CVE Vulnerability Catalog

Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-1712.

Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-1705.

Microsoft Office 2007 SP3 contains a vulnerability that allows remote attackers to execute arbitrary code via a crafted document, known as 'Microsoft Office Memory Corruption Vulnerability.'

A vulnerability in Microsoft Office and related applications allows remote attackers to execute arbitrary code via a crafted document. This affects multiple versions of Office, including Office 2010, 2013, and Mac applications.

A vulnerability in Microsoft Windows allows remote attackers to execute arbitrary code via a crafted Journal file. This affects multiple versions of Windows, including Vista, 7, 8, 8.1, and Server 2008 and 2012.

The Windows Forms libraries in Microsoft .NET Framework allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application. This is a privilege elevation vulnerability.

Microsoft Internet Explorer 11 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website. This is a memory corruption vulnerability.

Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code.

SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors.

Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors.

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before version 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php and through PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.

An unrestricted file upload vulnerability exists in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before version 3.3-1421902800. Attackers can upload a file with an executable extension, allowing remote code execution.

Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.5 Build 53.9 through 55.8 and 10.5.e Build 53-9010.e are vulnerable to remote attacks that can cause a denial of service (reboot) via unspecified vectors.

Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, allowing man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.

Lenovo System Update before version 5.06.0034 uses predictable security tokens, allowing local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.

Cisco UCS Central Software before version 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request.

ftagent.exe in EMC AutoStart versions 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets.