CVE Vulnerability Catalog

The Stored Procedure infrastructure in IBM DB2 versions 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.

Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet.

The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, making it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack.

The vulnerability in Square Squash allows remote attackers to execute arbitrary code by manipulating a YAML document in the namespace or sourcemap parameters in the deobfuscation and sourcemap functions.

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before version 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.

The WP ecommerce Shop Styling plugin for WordPress before version 1.8 contains a PHP remote file inclusion vulnerability in includes/generate-pdf.php, allowing attackers to execute arbitrary PHP code via the dompdf parameter.

Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 (Rev. A1) with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via (1) username or (2) password.

Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 allow remote attackers to execute arbitrary SQL commands via the c[password] or c[username] parameter.

Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System before version 1.4(1i) and on various Nexus devices, allowing remote SMTP servers to execute arbitrary code via a crafted reply.

Unspecified vulnerability in HP Operations Manager versions 9.1 through 9.13 and 9.2 through 9.24 allows remote authenticated users to execute arbitrary code by leveraging the OMi operator role.

The Message Transfer Service (MTS) in Cisco NX-OS before version 6.2(7) on MDS 9000 devices and before version 6.0(2) on Nexus 7000 devices allows remote attackers to cause a denial of service through a large volume of crafted traffic, leading to NULL pointer dereference and kernel panic.

In Cisco NX-OS 5.0 before 5.0(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, remote authenticated users can gain unintended privileges within a VDC via an SSH session to a management interface.

In Cisco NX-OS 6.1 before version 6.1(5) on Nexus 7000 devices, with local authentication and multiple VDCs enabled, remote authenticated users can gain unintended privileges within another VDC via crafted SSH key data in an SSH session to a management interface.

EMC Documentum D2 versions 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allow remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries by calling a core method or a D2FS web-service method.

Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint servers to execute arbitrary code via a malformed response.

IBM WebSphere Commerce versions 6.0 Feature Pack 2 through 5, 7.0.0.0 through 7.0.0.8, and 7.0 Feature Pack 1 through 7 allow remote attackers to cause a denial of service (resource consumption and daemon crash) via a malformed id parameter in a request.

An unspecified vulnerability in Panda Gold Protection, Global Protection 2014, Internet Security 2014, and AV Pro 2014 allows local users to gain privileges via unspecified vectors.

Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C does not properly restrict access to VNC ports on the management network, allowing remote attackers to have unspecified impact.

The uploadFile function in upload/index.php in CosCMS before version 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.

GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before version 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors.