CVE Vulnerability Catalog

On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI.

WIFICAM (P2P) Wireless IP Camera devices have a backdoor root account that can be accessed via TELNET.

TP-Link C2 and C20i devices with firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a 'host=' line within HTTP POST data.

TP-Link C2 and C20i devices with firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have backdoor accounts. These accounts include admin with password 1234, guest with password guest, and test with password test.

The eCommerce Shopsoftware version 2.0.2.2 rev 10690 contains an XXE vulnerability in the api/it-recht-kanzlei/api-it-recht-kanzlei.php file.

A vulnerability in the Solaris component of Oracle Sun Systems Products Suite allows an unauthenticated attacker with network access to compromise Solaris. While the vulnerability primarily affects Solaris, attacks may significantly impact additional products.

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (Rules Engine) allows a low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Attacks may significantly impact additional products.

Vulnerability in the Oracle Scripting component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise Oracle Scripting. Attackers can create, delete, or modify critical data and gain unauthorized access to all data accessible in Oracle Scripting.

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite, concerning the Kernel Zones virtualized NIC driver. It allows a low privileged attacker with network access to compromise Solaris.

Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite allows a high privileged attacker with network access via HTTP to compromise Primavera Gateway. The attack may significantly impact additional products in the ecosystem.

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite allows a low privileged attacker with network access via HTTP to compromise the system. Affected versions are 8.3, 8.4, 15.1, 15.2, 16.1, and 16.2.

Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools, affecting versions prior to 5.7. It allows an unauthenticated attacker with network access to compromise ASR.

A vulnerability in lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

lshell version 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code.

FreeType 2 before March 24, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.

Yeager CMS version 1.2.1 has an SQL injection vulnerability in the password recovery feature that allows remote attackers to change the account credentials of known users via the 'userEmail' parameter.

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup.

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of 'root' for the root account and 'tw' for the tw account, making it easier for remote attackers to gain administrative access.

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted information disclosure, modification of any component of the NorthStar system, including managed systems, and full denial of services to any systems under management which NorthStar interacts with using read-only or read-write credentials.