CVE Vulnerability Catalog

Vulnerability in Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.

A vulnerability in Frisk F-Prot Antivirus allows remote attackers to bypass protection by sending a ZIP file with a version header greater than 15, which prevents the software from decompressing and analyzing the file.

Multiple buffer overflows in the receiver function in loop.c in FlatFrag 0.3 and earlier allow remote attackers to execute arbitrary code via the (1) version, (2) name, and (3) model fields.

SQL injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to execute arbitrary SQL commands via the serviceid parameter. Although the vendor disputed this report, further investigation confirms the vulnerability exists.

The libungif library before version 4.1.0 contains a memory corruption vulnerability via a crafted GIF file, which can lead to arbitrary code execution. The issue is caused by an out-of-bounds write.

Vulnerability in Scorched 3D 39.1 (bf) and earlier allows a remote attacker to cause a denial of service (long loop and server hang) by sending a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp.

Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various functions including GLConsole::addLine, ServerCommon::sendString, ServerCommon::serverLog, a long command in ComsMessageHandler.cpp, a long UniqueID value in Logger.cpp, and possibly other unspecified vectors.

Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various functions including GLConsole::addLine, ServerCommon::sendString, and ServerCommon::serverLog.

Buffer overflow in GO-Global for Windows 3.1.0.3270 and earlier allows remote attackers to execute arbitrary code via a data block that is longer than the specified data block size.

A buffer overflow vulnerability in Glider Collect'n kill 1.0.0.0 allows remote attackers to execute arbitrary code via a gl_playerEnter command with a long player name.

SQL injection vulnerability in index.php in Tutorials Manager 1.0 Beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

A vulnerability in Cisco IOS versions 12.0 to 12.4 may allow a remote attacker to execute arbitrary code via a heap-based buffer overflow in system timers. However, this is not a specific vulnerability but a general design weakness that increases the risk of exploiting other potential vulnerabilities.

SQL injection vulnerability in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands.

SQL injection vulnerability in index.php in News2Net 3.0.0.0 allows remote attackers to execute arbitrary SQL commands via the category parameter.

Unspecified vulnerability in Oracle E-Business Suite and Applications versions 11.0 through 11.5.10, identified as Oracle Vuln# APPS08 in HRMS. The impact and attack vectors are unknown.

Unspecified vulnerability in Oracle E-Business Suite and Applications versions 4.5 through 4.5.1, identified as Oracle Vuln# APPS22 in Oracle Clinical. Details regarding impact and attack vectors are unknown.

Unspecified vulnerability in the HTTP Server in Oracle Application Server versions 1.0 through 9.0.2.3. Its impact and attack vectors are unknown, identified as Oracle Vuln# AS04.

Unspecified vulnerability in the Internet Directory component of Oracle Database Server 9i up to version 9.2.0.6 and Application Server from 9.0.2.3 to 10.1.2.0. Details regarding impact and attack vectors are unknown, identified as Oracle Vuln# DB32 and AS06.

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications versions 11.5 through 11.5.10, affecting various components such as Application Install, Application Object Library, Applications Technology Stack, Utilities, HRMS, Mobile Application Foundation, SDP Number Portability, Oracle Service, Service Fulfillment Manage, Universal Work Queue, and Workflow Cartridge. The impact and attack vectors are unknown.

Unspecified vulnerability in JDEdwards HTML Server in Oracle EnterpriseOne 8.94 OneWorld XE up to 8.95_B1, 8.94_Q1, and SP23_K1. It has unknown impact and attack vectors, identified as Oracle Vuln# JDE01.