CVE Vulnerability Catalog

SQL injection vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. Other vectors are covered by CVE-2006-3139.

PHP remote file inclusion vulnerability in index.php in Knusperleicht Faq 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the faq_path parameter.

PHP remote file inclusion vulnerability in index.php in Knusperleicht Guestbook 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the GB_PATH parameter.

Symantec Brightmail AntiSpam (SBAS) before 6.0.4 contains multiple directory traversal vulnerabilities. When the Control Center is allowed to connect from any computer, a remote attacker can read and overwrite certain files via directory traversal sequences in DATABLOB-GET and DATABLOB-SAVE requests.

PHP remote file inclusion vulnerability in conf.php in WoWRoster (aka World of Warcraft Roster) 1.5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the subdir parameter.

Login.pm in Barracuda Spam Firewall (BSF) versions 3.3.01.001 through 3.3.03.053 contains a hard-coded password for the guest account. This allows remote attackers to read sensitive information such as e-mail logs, and possibly e-mail contents and the admin password.

PHP remote file inclusion vulnerability in hsList.php in WoWRoster (World of Warcraft Roster) 1.5.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the subdir parameter.

PHP remote file inclusion vulnerability in phpAdsNew/view.inc.php in Albasoftware Phpauction 2.1 and possibly later versions, with phpAdsNew 2.0.5, allows remote attackers to execute arbitrary PHP code via a URL in the phpAds_path parameter.

PHP remote file inclusion vulnerability in index.php in Knusperleicht Newsletter 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the NL_PATH parameter.

A remote file inclusion vulnerability in editprofile.php in php(Reactor) 1.27pl1 allows remote attackers to execute arbitrary PHP code by supplying a URL in the pathtohomedir parameter.

A remote file inclusion vulnerability in quickie.php in Knusperleicht Quickie (probably version 0.2) allows remote attackers to execute arbitrary PHP code by supplying a URL in the QUICK_PATH parameter.

Savant2, a PHP templating library by Paul M. Jones, contains multiple remote file inclusion (RFI) vulnerabilities. The vulnerabilities occur possibly when used with the com_mtree component for Mambo and Joomla!, allowing remote attackers to execute arbitrary PHP code by manipulating the mosConfig_absolute_path parameter in multiple Savant2 files.

Remote file inclusion (RFI) vulnerability in about.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for Mambo 4.5. Attackers can execute arbitrary PHP code remotely by supplying a malicious URL in the mosConfig_absolute_path parameter.

SQL injection vulnerability in the u2u_send_recp function in u2u.inc.php in XMB (extreme message board) 1.9.6 Alpha and earlier. The u2uid parameter passed to u2u.php is taken directly from $_POST, bypassing the protection scheme and allowing arbitrary SQL command execution.

Stack-based buffer overflow in DZIPS32.DLL 6.0.0.4 in ConeXware PowerArchiver 9.62.03 allows user-assisted attackers to execute arbitrary code by adding a new file to a crafted ZIP archive that already contains a file with a long name.

PHP remote file inclusion vulnerability in index.php in Vlad Vostrykh Voodoo chat 1.0RC1b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter.

An unspecified vulnerability in CA eTrust Antivirus WebScan before 1.1.0.1048 allows remote attackers to install arbitrary files. Technical details of the vulnerability are not specified.

A vulnerability in CA eTrust Antivirus WebScan before version 1.1.0.1048 involves improper processing of outdated WebScan components. Technical details are unspecified, and the impact is unknown. The vulnerability may be exploited remotely by attackers.

A vulnerability in CA eTrust Antivirus WebScan is caused by improper bounds checking when processing certain user input. This allows remote attackers to execute arbitrary code.

A vulnerability in WebKit in Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML document that causes WebKit to access an object that has already been deallocated.