CVE Vulnerability Catalog

A stack-based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv.

A stack-based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code.

CVE-2017-12620 is a vulnerability related to XXE attacks that can occur when loading models or dictionaries containing XML in the Apache OpenNLP library. This issue affects applications that load models or dictionaries from untrusted sources.

Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters.

Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center) in all versions from HASP SRM 2.10 to Sentinel LDK 7.50 allows remote attackers to execute arbitrary code via malformed ASN.1 streams in V2C and similar input files.

The login page of the server on Huawei FusionServer rack servers RH2288 V3, RH2288H V3, XH628 V3, RH1288 V3, RH2288A V2, RH1288A V2, RH8100 V3, CH222 V3, CH220 V3, and CH121 V3 with software before specified versions allows remote attackers to bypass access restrictions and enter commands via unspecified parameters.

Intelbras WRN 150 devices allow remote attackers to read the configuration file, enabling authentication bypass via a direct request to cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie.

FileRun version 2017.09.18 and below suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module.

ERS Data System version 1.8.1.0 allows remote attackers to execute arbitrary code, related to 'com.branaghgroup.ecers.update.UpdateRequest' object deserialization.

A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabilities could be remotely exploited to allow code execution.

A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40. The vulnerability could be remotely exploited to allow code execution.

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data.

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30, and 9.40 allows remote users to bypass authentication.

MultiTech FaxFinder before version 4.1.2 stores passwords in an unencrypted form for the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext.

A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0. This flaw allows files to be executed as well as created, potentially compromising other users or teams' projects stored in source control management of the RHMAP Core installation.

The Content Timeline plugin version 4.4.2 for WordPress contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be conducted via the timeline and id parameters in the respective PHP files.

A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 allows an unauthenticated, remote attacker to bypass authentication checks when registering an Endpoint Identifier (EID) to a Routing Locator (RLOC) in the map server/map resolver (MS/MR). A logic error in the code enables the attacker to send specific valid map-registration requests that will be accepted even if the authentication keys do not match.

A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 allows an unauthenticated remote attacker to bypass authentication to the REST API. The issue is due to insufficient input validation for the REST API.

A stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before version 5.24.3-RC1 and 5.26.x before version 5.26.1-RC1 allows attackers to execute arbitrary code via a long environment variable.