CVE Vulnerability Catalog

The newreply.php file in MyBB (MyBulletinBoard) before version 1.8.7 and MyBB Merge System before version 1.8.7 has a vulnerability that allows remote attackers to exploit a missing permission check.

There is an SQL injection vulnerability in the moderation tool in MyBB before version 1.8.7 and in the MyBB Merge System before version 1.8.7 that may allow remote attackers to execute arbitrary SQL commands.

SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB before 1.6.18 and 1.8.x before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

An issue was discovered in Radisys MRF Web Panel (SWMS) version 9.0.1, where the MSM_MACRO_NAME POST parameter in /swms/ms.cgi is vulnerable to OS command injection attacks. This allows attackers to inject arbitrary OS commands and retrieve their output in the application's responses.

In Botan versions 1.8.0 through 1.11.33, an integer overflow could occur when decoding BER data, leading to an incorrect length field being computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way that later causes memory corruption or other failures.

A NULL pointer dereference in the fimg2d driver for Android L (5.0/5.1) and M (6.0) on Samsung Exynos processors allows for unspecified impact via unknown vectors.

Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server allow remote attackers to read and delete arbitrary files via the tmpfname parameter in several PHP scripts.

SQL injection vulnerability in class-wp-query.php in WP_Query in WordPress before version 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.

An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.

An issue was discovered on the D-Link DWR-932B router that allows the command '/sbin/telnetd -l /bin/sh' to be executed by HELODBG on port 39889 (UDP).

An issue was discovered on the D-Link DWR-932B router related to undocumented TELNET and SSH services that allow logins as admin with the password 'admin' and as root with the password '1234'.

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL. There is also an apply_noauth.cgi URL that enables unauthenticated users to perform sensitive actions on the device.

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number can be used to obtain the administrator username and password in conjunction with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.

Router NETGEAR WNR2000v5 zawiera przepełnienie bufora w parametrze hidden_lang_avi podczas wywoływania adresu URL /apply.cgi?/lang_check.html. To przepełnienie bufora może być wykorzystane przez nieautoryzowanego atakującego do zdalnego wykonania kodu.

The ISO CLNS parser in tcpdump before version 4.9.0 has a buffer overflow in the clnp_print() function in print-isoclns.c.

The ISO CLNS parser in tcpdump before version 4.9.0 has a buffer overflow in the lookup_nsap() function in addrtoname.c.

The ATM parser in tcpdump before version 4.9.0 has a buffer overflow in function print-atm.c:sig_print().

The SNMP parser in tcpdump before version 4.9.0 has a buffer overflow in the asn1_parse() function in print-snmp.c.

The Q.933 parser in tcpdump before version 4.9.0 has a buffer overflow in print-fr.c:q933_print(). This is a different vulnerability than CVE-2016-8575.

In tcpdump before version 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN, and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print().