CVE Vulnerability Catalog

A vulnerability in the EIGRP implementation in Cisco IOS after versions 12.3(2), 12.3(3)B, and 12.3(2)T and other products allows a remote attacker to cause a denial of service (DoS) by sending a spoofed neighbor announcement with mismatched k values or a goodbye message TLV.

The vulnerability in MD5 Neighbor Authentication in EIGRP (Cisco IOS 11.3 and later) does not include the Message Authentication Code (MAC) in the checksum. This allows an attacker to sniff message hashes and replay HELLO packets or cause a denial of service by sending spoofed neighbor announcements, resulting in an ARP storm on the local network.

A buffer overflow vulnerability in ELOG elogd 2.6.0-beta4 in the cmd and mode URL parameters allows remote attackers to cause a denial of service (application crash) and potentially execute arbitrary code.

A heap-based buffer overflow in Dec2Rar.dll version 3.2.14.3, distributed in the Symantec Antivirus Library and used by various Symantec products, allows remote attackers to execute arbitrary code via RAR archives with sub-block headers containing incorrect values in the length field.

SQL injection vulnerability in CS-Cart 1.3.0 allows remote attackers to execute arbitrary SQL commands via the sort_by and sort_order parameters in index.php.

A vulnerability in fetchmail before versions 6.3.1 and 6.2.5.5, when configured in multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.

SQL injection vulnerability in LogicBill 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the __mode and __id parameters in helpdesk.php.

SQL injection vulnerability in WowBB 1.65 allows remote attackers to execute arbitrary SQL commands via the q parameter in search.php.

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via parameters in various scripts.

In TML CMS 0.5, the index.php file is vulnerable to SQL injection via the id parameter. This allows a remote attacker to execute arbitrary SQL commands.

SQL injection vulnerability in index.cfm of Mercury CMS 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

SQL injection vulnerability in default.asp in Media2 CMS Shop 18.x allows remote attackers to execute arbitrary SQL commands via the item parameter. The provenance of this issue is unknown; the details were obtained solely from third party sources.

SQL injection vulnerability in RunScript.asp of iCMS allows remote attackers to execute arbitrary SQL commands via the Event_ID parameter.

SQL injection vulnerability in index.php of ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the StoryID parameter.

A buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.

An unspecified vulnerability in Kerio WinRoute Firewall before version 6.1.3 allows remote attackers to cause a denial of service (crash) via certain RTSP streams.

Unspecified vulnerability in Teamwork 3 before alpha 1.7, related to a menu security bug. Impact and attack vectors are unknown.

Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name.

SQL injection vulnerability in printer_friendly.cfm in e-publish CMS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

Miraserver 1.0 RC4 and earlier versions contain multiple SQL injection vulnerabilities in the page, id, and cat parameters, allowing remote attackers to execute arbitrary SQL commands.