CVE Vulnerability Catalog

A stack-based buffer overflow in the Macromedia JRun 4 web server (JWS) occurs due to improper handling of a long request during conversion to wide characters. A remote attacker can exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.

In Blender BlenLoader versions 2.0 through 2.40pre, a heap-based buffer overflow exists in the get_bhead function in readfile.c. An attacker can remotely cause a denial of service or potentially execute arbitrary code via a .blend file with a negative bhead.len value, leading to less memory allocation than expected, possibly due to an integer overflow.

A vulnerability in Ingate Firewall and SIParator before version 4.3.4 allows a remote attacker to cause a kernel deadlock by sending a SYN packet for a TCP stream, which requires an RST packet in response.

The IKEv1 implementation in NEC UNIVERGE IX1000, IX2000, and IX3000 devices contains a vulnerability that allows a remote attacker to cause a denial of service and potentially execute arbitrary code via crafted IKE packets. This was demonstrated using the PROTOS ISAKMP Test Suite for IKEv1.

Heap-based buffer overflow in the SIPParser function in i3sipmsg.dll in Interaction SIP Proxy before 3.0.011. A remote attacker can send a REGISTER request with a SPI version number containing a large number of space or tab characters, causing a denial of service and potentially arbitrary code execution.

Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via the username field in login.php or the user_language, user_email, and user_gedcomid parameters in login_register.php, which are directly inserted into authenticate.php.

A PHP remote file inclusion vulnerability in usermods.php of Tolva PHP website system 0.1.0 allows remote attackers to execute arbitrary code via a URL in the ROOT parameter.

A heap-based buffer overflow in VMware NAT networking components (vmnat.exe and vmnet-natd) in Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted EPRT and PORT FTP commands.

SQL injection vulnerability in index.php of Beehive Forum 0.6.2 and earlier. Remote attackers can execute arbitrary SQL commands via the user_sess parameter.

An unspecified vulnerability in the Software Distributor component of HP-UX B.11.11 allows remote attackers to gain access to the system. The attack vectors are not disclosed.

A vulnerability in MailEnable Enterprise 1.1 before patch ME-10009 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending several triple dot sequences ("...") in a UID FETCH command.

CSRF vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, using the dbname and checkprivs parameters.

The vulnerability in Metadot Portal Server 6.4.4 and earlier is due to improper resetting of the $IS_OWNER, $IS_ADMIN, and $IS_MANAGER global variables during privilege checks. This allows users to add themselves to the SITE_MGR group and gain administrator privileges.

A vulnerability in UserProfile.cs in Ultraapps Issue Manager before version 2.1 allows remote authenticated users to escalate privileges to administrator by modifying the p_User_user_id and User_user_id parameters in UserProfile.aspx, then changing the password field.

A stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command ending with a '}' character, demonstrated using long LIST, LSUB, SEARCH TEXT, STATUS INBOX, AUTHENTICATE, FETCH, SELECT, and COPY commands.

Multiple buffer overflows in MailEnable Professional 1.71 and Enterprise 1.1 before patch ME-10009 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long LIST, LSUB, and UID FETCH commands.

FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, allowing attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-2813), then calculating the credentials and including them in the secid cookie.

A vulnerability in OpenLDAP before version 2.2.28-r3 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.

A vulnerability in Gauche before version 0.8.6-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.

SQL injection vulnerability in articles/articles_funcs.php in phpCOIN 1.2.2 allows remote attackers to modify SQL syntax and potentially execute queries in limited circumstances via the rec_next parameter. Although the injection occurs after an ORDER BY clause, a syntax error may disclose error paths in some environments.