CVE Vulnerability Catalog

A stack-based buffer overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before version 0.18.3. It could allow a remote denial of service or code execution attack.

SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.

SQL Injection exists in the EyesOfNetwork web interface (eonweb) 5.1-0 via the user_id cookie to header.php.

CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.

SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.

In the mboxlist_do_find function in Cyrus IMAP before version 3.0.4, an off-by-one error in prefix calculation for the LIST command led to the use of uninitialized memory. This may allow remote attackers to obtain sensitive information or cause a daemon crash.

A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, Integra 500, and iSite ATG consoles. An attacker may create an application user account to gain administrative privileges.

A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles. The application is vulnerable to injection of malicious SQL queries via the input from the client.

Multiple SQL injection vulnerabilities in Synology Photo Station before version 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

CVE-2015-5052 is an SQL injection vulnerability in Sefrengo before version 1.6.5 beta2.

Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.

There is an SQL injection vulnerability in Pragyan CMS 3.0, which may allow attackers to execute unauthorized queries against the database.

strongSwan versions 5.2.2 and 5.3.0 allow remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.

The WordPress Community Events plugin before version 1.4 contains a SQL injection vulnerability.

The WatuPRO plugin before version 5.5.3.7 for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which allows an attacker to restore a router to its factory settings by simply browsing to a specific link. Due to improper authentication on this page, the software accepts the request, allowing the attacker to reset the router to its default configurations.

The XXE vulnerability in the GlobalProtect gateway interface in PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive information, cause denial of service, or conduct SSRF attacks.

Lexmark Scan To Network (SNF) version 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests. This allows remote attackers to obtain sensitive information via specific requests.

A session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors.

Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.