CVE Vulnerability Catalog

PHP remote file inclusion vulnerability in movie_cls.php of Built2Go PHP Movie Review 2B and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path parameter.

A heap-based buffer overflow in Winny 2.0 b7.1 and earlier allows remote attackers to execute arbitrary code by sending long strings to certain commands on the file transfer port.

Multiple SQL injection vulnerabilities in check_login.asp in Bloggage allow remote attackers to execute arbitrary SQL commands via the acc_name and password parameters.

A vulnerability in Symantec Scan Engine 5.0.0.24 and earlier versions before 5.1.0.7 uses client-side password verification. A remote attacker can bypass authentication and gain administrator privileges by sending modified XML requests.

An argument injection vulnerability in Beagle before version 0.2.5 allows attackers to execute arbitrary commands via crafted filenames. When Beagle launches external helper applications during indexing, injected command line arguments are processed.

Apple Safari 2.0.3 contains a vulnerability that allows remote attackers to cause a denial of service and potentially execute code by sending a malicious CELLSPACING attribute in a TABLE tag, triggering an error in KWQListIteratorImpl::KWQListIteratorImpl.

SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier. Remote attackers can execute arbitrary SQL commands via the flexbb_username COOKIE parameter.

A heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, used by applications employing ImageIO or AppKit, allows remote attackers to execute arbitrary code via crafted TIFF images.

Apple Safari 2.0.3 contains a vulnerability that allows remote attackers to cause a denial of service and potentially execute code via an invalid FRAME tag. The issue may be due to multiple SCROLLING attributes with no values or a SRC attribute with no value.

SQL injection vulnerability in index.php of MyBB (MyBulletinBoard) before version 1.04. A remote attacker can execute arbitrary SQL commands via the referrer parameter.

PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer. An attacker can execute arbitrary code remotely by supplying a crafted URL in the rf parameter.

SQL injection vulnerability in Haberler.asp in ASPSitem 1.83 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

A vulnerability in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before version 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allows local users to gain Linux shell access by using shell metacharacters in arguments to the 'show' command in the command line interface (CLI).

SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.

Multiple SQL injection vulnerabilities exist in plexum.php of NicPlex Plexum X5 and earlier. Remote attackers can execute arbitrary SQL commands via the pagesize, maxrec, and startpos parameters.

SQL injection vulnerability in plexcart.pl of NicPlex PlexCart X3 and earlier. Remote attackers can execute arbitrary SQL commands via the catid parameter.

SQL injection vulnerability in member.php of Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.

The config.php file in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values stored in config.php that are later executed. The provenance of this information is unknown; details are obtained solely from third party information.

Multiple SQL injection vulnerabilities were found in myEvent 1.x. Remote attackers can manipulate the event_id and event_desc parameters to execute arbitrary SQL commands.

PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3. An attacker can remotely execute arbitrary PHP code by providing a URL in the page parameter.