CVE Vulnerability Catalog

The server.php test script in ADOdb for PHP before version 4.70, used in multiple products including Mantis, PostNuke, Moodle, Cacti, Xaraya, PHPOpenChat, MAXdev MD-Pro, and MediaBeez, allows remote attackers to execute arbitrary SQL commands via the sql parameter when the MySQL root password is empty.

Multiple format string vulnerabilities were found in the auth_ldap_log_reason function in Apache auth_ldap version 1.6.0 and earlier. Remote attackers can exploit these flaws, for example via a crafted username, potentially leading to arbitrary code execution.

A vulnerability in the Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a specially crafted WMF file containing ExtCreateRegion or ExtEscape function calls with inconsistent argument lengths.

A vulnerability in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt unlimited authentication without account lockout or connection rate limiting.

Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before version 6.5.5, identified as potential security issues (SPR numbers). One of them (SPR# KSPR699NBP) in the NROUTER component allows a remote attacker to cause a denial of service (high CPU consumption) via a crafted vCal meeting request sent over SMTP.

Multiple memory leaks in IBM Lotus Notes and Domino Server before version 6.5.5 allow attackers to cause a denial of service via memory exhaustion and crash. The vulnerability involves unspecified vectors during SSL handshake and the stash file.

SQL injection vulnerability in login.php of TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (the u variable).

Multiple SQL injection vulnerabilities were found in OnePlug Solutions OnePlug CMS. Remote attackers can execute arbitrary SQL commands via the Press_Release_ID, Service_ID, and Product_ID parameters in respective ASP files.

Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the fid parameter in index.php and pagid parameter in verpag.php, and possibly other vectors.

A buffer overflow vulnerability exists in the IMAP service of Rockliffe MailSite prior to version 6.1.22.1. This flaw can be exploited remotely, but the exact attack vectors and impact are unknown.

SQL injection vulnerability in linkcategory.php of Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability in mcl_login.asp of Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter. The source of this information is unknown, and details are obtained solely from third party sources.

SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter. The source of this information is unknown, and details are obtained solely from third party information.

In Wine 20050930 and other versions, the SETABORTPROC GDI Escape function in WMF files allows arbitrary code execution. This is the same vulnerability as CVE-2005-4560 but in a different codebase.

A PHP remote file inclusion vulnerability in Valdersoft Shopping Cart 3.0 allows attackers to execute arbitrary code via the catalogDocumentRoot parameter. This affects multiple include/templates/categories/ PHP scripts.

In PHP 4.3.10 and 4.4.x before 4.4.3 for Windows, the create_named_pipe function in libmysql.c has a stack-based buffer overflow. An attacker can exploit a long arg_host or arg_unix_socket argument, such as a long named pipe variable in the host argument to mysql_connect, to execute arbitrary code.

In Linux kernel versions 2.6.x before 2.6.11 and 2.4.x before 2.4.29, the wan/sdla.c function does not require the CAP_SYS_RAWIO privilege for SDLA firmware upgrades. Although further investigation suggests that exploitation requires root privileges (protected by CAP_NET_ADMIN), the lack of precise privilege distinction may pose a risk.

In Lizard Cart CMS 1.04, SQL injection vulnerability exists in pages.php and detail.php via the id parameter. This allows a remote attacker to execute arbitrary SQL commands on the database.

SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the usuario_nkads_admin or password_nkads_admin parameters.

PHP remote file inclusion vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter. This is a different vulnerability than CVE-2006-0076.