CVE Vulnerability Catalog

The Framework Daemon in AlienVault Unified Security Management before version 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).

Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) MOVE request.

Multiple unspecified vulnerabilities in Google Chrome before version 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A use-after-free vulnerability in the MutationObserver::disconnect function in the DOM implementation in Blink, as used in Google Chrome before version 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.

EMC RSA Identity Management and Governance (IMG) versions 6.9 before P04 and 6.9.1 before P01 do not properly restrict password resets, allowing remote attackers to gain access via crafted use of the reset process for any valid account name.

The communication module on the Hospira LifeCare PCA Infusion System before version 7.0 does not require authentication for root TELNET sessions, allowing remote attackers to modify the pump configuration via unspecified commands.

HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS) before 4.1 patch 3 and 4.2 before patch 1 do not require authentication for JBoss RMI requests, allowing remote attackers to execute arbitrary code by (1) uploading this code within an archive or (2) instantiating a class.

Unspecified vulnerability in HP Storage Data Protector 7.x before 7.03 build 107 allows remote authenticated users to execute arbitrary code or cause a denial of service via unknown vectors.

IBM WebSphere Application Server (WAS) has a vulnerability that allows remote attackers to gain privileges via unspecified vectors when the OAuth grant type requires sending a password.

Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.

The Remote Document Conversion Service (DCS) in IBM WebSphere Portal versions 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.

The sqlite3VXPrintf function in SQLite before version 3.8.9 does not properly handle precision and width values during floating-point conversions, which can lead to integer overflow and stack-based buffer overflow. Attackers can exploit this in context to cause denial of service or potentially other unspecified impacts.

The sqlite3VdbeExec function in SQLite before version 3.8.9 does not properly implement comparison operators, allowing attackers to cause a denial of service or potentially other unspecified impacts via a crafted CHECK clause.

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, allowing context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause.

The sanitize_cookie_path function in cURL and libcurl versions 7.31.0 through 7.41.0 improperly calculates an index, which may lead to denial of service or other unspecified impacts via a cookie path containing only a double-quote character.

The fix_hostname function in cURL and libcurl versions 7.37.0 through 7.41.0 does not properly calculate an index, allowing remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name.

Red Hat JBoss Operations Network version 3.3.1 does not properly restrict access to certain APIs, allowing remote attackers to execute arbitrary Java methods via (1) ServerInvokerServlet or (2) SchedulerService, or cause a denial of service (disk consumption) via ContentManager.

The XXE vulnerability in Drools and jBPM before version 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impacts via a crafted BPMN2 file.

The WikiWiki module before 6.x-1.2 for Drupal has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.