CVE Vulnerability Catalog

Fiyo CMS version 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in dapur/apps/app_comment/sys_comment.php, using data from $_POST and $_REQUEST.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in comment_status.php that uses the $_GET['id'] parameter.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in comment_status.php via the $_GET['id'] parameter.

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root.

The FR-GV-301 issue in FreeRADIUS 3.x before version 3.0.15 allows a buffer overflow in the 'data2vp_wimax()' function, potentially leading to a daemon crash or arbitrary code execution by remote attackers.

The FR-GV-202 issue in FreeRADIUS 2.x before version 2.2.10 allows for a buffer overflow in the rad_coalesce() function. This can lead to a daemon crash or potentially allow remote attackers to execute arbitrary code.

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, and EMC M&R for SAS Solution Packs contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with knowledge of the default password may use these accounts to run arbitrary web service and remote procedure calls on the affected system.

Apache OpenMeetings version 1.0.0 uses weak cryptographic storage mechanisms. Additionally, the lack of captcha in registration and password reset forms, as well as missing brute force protection in authentication forms, increases the risk.

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.

A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to execute shell commands and elevate privileges.

On Junos OS devices with SNMP enabled, a network-based attacker with unfiltered access to the RE can cause the snmpd daemon to crash and restart by sending a crafted SNMP packet. Repeated crashes can lead to a partial denial of service condition and may allow for remote code execution.

The Integrated User Firewall (UserFW) feature in Junos OS version 12.1X47-D10 on Juniper SRX devices introduced integration of user profiles with existing firewall policies. During a security review, hardcoded credentials were identified and removed, which can impact both SRX devices and integrated LDAP and Active Directory points.

A reflected cross site scripting vulnerability in the NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN allows an attacker to inject HTML/JavaScript content into the management session of other users, including the administrator.

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, the msgfmt_parse_message function in msgformat_parse.c does not restrict locale length, which can lead to stack-based buffer overflow and application crash.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in sys_article.php via the name parameter when editing or adding a tag name.

dataTaker DT8x dEX w wersji 1.72.007 pozwala zdalnym atakującym na tworzenie programów lub harmonogramów, co może prowadzić do wysyłania wiadomości e-mail lub nawiązywania połączeń z serwerami FTP w celu przesyłania danych.

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.

GLPI versions before 9.1.5 are vulnerable to SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.