CVE Vulnerability Catalog

A direct static code injection vulnerability in error.php of GuppY 4.5.9 and earlier, with register_globals disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script later included by the main script.

A heap-based buffer overflow in the pskcmp.dll library of Panda Software Antivirus allows remote attackers to execute arbitrary code via a crafted ZOO archive.

SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 2.0.4 and earlier. Allows remote attackers to execute arbitrary SQL commands via the sortorder parameter.

SQL injection vulnerability in themes/kategorie/index.php in Randshop allows remote attackers to execute arbitrary SQL commands via the kategorieid and katid parameters.

Macromedia Flash Communication Server MX versions 1.0 and 1.5 do not sufficiently validate certain RTMP data, allowing attackers to cause a denial of service (instability or crash), as demonstrated using an alpha release build of Flash Player 8.5 (build 133).

Macromedia Breeze Communication Server and Breeze Live Server version 5.1 and earlier do not sufficiently validate certain RTMP data, which allows attackers to cause a denial of service (instability or crash), as demonstrated using an alpha release build of Flash Player 8.5 (build 133).

Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.

A vulnerability in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash and configuration loss) via a page with a large number of gg: URIs.

A memory leak in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service by sending multiple DCC packets with a code other than 2 and a large size field, which allocates memory for the packet but does not free it after the packet has been dropped.

A vulnerability in Mozilla browser allows a remote attacker to cause a denial of service (DoS) via excessive CPU consumption. The attack exploits a JavaScript BODY onload event that calls the window function.

A vulnerability in Gadu-Gadu 7.20 allows a remote attacker to cause a denial of service (DoS) by sending multiple DCC packets with code 6 or 7. This triggers a large number of popup windows and creates an excessive number of threads, leading to system overload.

A vulnerability in Apple Safari 2.0.2 allows remote attackers to cause a system slowdown via a JavaScript BODY onload event that calls the window function.

A stack-based buffer overflow in Gadu-Gadu 7.20 occurs when processing an image filename between 192 and 200 characters, as the "imgcache\" string appended to the buffer is not accounted for, allowing remote attackers to cause a denial of service (crash).

An unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to an unchecked buffer and possible buffer overflows, allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF) format image.

Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.

Unspecified vulnerability in Cisco Security Agent (CSA) 4.5.0 and 4.5.1 agents, when running on Windows systems, allows local users to bypass protections and gain system privileges by executing certain local software.

Multiple SQL injection vulnerabilities in Omnistar KBase 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter in users/comments.php, (2) category_id and (3) id parameters in users/kb.php.

SQL injection vulnerability in answer.php in FAQSystems FAQRing Knowledge Base Software 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

Multiple SQL injection vulnerabilities in Ugroup 2.6.2 and earlier allow remote attackers to execute arbitrary SQL commands via the FORUM_ID parameter in forum.php, and the TOPIC_ID, FORUM_ID, and CAT_ID parameters in topic.php.

Multiple SQL injection vulnerabilities in adcbrowres.php in AD Center ADC2000 NG Pro 1.2 and NG Pro Lite allow remote attackers to execute arbitrary SQL commands via the cat and lang parameters.