CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities have been found in Invision Power Board (IPB) versions 1.x and 2.x. Remote attackers can execute arbitrary SQL commands via parameters such as idcat, code, id, CODE, and member_id in various actions and files (including index.php and coins_list.php). The developer has disputed some of these vectors, stating that the CODE attribute is never present in SQL queries and that the 'ketqua' action and 'coin_list.php' file are not standard IPB 2.x features.

Multiple SQL injection vulnerabilities exist in Invision Power Board (IPB) 1.3 Final, allowing remote attackers to execute arbitrary SQL commands via the CODE parameter in the Stats, Mail, and Reg actions of index.php. The developer has disputed this issue, stating that the CODE parameter does not interact with the database and is only used in a SWITCH statement to select a function.

Directory traversal vulnerability in index.php in MKPortal 1.0.1 Final allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language cookie. Attackers can inject PHP sequences into the error.log file using a gl_session cookie, which is then included by index.php with malicious commands accessible via the ind parameter.

A vulnerability in PlaNet Concept planetNews allows remote attackers to bypass authentication and execute arbitrary code via a direct request to news/admin/planetnews.php.

PHP remote file inclusion vulnerability in index.php in Randshop before 1.2 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter, a different vector than CVE-2006-3375.

A vulnerability in includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates authentication credentials from request parameters. A remote attacker can modify the pass and session parameters, as well as the pass and userlevel indices of the Pivot_Vars[] or Users[] array parameters, to obtain privileges and upload arbitrary files.

Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding, which allows remote attackers to read arbitrary files via encoded dot dot (%2E%2E) sequences in an HTTP GET request for a file path containing "/content".

Direct static code injection vulnerability in code/class_db_text.php in EJ3 TOPo 2.2.178 and earlier allows remote attackers to execute arbitrary PHP code via parameters such as descripcion and pais, which are stored directly in a PHP script.

SQL injection vulnerability in category.php in PHCDownload 1.0.0 Final and 1.0.0 Release Candidate 6 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

BosClassifieds Classified Ads contains multiple PHP Remote File Inclusion (RFI) vulnerabilities. A remote attacker can execute arbitrary PHP code by supplying a malicious URL in the insPath parameter to index.php, recent.php, account.php, classified.php, or search.php.

PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4. When register_globals is enabled, a remote attacker can execute arbitrary PHP code via the pluginpath[0] parameter containing a URL.

Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.

SQL injection vulnerability in the loginADP function in ajaxp.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.

SQL injection vulnerability in SayfalaAltList.asp in Webvizyon Portal 2006 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

PHP remote file inclusion vulnerability in stats.php in RW::Download, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

FreeHost contains multiple SQL injection vulnerabilities in the readme parameter (misc.php) and index parameter (news.php), allowing remote attackers to execute arbitrary SQL commands.

An unspecified vulnerability in Microsoft Office 2003 SP1/SP2, Office XP SP3, Office 2000 SP3, and other products allows user-assisted attackers to execute arbitrary code via a crafted Office file with a malformed string that triggers memory corruption related to record lengths. This issue is known as the "Microsoft Office Parsing Vulnerability" and is distinct from CVE-2006-2389.

A buffer overflow vulnerability in the GIFIMP32.FLT library, used in Microsoft Office 2003 SP1/SP2, Office XP SP3, Office 2000 SP3, and other products, allows remote code execution via a crafted GIF image. The attack requires user interaction to open the malicious file.

An unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when parsed.

The DHCP Client service in Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 contains a buffer overflow vulnerability that allows a remote attacker to execute arbitrary code via a crafted DHCP response.