CVE Vulnerability Catalog

The vulnerability in Schannel in Microsoft Windows allows remote attackers to execute arbitrary code via crafted packets. It affects multiple versions of operating systems, including Windows Server 2003, Windows Vista, Windows 7, Windows 8, and Windows Server 2012.

Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows allows remote attackers to cause a denial of service (reboot) via a crafted TrueType font.

A vulnerability in Microsoft .NET Framework related to improper TypeFilterLevel checks, allowing remote attackers to execute arbitrary code via crafted data sent to a .NET Remoting endpoint.

Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'

XML Core Services (aka MSXML) 3.0 in Microsoft Windows allows remote attackers to execute arbitrary code or cause a denial of service via crafted XML content.

A vulnerability in Microsoft Windows Server 2003 SP2 allows local users to gain elevated privileges via a crafted IOCTL call to tcpip.sys or tcpip6.sys.

The kvm_iommu_map_pages function in the Linux kernel through version 3.17.2 miscalculates the number of pages during the handling of a mapping failure, allowing guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges.

The Linux kernel up to version 3.17.2 has an issue with handling private syscall numbers in the ftrace subsystem, allowing local users to gain privileges or cause a denial of service via a crafted application.

The Linux kernel up to version 3.17.2 has an issue with handling private syscall numbers in the perf subsystem, which may allow local users to cause denial of service or bypass the ASLR protection mechanism via a crafted application.

The sctp_assoc_lookup_asconf_ack function in the SCTP implementation in the Linux kernel through version 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

The SCTP implementation in the Linux kernel through version 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk.

A use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to TCP port 1599.

CVE-2014-4627 is an SQL injection vulnerability in EMC RSA Web Threat Detection versions 4.x before 4.6.1.1, allowing remote authenticated users to execute arbitrary SQL commands.

The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The network-diagnostics administration interface in the Cisco RV router firmware on RV220W devices, RV120W devices, and RV180 and RV180W devices before specified versions allows remote authenticated users to execute arbitrary commands via a crafted HTTP request.

The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.

SQL injection vulnerability in SAP Contract Accounting allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

SQL injection vulnerability in Product Safety (EHS-SAF) component in SAP Environment, Health, and Safety Management allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors.