CVE Vulnerability Catalog

In Clam AntiVirus (ClamAV) before version 0.87.1, improper boundary checks in petite.c allow attackers to perform unknown attacks via unknown vectors.

A SQL injection vulnerability was found in the index.php file of Peel versions 2.6 through 2.7. Remote attackers can execute arbitrary SQL commands via the rubid parameter.

SQL injection vulnerability in the report module of ibProArcade 2.5.2 and earlier. Remote attackers can execute arbitrary SQL commands via the 'user' parameter in index.php.

Vulnerability in ImageMagick before version 6.2.4.2-r1 allows local users in the portage group to escalate privileges by placing a shared object in the Portage temporary build directory, which is added to the search path allowing it to be loaded at runtime.

Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in conjunction with the login/userinfo.php path and the session parameter (aka the PHPKITSID variable).

The suid.cgi scripts in F-Secure Internet Gatekeeper for Linux before version 2.15.484 and Anti-Virus Linux Gateway before version 2.16 are installed with SUID permissions and world-executable, allowing local users to escalate privileges.

PHP file inclusion vulnerability in index.php of OSTE 1.0 allows remote attackers to execute arbitrary code via the 'page' and 'site' parameters.

A buffer overflow vulnerability has been discovered in the LZX decompression function of CHM Lib (chmlib) version 0.35, used in products such as KchmViewer. The impact and attack vectors are unknown.

Vulnerability in QDBM before version 1.8.33-r2 allows local users in the portage group to escalate privileges by placing a shared object in the Portage temporary build directory, which is added to the search path allowing it to be loaded at runtime.

SQL injection vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the forum parameter.

Vulnerability in Java Runtime Environment (JRE) and Software Development Kit (SDK) versions 1.4.2_08, 1.4.2_09, 1.5.0_05 and possibly others allows remote attackers to cause a denial of service (JVM unresponsive) via a crafted serialized object, such as a font object as demonstrated on JBoss.

A buffer overflow vulnerability in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name and then executing the XPWD command.

A format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.

SQL injection vulnerability in resetcore.php in e107 versions 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the a_name parameter or user field of the login page.

Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the INCLUDE_PATH, SQUIZLIB_PATH, and PEAR_PATH parameters in several script files.

Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via banner.php or the id parameter in print.php, comment.php, and news.php.

SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.

SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_searches parameter.

A buffer overflow vulnerability in the swcons utility in IBM AIX 5.2, when debug malloc is enabled, allows remote attackers to cause a core dump and potentially execute arbitrary code.

The vulnerability in the chfn tool in pwdutils version 3.0.4 and earlier on SuSE Linux (and possibly other operating systems) does not properly validate arguments for the GECOS field, allowing local users to gain privileges.