CVE Vulnerability Catalog

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a 'SYSTEM' entity containing a URL, the parser will attempt to connect to that URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before version 1.0.1.

On Broadcom BCM4355C0 Wi-Fi chips version 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects.

On Broadcom BCM4355C0 Wi-Fi chips version 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware.

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products may be vulnerable to Java deserialization issues. An unauthenticated remote attacker can exploit these vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.

The Event Espresso Lite plugin version 3.1.37.12.L for WordPress contains an SQL Injection vulnerability in the /includes/event-management/index.php file. The issue occurs via the recurrence_id parameter in requests to /wp-admin/admin.php.

The Support Ticket System plugin for WordPress before version 1.2.1 contains multiple SQL injection vulnerabilities in includes/update.php, allowing remote attackers to execute arbitrary SQL commands via the (1) user or (2) id parameter.

CVE-2015-7390 in TestLink before version 1.9.14 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the apikey parameter in lnl.php.

SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to search/.

A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account with a hardcoded password. An attacker can use this information to log into the system with high-privilege credentials.

A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing an unauthenticated user to execute arbitrary code and exfiltrate files.

A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing unauthenticated users to execute arbitrary SQL commands against the underlying database.

Password reset tokens in Magento CE before 1.9.2.2 and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, allowing remote attackers to obtain user passwords.

The redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager before version 3.6 allows remote authenticated users with the SuperUser role to execute arbitrary commands on any host in the RHEV environment.

There is a stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.

Versions of inspircd in Debian before 2.0.7 have an issue with improper handling of unsigned integers. This vulnerability exists due to an incomplete fix for CVE-2012-1836.

The Responsive Image Gallery plugin before version 1.2.1 for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in an add_edit_theme task on the wpdevart_gallery_themes page in the admin panel.

Server Side Request Forgery vulnerability in Vebto Pixie Image Editor versions 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.

Multiple hardcoded credentials exist in Xsuite 2.x, which may lead to unauthorized access to the system.

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, potentially allowing SQL injection attacks via plugins and themes.