CVE Vulnerability Catalog

Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite and Applications version 11.5.10CU1. Has unknown impact and attack vectors, known as Vuln# APPS05.

Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9. May lead to unknown impacts and attack vectors.

The vulnerability in edit_kategorie.php in Fuju News 1.0 allows a remote attacker to bypass authentication by setting the 'authorized' cookie.

Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQL commands via the position and id parameters.

SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

SQL injection vulnerability in the Your_Account module of PHP-Nuke 7.8 allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. The provenance of this information is unknown; details are obtained solely from third party information.

SQL injection vulnerability in category.php of Article Publisher Pro 1.0.1 and earlier. Remote attackers can execute arbitrary SQL commands via the cname parameter.

A direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and earlier versions before 2.25 allows remote attackers to inject PHP code via a semicolon in the name parameter of the systemdoc action. This can lead to arbitrary command execution.

Remote file inclusion vulnerability in PHP Album 0.3.2.3. An attacker can exploit the data_dir parameter in language.php by supplying an FTP URL, leading to arbitrary code execution when register_globals is enabled.

SQL injection vulnerability in sql.php of phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.

A directory traversal vulnerability in posts.php of SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie. The attack can be performed by injecting code into the gl_session cookie of users.php, which is stored in error.log.

SQL injection vulnerability in rateit.php of RateIt 2.2 allows remote attackers to execute arbitrary SQL commands via the rateit_id parameter.

Censtore 7.3.002 and earlier contain a vulnerability in censtore.cgi that allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the page parameter.

Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter. In some cases, remote file inclusion via SMB share is possible under PHP 5.

Multiple SQL injection vulnerabilities in index.php of Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the start parameter in a search action or the type parameter in a top action.

SQL injection vulnerability in member.php of PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.

A directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPath[path] parameter in class.forumposts.php and forumpollrenderer.php.

SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the $username variable in the mosGetParam function, the $task parameter in the mosMenuCheck function in includes/mambo.php, and the $filter variable in the showCategory function in the com_content component.

Unspecified vulnerability in the POP service in MailEnable Standard Edition before 1.94, Professional Edition before 1.74, and Enterprise Edition before 1.22. The flaw involves authentication exploits with unknown attack vectors and impact.