CVE Vulnerability Catalog

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, allowing remote attackers to read and write to arbitrary files via unknown vectors.

An unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify application configurations, and install or remove applications via vectors involving the P4 protocol.

An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.

An unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors.

SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema.

Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via various parameters.

The Pearson eSIS Enterprise Student Information System, version 3.3.0.13 and earlier, has an SQL injection vulnerability in the password reset functionality. This allows remote attackers to execute arbitrary SQL commands via the new password.

The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software before versions 8.2(5.48), 8.4(6.5), 9.0(3.1), and 9.1(2.5) allows remote attackers to cause a denial of service via crafted SIP packets.

Cisco Adaptive Security Appliance (ASA) Software versions before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections. This allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs.

Cisco Adaptive Security Appliance (ASA) Software versions before 8.2(5.47), 8.4(7.5), 8.7(1.11), 9.0(3.10), and 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access.

An unspecified vulnerability in TIBCO Spotfire's authentication modules allows remote attackers to execute arbitrary code. This affects multiple versions of Spotfire Web Player, Desktop, Server, and other components.

Multiple unspecified vulnerabilities in Google V8 before version 3.24.35.22, as used in Google Chrome before version 34.0.1847.116, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in renderer_webcolorchooser_impl.h in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.

A use-after-free vulnerability in Speech Dispatcher 0.7.1, used in Google Chrome before version 34.0.1847.116, allows remote attackers to cause application hang or potentially have unspecified other impact via a text-to-speech request.

The UnescapeURLWithOffsetsImpl function in Google Chrome before version 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.

A use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in Blink, as used in Google Chrome before version 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node.

Google V8, used in Google Chrome before version 34.0.1847.116, does not properly implement lazy deoptimization, allowing remote attackers to cause a denial of service (memory corruption) or possibly other unspecified impacts via crafted JavaScript code.

A use-after-free vulnerability in the HTMLBodyElement::insertedInto function in Blink, used in Google Chrome before version 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes.

A use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in the Web Workers implementation in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading.