CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in PHP files.

CareFusion Pyxis SupplyStation 8.1 with hardware test tool before version 1.0.16 has a hardcoded service password, which makes it easier for remote attackers to obtain access via unspecified vectors.

IBM TRIRIGA Application Platform versions 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL.

A memory leak in the tls_decrypt_ticket function in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service via a crafted session ticket that triggers an integrity-check failure.

A memory leak in OpenSSL 1.0.1 before 1.0.1j in the DTLS SRTP extension allows remote attackers to cause a denial of service through a crafted handshake message.

A race condition in the IP logging feature in Cisco Intrusion Prevention System (IPS) Software 7.1(7)E4 and earlier allows remote attackers to cause a denial of service (device reload) via crafted IP traffic that matches a problematic rule.

The Cisco TelePresence MCU Software before version 4.3(2.30) has a vulnerability that allows remote attackers to cause a denial of service through crafted TCP packets, leading to memory exhaustion.

Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.1.1 are vulnerable to remote attacks that can lead to denial of service by sending crafted SIP packets.

The SIP IX implementation in Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service (device reload) via crafted SDP packets.

Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.2 are vulnerable to an attack that can lead to a denial of service by sending a high rate of crafted packets. Attackers can remotely cause a device reload.

Apple OS X versions prior to 10.10 are vulnerable to an attack that can lead to denial of service via NULL pointer dereference when processing crafted ASN.1 data.

A heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute arbitrary code via crafted resource forks in an HFS filesystem.

The vulnerability in App Sandbox in Apple OS X before version 10.10 allows attackers to bypass the sandbox protection mechanism via the accessibility API.

Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.

CVE-2014-8306 is an SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before version 4.0. It allows remote attackers to execute arbitrary SQL commands via the item_id variable.

Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow.

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, allowing remote attackers to conduct SQL injection attacks via an array containing crafted keys.

An unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.