CVE Vulnerability Catalog

BlogPHP version 1.0 contains an SQL injection vulnerability in config.php. An attacker can remotely execute arbitrary SQL commands via the blogphp_username or blogphp_password cookie parameters.

SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in blog.php.

Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php.

The RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 is vulnerable to a denial of service attack via a malformed query string containing special characters like '|'. This causes high CPU consumption and service crash.

A buffer overflow vulnerability exists in multiple F-Secure Anti-Virus products for Windows and Linux when processing crafted ZIP archives. This allows remote attackers to execute arbitrary code on the affected system.

A vulnerability in the Stack Group Bidding Protocol (SGBP) support in Cisco IOS versions 12.0 through 12.4 allows a remote attacker on the local network to cause a denial of service (device hang and network traffic loss) by sending a crafted UDP packet to port 9900.

SQL injection vulnerability in HITSENSER Data Mart Server (versions BS, BS-S, BS-M, BS-L, and EX) allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

A buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code when the publisher's name link is clicked via a long publisher URI in a torrent file.

Etomite CMS 0.6 (and earlier) downloaded from the vendor site after January 10, 2006 contains a backdoor in manager/includes/todo.inc.php. Remote attackers can execute arbitrary commands via the 'cij' parameter.

A heap-based buffer overflow in the encodeURI and decodeURI functions of the kjs JavaScript interpreter in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted UTF-8 encoded URI.

A vulnerability in crawl before version 4.0.0 allows local users to gain privileges by unsafely calling programs when saving and loading games.

SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in login.php.

SQL injection vulnerability in login.php of aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.

PDFdirectory before version 1.0 stores sensitive data in plaintext, allowing remote attackers to obtain arbitrary users' passwords via direct database queries, possibly through SQL injection vulnerabilities.

An integer overflow in the IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE occurs while scanning for wireless networks. Remote attackers can exploit this by broadcasting crafted beacon or probe response frames to execute arbitrary code.

Multiple SQL injection vulnerabilities were found in PDFdirectory before version 1.0 in files util.php, userpref.php, user.php, uploadfrm.php, title.php, team.php, stats.php, page.php, org.php, member.php, index.php, group.php, and anniv.php. These allow remote attackers to execute arbitrary SQL commands.

A buffer overflow in the YGPPicFinder.DLL ActiveX control in the AOL You've Got Pictures (YGP) Picture Finder Tool, used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.

SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password parameters.

BlogPHP 1.0 contains an SQL injection vulnerability in index.php when magic_quotes_gpc is disabled. An attacker can send a crafted query via the username parameter in a login action, allowing arbitrary SQL commands and authentication bypass.

A buffer overflow vulnerability in Dual DHCP DNS Server 1.0 exists in the DHCP options field. Remote attackers can exploit this to cause a denial of service (application crash) and potentially execute arbitrary code.