CVE-2014-8474

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

Xxe

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

CVE-2014-3712

Katello allows remote attackers to cause a denial of service memory consumption via the 1 mode parameter in the setuputils function in contentsearchcontroller.rb or 2 action parameter in the respond function in api/apicontroller.rb in app/controllers/katello/, which is passed to the tosym method...

Security feature bypass

Katello allows remote attackers to cause a denial of service memory consumption via the 1 mode parameter in the setuputils function in contentsearchcontroller.rb or 2 action parameter in the respond function in api/apicontroller.rb in app/controllers/katello/, which is passed to the tosym method...

Design/Logic Flaw

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service memory consumption via a crafted XML document, aka an XML Entity Expansion XEE attack...

EUVD-2014-7929

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service memory consumption via a crafted XML document, aka an XML Entity Expansion XEE attack...

CVE-2014-3712

Katello allows remote attackers to cause a denial of service memory consumption via the 1 mode parameter in the setuputils function in contentsearchcontroller.rb or 2 action parameter in the respond function in api/apicontroller.rb in app/controllers/katello/, which is passed to the tosym method...

CVE-2014-3712

Katello vulnerability CVE-2014-3712 allows remote attackers to cause a denial of service via memory consumption. The issue arises in the Katello code paths performing to_sym on user-supplied values: (1) mode parameter in setup_utils (content_search_controller.rb) and (2) action parameter in respo...

AIX OpenSSL Denial of Service due to memory leak in DTLS / AIX OpenSSL Patch to mitigate CVE-2014-3566 / AIX OpenSSL Denial of Service due to memory consumption

IBM SECURITY ADVISORY First Issued: The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory11.asc https://aix.software.ibm.com/aix/efixes/security/openssladvisory11.asc...

Code injection

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service memory and CPU...

CVE-2014-8080 ruby: REXML billion laughs attack via parameter entity expansion

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service memory consumption via a crafted XML document, aka an XML Entity Expansion XEE attack...

CVE-2014-3688

The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service memory consumption by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/smstatefuns.c...

Oracle Linux 6 : kernel (ELSA-2014-1392)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1392 advisory. - kernel futex: Fix errors in nested key ref-counting Denys Vlasenko 1094458 CVE-2014-0205 Tenable has extracted the preceding description block direct...

CVE-2014-7191

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service memory consumption by using a large index value to create a sparse array...

CVE-2014-7191

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service memory consumption by using a large index value to create a sparse array...

CVE-2014-3397

The network stack in Cisco TelePresence MCU Software before 4.32.30 allows remote attackers to cause a denial of service memory consumption via crafted TCP packets, aka Bug ID CSCtz35468...

Design/Logic Flaw

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service memory consumption by using a large index value to create a sparse array...

Code injection

The network stack in Cisco TelePresence MCU Software before 4.32.30 allows remote attackers to cause a denial of service memory consumption via crafted TCP packets, aka Bug ID CSCtz35468...

CVE-2014-7191

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service memory consumption by using a large index value to create a sparse array...

CVE-2014-3397

The CVE-2014-3397 affects Cisco TelePresence MCU Software prior to 4.3(2.30). The vulnerability is a memory exhaustion DoS caused by processing crafted TCP packets in the device’s network stack, enabling an unauthenticated remote attacker to exhaust memory and potentially disrupt or reload the sy...