CVE Vulnerability Catalog

Cisco DTA Control System (DTACS) version 4.0.0.9 and Cisco Headend System Release are vulnerable to remote attacks that can lead to denial of service through excessive CPU and memory consumption and TCP service outage. Attackers can exploit a SYN flood or another type of TCP traffic flood.

The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SOAP request to the (1) getBackupPolicy or (2) getBackupPolicies method.

Integer overflow in the libnv6 module in Dell NetVault Backup before version 10.0.5 allows remote attackers to execute arbitrary code via crafted template string specifiers in a serialized object, triggering a heap-based buffer overflow.

CVE-2015-4060 involves a heap-based buffer overflow in the TermProxy (WLTermProxyService.exe) service in Wavelink ConnectPro, which can be exploited by remote attackers to execute arbitrary code via a large HTTP header.

Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute arbitrary code via a large HTTP header.

In IPsec-Tools version 0.8.2, a vulnerability allows remote attackers to cause the IKE daemon to crash by sending a series of crafted UDP requests, leading to a NULL pointer dereference.

In the Developer tools of Visual Mining NetCharts Server, the projectContents.jsp file allows remote attackers to rename arbitrary files, potentially leading to their execution.

Directory traversal vulnerability in saveFile.jsp in the development installation of Visual Mining NetChart allows remote attackers to write to arbitrary files via unspecified vectors.

The nbd-server.c file in Network Block Device (nbd-server) before version 3.11 does not properly handle signals, allowing remote attackers to cause a denial of service (deadlock) via unspecified vectors.

Cisco Finesse version 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document.

Cisco IP Phone 7861 with firmware from Cisco Unified Communications Manager 10.3(1) allows remote attackers to cause a denial of service via crafted packets.

AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.

The modern style negotiation in Network Block Device (nbd-server) versions 2.9.22 through 3.3 allows remote attackers to cause a denial of service by terminating the root process. This can be achieved by closing the connection during negotiation or specifying a name for a non-existent export.

SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.

The ReFlex Gallery plugin before version 3.1.4 for WordPress has an unrestricted file upload vulnerability. Attackers can upload a PHP file, allowing arbitrary PHP code execution.

Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors.

Aruba Networks ClearPass Policy Manager (CPPM) before 6.5.0 allows remote administrators to execute arbitrary code via unspecified vectors.

CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature.

The __driver_rfc4106_decrypt function in the Linux kernel before version 3.19.3 improperly determines the memory locations used for encrypted data, which can lead to buffer overflow and system crash or potentially arbitrary code execution.

Multiple memory leaks in the x11_init_protocol function in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service via a crafted packet.