CVE Vulnerability Catalog

An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities allow attackers to execute arbitrary system commands.

EMC Network Configuration Manager (NCM) versions 9.3.x and 9.4.x contain an Improper Authentication vulnerability that could be exploited by malicious users to compromise the affected system.

EMC Network Configuration Manager (NCM) versions 9.3.x and 9.4.x contain a Java RMI Remote Code Execution vulnerability. This could be exploited by malicious users to compromise the affected system.

EMC Documentum eRoom version 7.4.4 and earlier contains an unverified password change vulnerability that could be exploited by malicious users to compromise the system.

IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 has inadequate account lockout settings that could allow a remote attacker to brute force account credentials.

The Data Warehouse component in NetApp OnCommand Insight before version 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privileged account.

An issue was discovered in SageCRM 7.x before 7.3 SP3 related to the Component Manager functionality, which allows additional components to be added to the application. It is possible to upload a zip file containing an .ecf file, leading to the extraction of files onto the filesystem, including a malicious web shell script.

IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications.

IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing unauthorized administrative operations, and potentially causing a denial of service.

The IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.

IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 has inadequate account lockout settings that could allow a remote attacker to brute force account credentials.

IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser.

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets.

A vulnerability in the web-based GUI of Cisco Prime Home allows an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The issue is due to a processing error in the role-based access control (RBAC) of URLs.

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.

Multiple integer overflows in libXpm before version 3.5.12 can lead to remote denial of service or arbitrary code execution. The issue occurs when a program requests parsing XPM extensions on a 64-bit platform, potentially causing a heap-based buffer overflow.

MyBB before version 1.8.8 and MyBB Merge System before version 1.8.8 have a vulnerability that allows remote attackers to achieve unspecified impact via vectors related to 'loose comparison false positives'.

MyBB (MyBulletinBoard) before version 1.8.8 and MyBB Merge System before version 1.8.8 has an SQL injection vulnerability in the users data handler. This allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 have a vulnerability that allows attackers to achieve unspecified impact via vectors related to low adminsid and sid entropy.

The newreply.php file in MyBB (MyBulletinBoard) before version 1.8.7 and MyBB Merge System before version 1.8.7 has a vulnerability that allows remote attackers to exploit a missing permission check.