CVE Vulnerability Catalog

Kaspersky Antivirus 5.0.5 and 5.5.3 contain a vulnerability that allows a remote attacker to cause a denial of service via excessive CPU and memory consumption. The attack vector is unknown.

Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the informationID or ParentCategory parameter to index.php. This could lead to unauthorized database access.

A buffer overflow vulnerability in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, derived from the Cube engine, allows remote attackers to execute arbitrary code via long input data streams.

PHP-Stats 0.1.9.1 and earlier contains multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via the option[prefix] parameter in admin.php and the PC_REMOTE_ADDR HTTP header in click.php.

A vulnerability in htpasswd used in Acme thttpd 2.25b and possibly other products like Apache allows local users to gain privileges via shell metacharacters in command line arguments passed to the system function.

PHP-Stats 0.1.9.1 and earlier contain a vulnerability in admin.php that allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.

Multiple buffer overflows in htpasswd, used in Acme thttpd 2.25b and possibly other products like Apache, may allow local users to gain privileges via a long command line argument or a long line in a file.

SQL injection vulnerability in forgotten_password.php in PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.

The vulnerability in kpdf results from incomplete application of patches from xpdf related to CVE-2005-3627. This allows attackers to exploit flaws that were not fully fixed.

SQL injection vulnerability in Invision Power Board (IPB) 2.1.5 in index.php during a showtopic operation. Remote attackers can execute arbitrary SQL commands via the st parameter.

PHP-Stats 0.1.9.1 and earlier contains a directory traversal vulnerability via the option[language] and option[template] parameters in admin.php and other scripts. A remote unauthenticated attacker can read and potentially execute arbitrary files on the server.

A format string vulnerability in the visualization function in Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname, dedicated server name, or map name in a level (.lxl) file.

An unspecified vulnerability in the session handling of Geeklog versions 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.

SQL injection vulnerability in Akarru Social BookMarking Engine before version 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter in akarru.lib/users.php.

A vulnerability in config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter.

Multiple buffer overflows in LISTSERV 14.3 and 14.4 (including Lite and HPO) with the web archive interface enabled allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.

SQL injection vulnerability in Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

An unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostic tests via unknown attack vectors.

In Joomla! 1.0.7 and earlier, multiple SQL injection vulnerabilities exist in the Admin functionality. They allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.

A buffer overflow vulnerability exists in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier when a Unicode string is converted to a narrow string. This flaw may allow a remote attacker to cause an unknown impact.