CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-94

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-5543 94 2017-01-20 2017-01-20
7.5
None Remote Low Not required Partial Partial Partial
includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.
2 CVE-2016-1000003 94 Exec Code 2016-10-07 2016-12-22
7.5
None Remote Low Not required Partial Partial Partial
Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
3 CVE-2016-10157 94 2017-01-23 2017-01-23
7.5
None Remote Low Not required Partial Partial Partial
Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code within the Akamai NetSession process space.
4 CVE-2016-9949 94 Exec Code 2016-12-16 2017-01-06
9.3
Admin Remote Medium Not required Complete Complete Complete
An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code.
5 CVE-2016-9862 94 2016-12-10 2016-12-23
5.0
None Remote Low Not required None Partial None
An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.
6 CVE-2016-7968 94 Exec Code 2016-12-23 2016-12-27
7.5
None Remote Low Not required Partial Partial Partial
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.
7 CVE-2016-7967 94 2016-12-23 2016-12-27
5.8
None Remote Medium Not required Partial Partial None
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.
8 CVE-2016-7966 94 2016-12-23 2016-12-27
7.5
None Remote Low Not required Partial Partial Partial
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
9 CVE-2016-7954 94 2016-12-22 2016-12-23
7.5
None Remote Low Not required Partial Partial Partial
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
10 CVE-2016-7787 94 Exec Code 2016-12-23 2016-12-27
4.0
None Remote Low Single system None Partial None
A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.
11 CVE-2016-7110 94 Exec Code 2016-09-07 2016-09-08
10.0
None Remote Low Not required Complete Complete Complete
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7109.
12 CVE-2016-7109 94 Exec Code 2016-09-07 2016-09-08
10.0
None Remote Low Not required Complete Complete Complete
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7110.
13 CVE-2016-5734 94 Exec Code 2016-07-02 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
14 CVE-2016-5424 94 +Priv 2016-12-09 2016-12-14
4.6
None Remote High Single system Partial Partial Partial
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.
15 CVE-2016-5149 94 2016-09-11 2016-11-28
6.8
None Remote Medium Not required Partial Partial Partial
The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension, which allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL.
16 CVE-2016-3154 94 Exec Code 2016-04-08 2016-04-14
7.5
None Remote Low Not required Partial Partial Partial
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
17 CVE-2016-3153 94 Exec Code 2016-04-08 2016-04-14
7.5
None Remote Low Not required Partial Partial Partial
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
18 CVE-2016-1986 94 Exec Code 2016-02-11 2016-11-30
7.5
None Remote Low Not required Partial Partial Partial
HP Continuous Delivery Automation (CDA) 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
19 CVE-2016-1985 94 Exec Code 2016-01-30 2016-11-30
10.0
None Remote Low Not required Complete Complete Complete
HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
20 CVE-2016-1413 94 2016-05-27 2016-05-31
4.0
None Remote Low Single system None Partial None
The web interface in Cisco Firepower Management Center 5.4.0 through 6.0.0.1 allows remote authenticated users to modify pages by placing crafted code in a parameter value, aka Bug ID CSCuy76517.
21 CVE-2016-0033 94 DoS Overflow 2016-02-10 2016-12-05
5.0
None Remote Low Not required None None Partial
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to cause a denial of service (performance degradation) via crafted XSLT data, aka ".NET Framework Stack Overflow Denial of Service Vulnerability."
22 CVE-2015-8761 94 Exec Code 2016-01-08 2016-01-11
6.0
None Remote Medium Single system Partial Partial Partial
The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.
23 CVE-2015-7905 94 Exec Code 2015-11-12 2017-01-12
7.5
None Remote Low Not required Partial Partial Partial
Unitronics VisiLogic OPLC IDE before 9.8.02 allows remote attackers to execute unspecified code via unknown vectors.
24 CVE-2015-7450 94 Exec Code 2016-01-02 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
25 CVE-2015-7381 94 Exec Code File Inclusion 2015-09-27 2015-09-28
7.5
None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.
26 CVE-2015-6555 94 Exec Code 2015-11-11 2016-12-07
8.5
None Remote Medium Single system Complete Complete Complete
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port.
27 CVE-2015-5970 94 2016-02-18 2016-03-10
5.0
None Remote Low Not required Partial None None
The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.
28 CVE-2015-5721 94 2016-09-03 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
29 CVE-2015-5693 94 Exec Code 2015-09-20 2016-12-21
7.9
None Remote Medium Multiple systems Complete Complete Complete
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."
30 CVE-2015-5687 94 Exec Code 2015-10-05 2015-10-06
7.5
None Remote Low Not required Partial Partial Partial
system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie.
31 CVE-2015-5647 94 Exec Code 2015-10-12 2015-10-13
8.5
None Remote Medium Single system Complete Complete Complete
The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866.
32 CVE-2015-5646 94 Exec Code 2015-10-12 2015-10-13
8.5
None Remote Medium Single system Complete Complete Complete
Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867.
33 CVE-2015-5644 94 Exec Code 2015-10-05 2015-10-07
6.8
None Remote Medium Not required Partial Partial Partial
The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
34 CVE-2015-5643 94 Exec Code 2015-10-05 2015-10-07
6.8
None Remote Medium Not required Partial Partial Partial
The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
35 CVE-2015-5603 94 Exec Code 2015-09-21 2016-12-07
6.5
None Remote Low Single system Partial Partial Partial
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."
36 CVE-2015-5242 94 Exec Code 2015-11-25 2015-11-27
6.0
None Remote Medium Single system Partial Partial Partial
OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows remote authenticated users to execute arbitrary code via a crafted extended attribute (xattrs).
37 CVE-2015-4726 94 Exec Code File Inclusion 2015-06-23 2016-12-07
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config['basedir'] parameter.
38 CVE-2015-4338 94 2015-06-17 2015-06-18
6.5
None Remote Low Single system Partial Partial Partial
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
39 CVE-2015-3446 94 Exec Code 2015-05-01 2016-12-05
9.3
None Remote Medium Not required Complete Complete Complete
The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
40 CVE-2015-2945 94 Exec Code 2015-05-25 2015-05-27
7.5
None Remote Low Not required Partial Partial Partial
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015.
41 CVE-2015-2308 94 Exec Code 2015-06-24 2016-12-02
6.8
None Remote Medium Not required Partial Partial Partial
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
42 CVE-2015-2171 94 Exec Code 2015-03-30 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.
43 CVE-2015-1699 94 Exec Code 2015-05-13 2015-07-30
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1698.
44 CVE-2015-1698 94 Exec Code 2015-05-13 2016-12-09
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1699.
45 CVE-2015-1697 94 Exec Code 2015-05-13 2016-12-09
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1698, and CVE-2015-1699.
46 CVE-2015-1696 94 Exec Code 2015-05-13 2016-12-09
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
47 CVE-2015-1695 94 Exec Code 2015-05-13 2015-07-30
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
48 CVE-2015-1675 94 Exec Code 2015-05-13 2015-07-30
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
49 CVE-2015-1645 94 Exec Code 2015-04-14 2015-09-16
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka "EMF Processing Remote Code Execution Vulnerability."
50 CVE-2015-1635 94 Exec Code 2015-04-14 2017-01-02
10.0
None Remote Low Not required Complete Complete Complete
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Total number of vulnerabilities : 2069   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.