Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.
LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files.
CloudView NMS before 2.10a has XSS via SNMP.
CloudView NMS before 2.10a has a format string issue exploitable over SNMP.
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.
Paessler PRTG before 16.2.24.4045 has XSS via SNMP.
OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.