CVE Vulnerability Catalog

In rsync before version 2.6.8, an integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) may allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.

A buffer overflow vulnerability was discovered in pdnsd before version 1.2.4 with unknown impact and attack vectors. This issue may be related to the OUSPG PROTOS DNS test suite.

Multiple unspecified vulnerabilities in FITELnet products (F40, F80, F100, F120, F1000, E20/E30) allow remote attackers to cause a denial of service (DoS) via crafted DNS messages that trigger errors in ProxyDNS or PKI-Resolver. The vulnerability was demonstrated using the OUSPG PROTOS DNS test suite.

An unspecified vulnerability in Juniper Networks JUNOSe E-series routers before version 7-1-1, related to the DNS client code, can be exploited remotely. The issue was identified by the OUSPG PROTOS DNS test suite.

Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101 and other versions allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.

SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. This issue can be leveraged to execute arbitrary PHP code by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.

SQL injection vulnerability in vb_board_functions.php in MKPortal 1.1, as used with vBulletin 3.5.4 and earlier, allows remote attackers to execute arbitrary SQL commands via the userid parameter.

The na-img-4.0.34.bin software for the IP3 Networks NetAccess NA75 has a default administrative account with username and password set to 'admin'.

Multiple SQL injection vulnerabilities were found in the osTicket module in Help Center Live before version 2.1.0. They allow remote attackers to execute arbitrary SQL commands via unknown vectors.

Multiple SQL injection vulnerabilities were found in ampleShop 2.1 and earlier. An attacker can remotely execute arbitrary SQL commands via the RecordID, solus, and cat parameters in various .cfm files.

SQL injection vulnerability in function/showprofile.php in FlexBB 0.5.5 allows remote attackers to execute arbitrary SQL commands and view all usernames and passwords via the id parameter to the showprofile page in index.php.

A buffer overflow vulnerability in the parse_url function of the RTSP module in Fenice 1.10 and earlier allows remote attackers to execute arbitrary code via a long URL.

The vulnerability in Asterisk Recording Interface (ARI) in Asterisk@Home before version 2.8 stores the recordings/includes/main.conf file under the web document root with insufficient access control, allowing remote attackers to obtain password information.

A vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code by injecting a URL into the DFORUM_PATH parameter across multiple scripts. Attackers can upload a malicious PHP file from an external server and execute it on the victim's server.

A PHP remote file inclusion vulnerability in agenda.php3 of phpMyAgenda 3.0 Final and earlier allows attackers to execute arbitrary PHP code by supplying a URL in the rootagenda parameter. This can lead to full server compromise.

In SL_site 1.0, the page.php file is vulnerable to SQL injection via the id_page parameter, allowing remote attackers to execute arbitrary SQL commands. This issue can also lead to reflected XSS through error messages.

RI Blog 1.1 is vulnerable to SQL injection in the username and password fields. Remote attackers can execute arbitrary SQL commands, leading to unauthorized database access.

An eval injection vulnerability in index.php of ClanSys 1.1 allows remote attackers to execute arbitrary PHP code by injecting PHP code into the 'page' parameter. The attack can involve injecting an 'include' statement, leading to code execution.

An off-by-one error in the OID printing routine in Ethereal 0.10.x up to 0.10.14 has unknown impact and remote attack vectors.

PHP remote file inclusion vulnerability in movie_cls.php of Built2Go PHP Movie Review 2B and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path parameter.