds write, leading to application crash. The attack can be executed via crafted JavaScript code that triggers access to red-zone memory locations.

Devices Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.

There is a vulnerability in Huawei Tecal devices that may lead to unauthorized access to the system. This affects multiple server models, including RH1288 V2, RH2265 V2, RH2285 V2, and others with specific software versions.

An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'libxslt' component. This issue may lead to denial of service (memory corruption) or potentially other unspecified impacts via unknown vectors.

An issue was discovered in certain Apple products, including iOS before 10.3, related to the 'HomeKit' component. It allows attackers to have an unspecified impact by leveraging the presence of Home Control on Control Center.

An issue was discovered in certain Apple products related to the 'HTTPProtocol' component. Affects iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The issue involves nghttp2 before 1.17.0.

An issue was discovered in certain Apple products affecting iOS before 10.3 and macOS before 10.12.4. The issue involves the 'Security' component and allows remote attackers to bypass intended access restrictions.

An issue was discovered in certain Apple products, including macOS before 10.12.4, involving mishandling of profile uninstall actions in the 'MCX Client' component when a profile has multiple payloads. This allows remote attackers to bypass intended access restrictions.

IBM Curam Social Program Management versions 6.0 and 7.0 are vulnerable to a denial of service caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume all available memory resources.

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, and 11.0.18 and earlier have an exploitable memory corruption vulnerability in the rendering engine. Successful exploitation could lead to arbitrary code execution.

Snoopy allows remote attackers to execute arbitrary commands. This vulnerability exists due to an incomplete fix for CVE-2014-5008.

Snoopy allows remote attackers to execute arbitrary commands.

W pliku fastping.c w MRLG (Multi-Router Looking Glass) przed wersją 5.5.0 istnieje podatność, która pozwala zdalnym atakującym na wykonanie dowolnego zapisu w pamięci oraz na uszkodzenie pamięci.

The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. This issue exists due to an incomplete fix for CVE-2008-4796.

In Sophos Web Appliance (SWA) before version 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection.

ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files.

The findcore.php file in MODX Revolution version 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.

In MODX Revolution version 2.5.4-pl and earlier, the setup/controllers/welcome.php file allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.

Siklu EtherHaul devices before version 7.4.0 are vulnerable to a remote command execution (RCE) vulnerability. This vulnerability allows a remote attacker to execute commands and retrieve information such as usernames and plaintext passwords from the device with no authentication.