CVE Vulnerability Catalog

A vulnerability in PostgreSQL allows attackers to bypass SQL injection protections by using invalid encodings of multibyte characters. Affected versions include 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier.

PostgreSQL vulnerability allows bypassing SQL injection protection in applications using multibyte encodings (SJIS, BIG5, GBK, GB18030, UHC). The issue stems from improper handling of the 0x5c (backslash) byte as the trailing byte of a multibyte character by clients that do not support these encodings.

In Sitecom WL-153 router firmware before version 1.38, a vulnerability exists due to missing validation of the InternalClient parameter in UPnP requests. A remote attacker can bypass access restrictions and perform unauthorized operations, such as forwarding arbitrary traffic via AddPortMapping.

ZyXEL P-335WT router does not validate the InternalClient parameter in UPnP requests, allowing remote attackers to bypass access restrictions and perform unauthorized operations, such as adding port mappings (AddPortMapping) for arbitrary traffic.

The Linksys WRT54G Wireless-G Broadband Router has a vulnerability in UPnP handling that allows remote attackers to bypass access restrictions and perform unauthorized operations by sending a UPnP request with a modified InternalClient parameter, which is not validated. This is demonstrated by using AddPortMapping to forward arbitrary traffic.

The Edimax BR-6104K router has a vulnerability in UPnP handling that allows remote attackers to bypass access restrictions and perform unauthorized operations. By modifying the InternalClient parameter in a UPnP request, an attacker can add port forwarding rules (AddPortMapping) and redirect arbitrary network traffic.

A vulnerability in Prodder and perlpodder before version 0.5 allows remote attackers to execute arbitrary code by injecting shell metacharacters into the podcast URL (url attribute of an enclosure tag or $enc_url variable). When wget is run, the metacharacters are interpreted by the shell, leading to command execution.

SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands via the layid parameter in login.asp and main.asp.

Unspecified vulnerability in the sapdba command in SAP with Informix before version 700 and in version 700 up to patch 100 allows local users to execute arbitrary commands via insecure environment variable handling.

Multiple integer overflows in FreeType before version 2.2 were found in bdf/bdflib.c, sfnt/ttcmap.c, cff/cffgload.c, and the read_lwfn function when processing LWFN files. This vulnerability allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code.

Multiple format string vulnerabilities in OpenBOR 2.0046 and earlier, Beats of Rage (BOR) 1.0029 and earlier, and Horizontal Shooter BOR (HOR) 2.0000 and earlier allow remote code execution via format string specifiers in mod configuration files, such as the music identifier in data/scenes/intro.txt and background identifier in data/easy/1aeasy.txt, which are improperly handled in the update and shutdown functions.

A vulnerability in Ipswitch WhatsUp Professional 2006 allows a remote attacker to impersonate a trusted console by manipulating HTTP headers. User identity verification relies solely on headers, enabling authentication bypass.

SQL injection vulnerability in MyWeb Portal Office allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. The issue affects all editions: Standard, Public, Medical, Citizen, School, and Light.

Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, allowing remote attackers to gain privileges.

A vulnerability in Coppermine before version 1.4.6 allows remote attackers to upload arbitrary files via a filename with multiple file extensions when Apache has mod_mime installed.

A vulnerability in phpBazar 2.1.0 and earlier allows remote attackers to bypass authentication and gain unauthorized access to the administrative section by setting the action parameter to edit_member and the value parameter to 1 in admin/admin.php.

PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.

A PHP remote file inclusion vulnerability in config.php of phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie.

An unspecified vulnerability in the installation process of Sun Java System Directory Server 5.2 causes incorrect user data to be written to a file created during installation, allowing remote or local attackers to gain elevated privileges.

SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.