CVE Vulnerability Catalog

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function.

CVE-2015-2070 is an SQL injection vulnerability in eTouch SamePage Enterprise Edition version 4.4.0.0.239 that allows remote attackers to execute arbitrary SQL commands via the catId parameter to cm/blogrss/feed.

SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.

The Apptha WordPress Video Gallery (contus-video-gallery) plugin before version 2.8 contains an SQL injection vulnerability in the videogalleryrss.php file. Remote attackers can execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php.

Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager before version 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors in GetClientPackage.aspx or GetProcessedPackage.aspx.

The nss_dns implementation of getnetbyname in GNU C Library (glibc) before version 2.21 allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being processed.

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, allowing remote attackers to execute arbitrary code via crafted Netlogon packets.

Zhone GPON 2520 with firmware R4.0.2.566b is vulnerable to a denial of service attack that can be executed by remote attackers using a long string in the oldpassword parameter.

A stack-based buffer overflow in the DIR-645 router with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary code via a long string in a GetDeviceSettings action to the HNAP interface.

D-Link DAP-1320 Rev Ax with firmware before version 1.21b05 allows attackers to execute arbitrary commands via unspecified vectors.

The D-Link DCS-931L with firmware 1.04 and earlier has an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.

Buffer overflow in the charset_to_intern function in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string.

A stack-based buffer overflow exists in the dsmtca client in IBM Tivoli Storage Manager (TSM) affecting versions 5.4 through 5.4.3.6, 5.5 through 5.5.4.3, 6.1 through 6.1.5.6, 6.2 before 6.2.5.4, and 6.3 before 6.3.2.3 on UNIX, Linux, and OS X. This allows local users to gain privileges via unspecified vectors.

A race condition in the SSL implementation on Cisco Intrusion Prevention System (IPS) devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an upgrade.

Cisco IOS XR versions 5.0.1 and 5.2.1 on Network Convergence System 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X devices allow remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers.

Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.269 and 14.x through 16.x before version 16.0.0.305 on Windows and OS X and before version 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.

XXE vulnerability in the JBPMBpmn2ResourceImpl function in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files by importing a crafted BPMN2 file.