CVE Vulnerability Catalog

PHP remote file inclusion vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter. This is a different vulnerability than CVE-2006-0076.

SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.

SQL injection vulnerability in auth.php of ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).

A vulnerability in the Intel Graphics Accelerator Driver (ialmnt5.sys) allows an attacker to cause a denial of service (system crash or screen resolution change) by providing a long text field, such as a long window title.

A direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field in a new message, which is written to a PHP file.

A PHP remote file inclusion vulnerability in forum.php of oaBoard 1.0 allows an attacker to execute arbitrary PHP code by supplying a crafted URL in the inc parameter.

SQL injection vulnerability in profile.php of PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter. The issue affects version 1.1 and earlier.

A buffer overflow vulnerability in the termsh utility on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. This is likely a different vulnerability than CVE-2005-0351 as it involves a distinct attack vector.

SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter in search.php and the email parameter in user.php.

SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.

A SQL injection vulnerability was found in VEGO Web Forum 1.26 and earlier in functions.php, functions_update.php, and functions_display.php. Remote attackers can execute arbitrary SQL commands via the theme_id parameter in index.php.

PHPjournaler 1.0 contains an SQL injection vulnerability in index.php. Remote attackers can execute arbitrary SQL commands via the readold parameter.

CubeCart contains a PHP remote file inclusion vulnerability in includes/orderSuccess.inc.php, allowing an attacker to execute arbitrary PHP code by supplying a crafted URL in the glob[rootDir] parameter.

SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via the addr_id parameter. The provenance of this information is unknown; details are obtained solely from third party information.

Heap-based buffer overflow in the iGateway service of Computer Associates iTechnology products before version 4.0.051230. A remote attacker can execute arbitrary code by sending an HTTP request with a negative Content-Length field.

The tuxpaint-import.sh script in Tux Paint version 0.9.14 and earlier creates temporary files insecurely, which may lead to unknown impacts and attack vectors.

A heap-based buffer overflow in Apple QuickTime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted QuickTime Image File (QTIF), PICT, or JPEG format image with a long data field.

Multiple SQL injection vulnerabilities in VUBB alpha rc1 allow remote attackers to execute arbitrary SQL commands via the f parameter in viewforum.php, t parameter in viewtopic.php, and view parameter in usercp.php.

A buffer overflow vulnerability in petris before version 1.0.1 allows remote attackers to execute arbitrary code via unspecified attack vectors.

Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before version 2.0.3, used for user authentication against a PostgreSQL database, allow remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.