CVE Vulnerability Catalog

Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handling.

The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors.

SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors.

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have default passwords, making it easier for remote attackers to gain access to sensitive information.

SQL injection vulnerability in info.php in CookieViz before version 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter.

In the libavcodec library in FFmpeg before version 2.4.2, the number of channels is not constrained to at most 2, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted On2 data.

An off-by-one error in libavcodec/smc.c in FFmpeg before version 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (SMC) video data.

In libavcodec/gifdec.c in FFmpeg before version 2.4.2, image heights are not properly computed, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.

An integer underflow in libavcodec/cinepak.c in FFmpeg before version 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Cinepak video data.

In libavcodec/pngdec.c in FFmpeg before version 2.4.2, the monochrome-black format is accepted without verifying that the bits-per-pixel value is 1. This allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.

In libavcodec/tiff.c in FFmpeg before version 2.4.2, bits-per-pixel fields are not properly validated, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted TIFF data.

In the libavcodec library in FFmpeg before version 2.4.2, not all lines of HHV Intra blocks are considered during image height validation. This may allow remote attackers to cause a denial of service (out-of-bounds access) or potentially have unspecified other impact via crafted MM video data.

In libavcodec in FFmpeg before version 2.4.2, a certain codec ID is omitted during alignment enforcement, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.

In libavcodec/mjpegdec.c in FFmpeg before version 2.4.2, only dimension differences are considered when determining whether an image size has changed, not bits-per-pixel differences. This allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.

CVE-2014-5417 is a cross-site scripting (XSS) vulnerability in the Meinberg NTP Server firmware on LANTIME M-Series devices version 6.15.019 and earlier. It allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.

CVE-2014-5408 is an XSS vulnerability in the login script of the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices version 15 and earlier. It allows remote attackers to inject arbitrary web scripts or HTML via the username parameter.

The AXN-NET Ethernet module version 3.04 for Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.

The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.

ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware version 3.0.0.4.376.x do not verify the integrity of firmware update information or downloaded updates. This allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.

Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.