CVE Vulnerability Catalog

Unspecified vulnerability in the NSM XDB service in Juniper NSM before version 2012.2R8 allows remote attackers to execute arbitrary code via unspecified vectors.

OpenVAS Administrator versions 1.2 before 1.2.2 and 1.3 before 1.3.2 allow remote attackers to bypass OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information.

OpenVAS Manager versions 3.0 before 3.0.7 and 4.0 before 4.0.4 allow remote attackers to bypass OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information.

Skybox View Appliances with ISO versions 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2.57 do not properly restrict access to the Admin interface. This allows remote attackers to obtain sensitive information and cause denial of service through specific requests.

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by inc/public/lib.urlhandlers.php or plugins/pages/_public.php.

Multiple SQL injection vulnerabilities in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) search or (2) list functionality.

A stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (TORQUE Resource Manager) versions 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.

The server in Symantec Workspace Streaming (SWS) before version 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS.

IBM WebSphere Application Server versions 6.1.0.0 through 6.1.0.47 and 6.0.2.0 through 6.0.2.43 are vulnerable to a denial of service attack that can be executed via crafted TLS traffic.

A directory traversal vulnerability in IBM Eclipse Help System (IEHS) allows remote attackers to read arbitrary files via a crafted URL.

A stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, and other mentioned versions allows remote attackers to execute arbitrary code via a crafted packet.

EMC RSA NetWitness before version 9.8.5.19 and RSA Security Analytics before versions 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, allowing remote attackers to bypass authentication by leveraging knowledge of a valid account name.

CVE-2014-3757 describes an SQL injection vulnerability in sorter.php in the phpManufaktur kitForm extension version 0.43 and earlier for the KeepInTouch (KIT) module. This allows remote attackers to execute arbitrary SQL commands via the sorter_value parameter.

Multiple integer overflows in the fs_get_reply, fs_alloc_glyphs, and fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply.

Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.

Multiple SQL injection vulnerabilities in GLPI before version 0.83.9 allow remote attackers to execute arbitrary SQL commands through various parameters in the application.

Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as exploited in the wild in May 2014.

Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content, known as 'Web Applications Page Content Vulnerability.'