CVE Vulnerability Catalog

TikiWiki 1.9.3.2 and possibly earlier versions contain an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via unknown attack vectors.

A reported PHP remote file inclusion vulnerability in talkbox.php in Amr Talkbox was said to allow remote attackers to execute arbitrary PHP code via the direct parameter. However, the issue has been disputed by CVE, since the $direct variable is set to a static value just before the include statement.

phpCMS 1.2.1pl2 contains multiple PHP remote file inclusion (RFI) vulnerabilities in files under parser/include/ and parser/plugs/. An attacker can supply a malicious URL in the PHPCMS_INCLUDEPATH parameter to execute arbitrary PHP code on the server.

Multiple PHP remote file inclusion vulnerabilities exist in ISPConfig 2.2.3. A remote attacker can execute arbitrary PHP code by supplying a malicious URL in the go_info[isp][classes_root] or go_info[server][classes_root] parameters in server.inc.php, app.inc.php, login.php, and trylogin.php. The vendor has disputed this issue, stating that the original researcher reviewed an installation tarball that differs from the system after installation.

A reported PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 could allow remote attackers to execute arbitrary PHP code via the ltw_config[include_dir] parameter. CVE disputes this claim, as the $ltw_config[include_dir] variable is defined as a static value in an include file before being referenced in an include() statement.

PHP remote file inclusion vulnerability in stat_modules/users_age/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

Multiple SQL injection vulnerabilities exist in Enthrallwebe ePhotos 2.2 and earlier. A remote attacker can execute arbitrary SQL commands via the CAT_ID parameter in subphotos.asp and subLevel2.asp, the AL_ID parameter in photo.asp, and the SUB_ID parameter in subLevel2.asp.

The vulnerability in artswrapper in aRts, when running setuid root on Linux 2.6.0 or later, does not check the return value of the setuid function call. This allows local users to gain root privileges by causing setuid to fail, preventing artsd from dropping privileges.

Unspecified vulnerability in session.c in PHP before 5.1.3 involves unknown impact and attack vectors related to certain characters in session names, including special characters associated with CRLF injection, SQL injection, XSS, and HTTP response splitting. PHP applications expect session names to be alphanumeric, as implied in the PHP manual for session_name().

Unspecified vulnerability in the session extension functionality in PHP before 5.1.3 has unknown impact and attack vectors related to heap corruption.

A vulnerability in zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element. This prevents a variable from being unset even when the PHP unset function is called, potentially leading to its value being used in security-relevant operations.

Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI.

Open Business Management (OBM) 1.0.3 pl1 contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the new_order, order_dir, entity, and tf_dateafter parameters in several files, including index.php, group/group_index.php, user/user_index.php, list/list_index.php, and company/company_index.php.

Buffer overflow vulnerability in the Remote Access Connection Manager (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier. Remote unauthenticated or authenticated attackers can execute arbitrary code via crafted RPC requests, leading to registry and stack corruption.

An unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via unexpected data related to parameter validation in the DXImageTransform.Microsoft.Light ActiveX control, causing Internet Explorer to crash in a way that enables code execution.

A buffer overflow vulnerability exists in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier. This allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing.

A heap-based buffer overflow exists in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier. Remote attackers can execute arbitrary code via crafted UTF-8 encoded HTML that causes size discrepancies during Unicode conversion.

An unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when saved as a multipart HTML (.mht) file.

The SMB driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier contains a privilege escalation vulnerability. A local user can call the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER flag and an arbitrary kernel memory address, leading to arbitrary code execution.

Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls, causing memory corruption during garbage collection.