CVE Vulnerability Catalog

WAGO IO 750-849 versions 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management.

The novi_process_manager_daemon service in the NoviWare software may be inadvertently exposed when an operator attempts to modify access control lists (ACLs). A bug in applying these modifications could allow remote, unauthenticated attackers to gain privileged (root) code execution on the switch.

Network interfaces of the cliengine and noviengine services in the NoviWare software may be inadvertently exposed during ACL modifications due to a bug in applying those modifications. This can lead to a stack-based buffer overflow, allowing remote, unauthenticated attackers to gain privileged (root) code execution on the switch.

The novish command-line interface, included in the NoviWare software distribution through NW400.2.6, is prone to a buffer overflow in the 'show log cli' command. A read-only user can exploit this vulnerability to gain privileged (root) code execution on the switch via command injection.

Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.

An Authentication Bypass vulnerability in ESMAC (Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product.

NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an addforum action.

Codiad versions before 2.8.4 are vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.

There is a vulnerability in the Venkman script debugger in Mozilla Firefox before version 2.0.0.8 that allows for remote code execution.

A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspecified impact.

In Qualcomm products with Android releases from CAF, in the function __mdss_fb_copy_destscaler_data(), the variable ds_data[i].scale may point to a user-provided address. In the event of an error, this address may be freed, leading to a use after free condition.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with improper validation of arguments in several QTEE syscalls.

All Qualcomm products with Android releases from CAF using the Linux kernel have an integer overflow to buffer overflow vulnerability when loading an image file.

All Qualcomm products with Android releases from CAF using the Linux kernel may have an issue with a driver that can potentially leak kernel memory.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with improper length checking in an HCI command.

All Qualcomm products with Android releases from CAF using the Linux kernel may consume excessive amounts of memory when downloading a file.

All Qualcomm products with Android releases from CAF using the Linux kernel have a configuration vulnerability when loading a 3rd-party QTEE application.

All Qualcomm products with Android releases from CAF using the Linux kernel may be vulnerable to an assertion that could be reachable in a handover scenario.

All Qualcomm products with Android releases from CAF using the Linux kernel have an array index out of bounds vulnerability in LPP.

All Qualcomm products with Android releases from CAF using the Linux kernel have a use-after-free vulnerability in IMS RCS.