CVE Vulnerability Catalog

A use-after-free vulnerability in the GPU process implementation in Google Chrome before version 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown.

An unspecified vulnerability in Uconnect before version 15.26.1, used in certain Fiat Chrysler Automobiles (FCA) models from 2013 to 2015, allows remote attackers on the same cellular network to control vehicle movement and modify dashboard settings.

Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client may allow remote attackers to execute arbitrary code or obtain sensitive information. This affects versions before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1.

Cisco Videoscape Policy Resource Manager (PRM) version 3.5.4 is vulnerable to remote attacks that can lead to denial of service through excessive CPU and memory consumption and TCP service outage. Attackers can exploit a SYN flood or another type of TCP traffic flood.

Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect.

The scalar-function implementation in IBM DB2 versions 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.

Eaton Cooper Power Systems ProView versions 4.0 and 5.0 before 5.0 11 generate TCP initial sequence number (ISN) values linearly, making it easier for remote attackers to spoof TCP sessions by predicting an ISN value.

Multiple SQL injection vulnerabilities in Sysphonic Thetis before version 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

A vulnerability has been identified in the EN100 Ethernet module for various firmware variants that could lead to denial-of-service. Specifically crafted packets sent to port 50000/UDP could cause the device to crash.

The NVIDIA GPU driver for FreeBSD in versions R352 before 352.09, 346 before 346.72, R349 before 349.16, R343 before 343.36, R340 before 340.76, R337 before 337.25, R334 before 334.21, R331 before 331.113, and R304 before 304.125 allows local users with certain permissions to read or write arbitrary kernel memory via unspecified vectors that trigger an untrusted pointer dereference.

A vulnerability in Cisco Videoscape Distribution Suite Service Broker (VDS-SB) allows remote attackers to cause a denial of service (device reload) via a crafted HTTP request. This affects VDSM configuration on UCS and VDS-IS versions before 3.3.1 R7 and 4.x before 4.0.0 R4.

Siemens SICAM MIC devices with firmware before version 2404 allow remote attackers to bypass authentication and gain administrative access via unspecified HTTP requests.

The Management Interface in Citrix NetScaler ADC and NetScaler Gateway before version 10.1.132.8 and 10.5 before Build 56.15 allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to rapi/ipsec_logs.

CVE-2015-3621 in SAP Enterprise Central Component (ECC) has an untrusted search path vulnerability that allows local users to gain privileges via a Trojan horse program.

The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, allowing local users to gain privileges via a Trojan horse XeService.exe file.

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to compromise internal state of an application via unspecified vectors.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability.