CVE Vulnerability Catalog

Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier has a remote command execution vulnerability. Authenticated users with least privileges can run arbitrary commands on the system as root via the Patch Update functionality.

An issue was discovered in certain Apple products, including iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3, related to the 'CoreFoundation' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted string.

An issue was discovered in certain Apple products, including iOS before 10.2, involving the 'WebSheet' component. It allows attackers to bypass a sandbox protection mechanism via unspecified vectors.

In Facebook's HHVM versions before 3.15.0, there is an infinite recursion in wddx, allowing attackers to have unspecified impact via unknown vectors.

The array_*_recursive functions in Facebook HHVM before version 3.15.0 allow attackers to have unspecified impact via unknown vectors, related to recursion.

Facebook HHVM versions before 3.15.0 have a self recursion issue that allows attackers to have unspecified impact via unknown vectors.

Integer overflow in StringUtil::implode in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors.

Integer overflow in bcmath in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.

Facebook HHVM versions before 3.15.0 contain an out-of-bounds write vulnerability in the mb_detect_encoding, mb_send_mail, and mb_detect_order functions. Attackers can exploit this vulnerability, leading to unspecified impact.

An issue was discovered in dotCMS through 3.6.1 related to the findChildrenByFilter() function, which performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented, they can be bypassed for the q and inode parameters, leading to potential SQL injection attacks.

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.

The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.

The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.

Zabbix before 2.2.14 and 3.0 before 3.0.4 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

IBM Integration Bus versions 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS are vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data.

Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the orders_status or customers_status parameter to api/easybill/easybillcsv.php.

IBM Websphere MQ JMS client versions 7.0.1, 7.1, 7.5, 8.0, and 9.0 allow deserialization of objects from untrusted sources, which could enable a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath.

Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (pycrypto) allows remote attackers to execute arbitrary code, as demonstrated by a crafted iv parameter to cryptmsg.py.

Adobe Digital Editions versions 4.5.3 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.

Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.