CVE Vulnerability Catalog

Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier. Unknown impact and attack vectors.

An eval injection vulnerability in the decode function of rpc_decoder.php in phpRPC 0.7 and earlier, used by runcms, exoops, and other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag.

Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier are related to permissions. Their impact and attack vectors are unknown.

JFacets before version 0.2 allows remote attackers to gain privileges of any account by sending a GET request with a modified account profile ID.

SQL injection vulnerability in forumlib.php in Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter.

In Joomla! 1.0.7, the feedcreator.class.php (syndication component) allows a remote attacker to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.

The c-client library in PHP before 4.4.4 and 5.x before 5.1.5 does not check safe_mode or open_basedir settings. In applications that accept user-controlled input for the mailbox argument of the imap_open function, this allows remote attackers to access an IMAP stream data structure and perform unauthorized IMAP actions.

SQL injection vulnerability in poems.php of DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.

SQL injection vulnerability in MgrLogin.asp of Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter. The details are obtained solely from third party information.

In SMartBlog (SMBlog) 1.2, the index.php file contains a remote file inclusion vulnerability. An attacker can use the pg parameter or a query string without a parameter to include and execute arbitrary PHP code from an external source.

Buffer overflow vulnerability in the IsComponentInstalled method of Internet Explorer 6.0 on Windows 2000 before SP4 and Windows XP before SP1. A remote attacker can execute arbitrary code via JavaScript calling this method with a long first argument.

WordPress 1.5.2 (and possibly earlier versions before 2.0) contains an SQL injection vulnerability in the User-Agent field of the HTTP header when posting a comment. A remote attacker can exploit this to execute arbitrary SQL commands on the database.

Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the newsid parameter in newsdetailsview.asp and the password parameter in login.asp.

Multiple SQL injection vulnerabilities in N8cms versions 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the dir and page_id parameters to index.php.

The NETGEAR WGT624 wireless DSL router has a default account with username "Gearguy" and password "Geardog", allowing remote attackers to modify the device configuration. Note that not all WGT624 routers may be affected.

Multiple SQL injection vulnerabilities exist in sendcard.php in sendcard before version 3.3.0. Remote attackers can execute arbitrary SQL commands via unspecified parameters.

Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before version 0.9.96. Impact and attack vectors are unknown.

PHP remote file inclusion vulnerability in index.php of Top sites de PixelArtKingdom allows attackers to include and execute arbitrary files via the 'page' parameter.

SQL injection vulnerability in topics.php of phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.

The default configuration of the DNS Server service on Windows Server 2003, Windows 2000, and Microsoft DNS Server on Windows NT 4.0 allows recursive queries and provides additional delegation information to arbitrary IP addresses. This enables remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.