CVE Vulnerability Catalog

The XML API in Cisco TelePresence Software mishandles authentication, allowing remote attackers to execute control commands or make configuration changes via an API request.

The gadgets-integration API in Cisco Finesse versions 8.5(1) through 11.0(1) is vulnerable to server-side request forgery (SSRF) attacks via a crafted request. An attacker can exploit this vulnerability to conduct unauthorized requests to the server.

The FirePOWER Security Services Processor (SSP) module in Cisco ASA 5585-X devices with FirePOWER Services versions 5.3.1 through 6.0.0 misconfigures kernel logging, allowing remote attackers to cause a denial of service by flooding IP traffic.

Cisco FirePOWER System Software versions 5.3.x through 5.3.0.6 and 5.4.x through 5.4.0.3 on FirePOWER 7000 and 8000 appliances, as well as on the Advanced Malware Protection (AMP) for Networks component, allows remote attackers to cause a denial of service via crafted packets.

Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted packed executable.

SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

The X509_NAME_oneline function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

The asn1_d2i_read_bio function in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the 'negative zero' issue.

Integer overflow in the EVP_EncryptUpdate function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

Integer overflow in the EVP_EncodeUpdate function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h can lead to denial of service due to heap memory corruption when processing a large amount of binary data.

OpenSSL before version 0.9.6 has a flaw in handling C bitwise-shift operations that can lead to improper RSA key generation on 64-bit HP-UX platforms. This makes it easier for remote attackers to defeat cryptographic protection mechanisms.

The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, allowing local users to gain privileges by leveraging a group-writable setgid directory.

The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, allowing local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem and then executing a crafted setuid program.

The atl2_probe function in Atheros network drivers in the Linux kernel up to version 4.5.2 incorrectly enables scatter/gather I/O, allowing remote attackers to obtain sensitive information from kernel memory by reading packet data.

The tcp_cwnd_reduction function in the Linux kernel before version 4.3.5 allows remote attackers to cause a denial of service via a divide-by-zero error, leading to system crashes.

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, allowing local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem and then executing a crafted setuid program.