CVE Vulnerability Catalog

A vulnerability in the Fuji Xerox FXPS print engine allows attackers to use the FTP printing interface as a proxy (FTP bounce). By manipulating PORT arguments in FTP requests, an attacker can connect to systems that would otherwise be restricted.

A PHP remote file inclusion (RFI) vulnerability in ToendaCMS 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tcms_administer_site parameter. The issue has been disputed by a third party, who states that $tcms_administer_site is initialized to a constant value within index.php.

SQL injection vulnerability in user logon authentication request handling in Cool_CoolD.exe in Cool Manager 5.0 (5,60,90,28) and Cool Messenger Office/School Server 5.5 (5,65,12,13). A remote attacker can execute arbitrary SQL commands via the username field.

SQL injection vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

PHP remote file inclusion vulnerability in config.kochsuite.php in the Kochsuite (com_kochsuite) 0.9.4 component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

A stack-based buffer overflow exists in channels/chan_mgcp.c in MGCP in Asterisk versions 1.0 through 1.2.10. A remote attacker can execute arbitrary code by sending a crafted audit endpoint (AUEP) response.

Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.

The EstateAgent component (com_estateagent) for Mambo contains a remote file inclusion vulnerability in estateagent.php. When register_globals is enabled, a remote attacker can execute arbitrary PHP code by supplying a URL in the mosConfig_absolute_path parameter.

Remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component (com_cpg) 1.0 and earlier for Mambo. Attackers can execute arbitrary PHP code remotely by supplying a malicious URL in the mosConfig_absolute_path parameter.

A buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to format (such as the "File System Management" RBAC profile) to execute arbitrary code via unknown vectors. This is a different vulnerability than CVE-2006-4307.

Multiple PHP remote file inclusion vulnerabilities in Shadows Rising RPG (Pre-Alpha) 0.0.5b and earlier allow remote attackers to execute arbitrary PHP code. The flaw is triggered via a URL in the CONFIG[gameroot] parameter to security.inc.php, smarty.inc.php, and qlib/smarty.inc.php.

Stack-based buffer overflow in Justsystem Ichitaro (versions 9.x through 13.x, 2004, 2005, 2006, Government 2006, Ichitaro for Linux) and FormLiner before 20060818. A remote attacker can execute arbitrary code via a crafted document containing long Unicode strings. The vulnerability is actively exploited by malware such as Trojan.Tarodrop.

Buffer overflow vulnerability in the sppp driver in FreeBSD, NetBSD, and OpenBSD. A remote attacker can send crafted Link Control Protocol (LCP) packets with an option length exceeding the overall length, triggering the overflow. This leads to a kernel panic (denial of service), sensitive information disclosure, and possibly arbitrary code execution.

SQL injection vulnerability in list.php in CityForFree indexcity 1.0 occurs when magic_quotes_gpc is disabled. A remote attacker can execute arbitrary SQL commands via the cate_id parameter.

PHP remote file inclusion vulnerability in sef.php in the OpenSEF 2.0.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

An unquoted Windows search path vulnerability in multiple SSH Tectia products (Client/Server/Connector 5.0.0 and 5.0.1, Client/Server before 4.4.5, and Manager 2.12 and earlier) running on Windows allows local users to place a malicious executable in "Program Files" or its subdirectories, potentially leading to privilege escalation.

A vulnerability in SSH Tectia Management Agent 2.1.2 allows local users to gain root privileges. When the "Restart" action is selected from the Management server GUI, the agent locates a program named sshd from the process listing and restarts it with root privileges, enabling execution of arbitrary user programs as root.

Vulnerability in the SCTP implementation in the Linux kernel (versions 2.6.x before 2.6.17.10 and 2.4.23 up to 2.4.33) in the sctp_make_abort_user function. A local user can cause a kernel panic (denial of service) and possibly gain root privileges. The attack vectors are unknown.

An unspecified vulnerability in Sun Solaris 8 and 9 before 20060821 allows local users to execute arbitrary commands. The issue involves the default Role-Based Access Control (RBAC) settings in the "File System Management" profile.

Unspecified vulnerability in the format command in Sun Solaris 8 and 9 before 20060821 allows local users to modify arbitrary files via unspecified vectors involving profiles that permit running format with elevated privileges. This is a different issue than CVE-2006-4306 and CVE-2006-4319.