CVE Vulnerability Catalog

A vulnerability in Papyrus NASCAR Racing 4 (4.1.3.1.6 and earlier), 2002 Season (1.1.0.2 and earlier), and 2003 Season (1.2.0.1 and earlier) allows remote attackers to cause a denial of service (CPU consumption) by sending an empty UDP datagram, which is not properly discarded due to the use of the FIONREAD asynchronous socket.

Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including wv, abiword, freetype, gimp, libgsf, and imagemagick. The vulnerability allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.

PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter.

NewsPHP 2006 PRO contains multiple SQL injection vulnerabilities in index.php and inc/rss_feed.php. Remote attackers can inject arbitrary web script or HTML via the words, id, topmenuitem, cat_id, and category parameters.

Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.

Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code via a long URL, which is not properly terminated before being used with the strncpy function. This appears to be the result of an incomplete patch for CVE-2004-0982.

A stack-based buffer overflow exists in the CG_ServerCommand function of the Quake 3 Engine as used by Soldier of Fortune 2 (SOF2MP) GOLD 1.03. A remote attacker can send a long command from the server, causing a denial of service and potentially executing arbitrary code.

SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. It is uncertain whether this is a vulnerability or a feature of the product.

SQL injection vulnerability in index.php in the NP_SEO plugin in BLOG:CMS before 4.1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

PHP remote file inclusion vulnerability in index.php in Randshop 1.2 and earlier, including 0.9.3, allows remote attackers to execute arbitrary PHP code via a URL in the 'incl' parameter.

A vulnerability in the passwd command from the shadow package in Ubuntu 5.04 through 6.06 LTS: when called with the -f, -g, or -s flag, it does not check the return code of a setuid call. If setuid fails (e.g., due to PAM failures or resource limits), a local user might gain root privileges.

SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary SQL commands via the where parameter in a view action.

VirtuaStore 2.0 contains an SQL injection vulnerability in the password parameter during login. A remote attacker can execute arbitrary SQL commands, potentially leading to unauthorized database access.

Stack-based buffer overflow in the Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c. Remote attackers can exploit long CS_ITEMS values to cause a denial of service and possibly execute arbitrary code.

The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call. This could allow local users to gain privileges by causing setuid to fail, such as exceeding PAM limits for the maximum number of user processes, which prevents the winbind NTLM authentication helper from dropping privileges.

Siemens Speedstream Wireless Router 2624 allows local users to bypass authentication and access protected files by using the Universal Plug and Play UPnP/1.0 component.

HSPcomplete versions 3.2.2, 3.3 Beta and earlier contain multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via the 'type' parameter in report.php and the 'level' parameter in custom_buttons.php.

SQL injection vulnerability in tree.php in MyNewsGroups 0.6 allows remote attackers to execute arbitrary SQL commands via the grp_id parameter.

Multiple SQL injection vulnerabilities exist in SmS Script. A remote attacker can execute arbitrary SQL commands via the CatID parameter in cat.php and add.php.

SQL injection vulnerability in index.php in deV!Lz Clanportal DZCP 1.3.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.