CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities were found in Mantis 1.0.0rc3 and earlier in the manage user page. Remote attackers can execute arbitrary SQL commands via the 'prefix' and 'sort' parameters in manage_user_page.php and the 'sort' parameter in view_all_set.php.

A vulnerability in scponlyc (scponly 4.1 and earlier) allows a local user to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LD_PRELOAD to alter expected function calls in the setuid application.

Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via the setLang parameter in index.php and unspecified search module parameters.

SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown vectors.

An argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via getopt-style argument specifications that are not filtered.

A vulnerability in Mantis before version 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the max_file_size parameter in bug_file_add.php, bug_report.php, bug_report_advanced_page.php, and proj_doc_add_page.php.

A buffer overflow vulnerability in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.

SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter. The provenance of this information is unknown; details are obtained solely from third party information.

WebDB 1.1 and earlier contain an SQL injection vulnerability via unspecified search parameters (possibly Search0). The vendor disputes this, stating the code was added for a specific client and has been removed, with all clients receiving updates automatically.

An unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i (patch 11) and CMA 3.5 (patch 5) allows local users to gain privileges by placing a malicious "program.exe" file in the C: folder, which is executed by naPrdMgr.exe when it attempts to run EntVUtil.EXE.

SQL injection vulnerability in phpBB 2 before version 2.0.18 allows remote attackers to execute arbitrary SQL commands via the topic type parameter.

A vulnerability in the khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier, used by Safari and TextEdit, allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute in a TD tag.

Buffer overflow vulnerability in the Network Block Device (nbd) server versions 2.7.5 and earlier, and 2.8.0 through 2.8.2. A remote attacker can send an oversized request that is written past the end of the buffer because nbd does not account for memory taken by the reply header, allowing arbitrary code execution.

SQL injection vulnerability in MusicBox 2.3 allows remote attackers to execute arbitrary SQL commands via the show and type parameters. The provenance of this information is unknown, although it was later rediscovered.

The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators generates a random internal ACL name that is also used as a hidden username and password. An attacker can sniff this name from the cleartext portion of a RADIUS session and use the password to log in to another device using Cisco Secure Access Control Server (CS ACS).

Multiple SQL injection vulnerabilities in Papoo 2.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the menuid parameter in index.php and guestbook.php, and the forumid and reporeid_print parameters in print.php.

SQL injection vulnerability in article.php of phpSlash 0.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the story_id parameter.

SQL injection vulnerability in Quantum Art QP7.Enterprise (formerly Q-Publishing) allows remote attackers to execute arbitrary SQL commands via the p_news_id parameter in news_and_events_new.asp and news.asp scripts. The vendor disputed the report, but CVE analysis confirmed a forced SQL syntax error in one script.

SQL injection vulnerability in index.cfm in SpireMedia mx7 allows remote attackers to execute arbitrary SQL commands via the cid parameter. Although the vendor disputed this issue, further research by CVE and OSVDB suggests it might be path disclosure due to invalid SQL syntax.

A remote file inclusion vulnerability in PHPGedView 3.3.7 and earlier allows arbitrary code execution via the PGV_BASE_DIRECTORY parameter in help_text_vars.php. An attacker can execute malicious PHP code by supplying a crafted URL.