CVE Vulnerability Catalog

An unspecified vulnerability in HP-UX versions B.11.00 through B.11.23, when IPSEC is running, allows remote attackers to have an unknown impact.

Multiple heap-based buffer overflows in QuickTime.qts in Apple QuickTime Player 7.0.3 and iTunes 6.0.1 (3) and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a .mov file with a large Movie Resource atom size or a modified Sample Description Table size in an stsd atom.

Vulnerability in the fckeditor2rc2 addon for DoceboLMS 2.0.4 allows remote attackers to execute arbitrary PHP code by uploading a file that appears to be an image but contains PHP script via the FileUpload command in connector.php.

Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."

Multiple SQL injection vulnerabilities in Alisveristr E-commerce allow remote attackers to bypass authentication and possibly execute arbitrary SQL commands via the username and password parameters in the user login and administrator login pages.

SQL injection vulnerability in view_archive.cfm in CFMagic Magic List Pro 2.5 allows remote attackers to execute arbitrary SQL commands via the ListID parameter.

Unspecified absolute path vulnerability in umountall in IBM AIX 5.1 through 5.3 allows local users to cause unknown impact via unknown vectors.

Multiple SQL injection vulnerabilities in CFMagic Magic Forum Personal 2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ForumID parameter in view_forum.cfm, and (2) ForumID, (3) Thread, and (4) ThreadID parameters in view_thread.cfm.

A heap-based buffer overflow in the StreamPredictor function of Xpdf 3.01, used in multiple products including Poppler, teTeX, KDE kpdf, pdftohtml, KOffice KWord, CUPS, and libextractor, allows remote attackers to execute arbitrary code via a crafted PDF file with an out-of-range numComps field.

A heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as MPlayer, xine-lib, Xmovie, and GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes.

A buffer overflow vulnerability in multiple Multi-Tech Systems MultiVOIP devices with firmware before x.08 allows remote attackers to execute arbitrary code via a long INVITE field in a Session Initiation Protocol (SIP) packet.

SQL injection vulnerability in search.php in PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the Location, Last Name, and First Name parameters.

Unspecified vulnerability in System Communications Services 6 Delegated Administrator 2005Q1 in Sun Java System Messaging Server 2005Q1 allows remote attackers to obtain the Top-Level Administrator (TLA) default password via unknown vectors, possibly involving configure_toplevel_admin.ldif.

SQL injection vulnerability in saralblog 1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to viewprofile.php.

Multiple SQL injection vulnerabilities in A-FAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the faqid parameter in faqDspItem.asp and the catcode parameter in faqDsp.asp.

SQL injection vulnerability in index.php in PluggedOut Blog 1.9.5 and earlier allows remote attackers to execute arbitrary SQL commands via the categoryid, entryid, year, month, and day parameters.

SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

Blog System 1.2 contains SQL injection vulnerabilities in the 'cat' parameter in index.php and the 'note' parameter in blog.php, allowing remote attackers to execute arbitrary SQL commands.

SQL injection vulnerability in index.php in Cars Portal 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the page and car parameters.

SQL injection vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter.