CVE Vulnerability Catalog

Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before version 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code.

Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989) might allow authenticated remote attackers to perform unauthorized file access and modification.

In Exponent CMS 2.4.0 patch1, untrusted input is passed into the getSearchResults method in notfoundController.php. This method uses the '$term' parameter directly in SQL, leading to a SQL injection vulnerability.

SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.

In Exponent CMS v2.4.0 and older, the 'target' parameter of the 'DragnDropReRank' function is used without filtration, leading to SQL injection vulnerability.

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.

The perl script /opt/teradata/gsctools/bin/t2a.pl in Teradata Virtual Machine Community Edition v15.10 creates files in /tmp in an insecure manner, which may lead to elevated code execution.

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

The register method in the UsersModelRegistration class in Joomla! before version 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.

A stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be exploited by local attackers or attackers able to inject arguments to these binaries to execute code.

A vulnerability in the web-based graphical user interface of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.

A vulnerability in the SDP parser of Cisco Meeting Server could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This affects versions prior to 2.0.3 and Acano Server versions 1.9.x prior to 1.9.5 and 1.8.x prior to 1.8.17.

A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This affects versions of Cisco Meeting Server prior to 2.0.1 and other listed applications.

A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system.

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 is vulnerable to an SQL Injection attack.

SAP ASE version 16.0 SP02 PL03 and prior allows attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc import_sproc SQL injection.

Exponent CMS versions before 2.3.9 are vulnerable to an attacker uploading a malicious script file via redirection, allowing the script to be placed in an unprotected folder that permits script execution.

git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to 'cd ' and 'git clone ' commands.

On Samsung Galaxy S4 through S7 devices, an integer overflow condition exists within libomacp.so when parsing OMACP messages, leading to heap corruption. This can result in Denial of Service and potentially remote code execution.

A buffer overflow vulnerability was observed in the divby function of MuJS before version 8c805b4eb19cf2af689c860b77e6111d2ee439d5. Successful exploitation of this issue can lead to code execution or denial of service condition.