CVE Vulnerability Catalog

A vulnerability in the docutils component in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.

SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

The _httpsrequest function in Snoopy 1.2, used in products such as WordPress, MagpieRSS, Ampache, and Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL. The issue is due to improper handling of these characters by the fetch function.

SQL injection vulnerability in chat.php of MWChat 6.8. A remote attacker can execute arbitrary SQL commands via the username parameter.

SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.

SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

Vulnerability in Mantis before version 0.19.3 causes the User ID to be cached longer than necessary. The impact and attack vectors are unknown.

Multiple stack-based buffer overflows in ZipGenius versions 5.5.1.468 and 6.0.2.1041, and other versions before 6.0.2.1050, allow remote attackers to execute arbitrary code via a crafted ZIP archive with a long filename, a long original name in UUE/XXE/MIM files, or an ACE archive with a long filename.

Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS, before 1.2.x.18 on Linux, and 1.1.x.6 and earlier allows remote attackers to cause a denial of service (crash) via crafted network data with a large Object Counter value, which leads to a resultant heap-based buffer overflow.

Buffer overflow vulnerability in Skype for Windows versions 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via specially crafted callto:// and skype:// links or a non-standard VCARD, likely due to an error in the SysUtils.WideFmtStr Delphi routine.

Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via the username parameter in the Your Account page, the url parameter in the Downloads module, and the description parameter in the Web_Links module.

Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via the id parameter in detail.php and the catid parameter in get.php and index.php.

Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the forum_id, thread_id, link_id, artid, and dl_id parameters.

Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights that should be restricted to administrators.

The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers to execute arbitrary code.

Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute arbitrary code via a crafted GIF file.

Stack-based buffer overflow in ppp in SCO Unixware 7.1.3 and 7.1.4, and possibly earlier versions, allows local users to execute arbitrary code via a long argument to the prompt or defprompt command.

Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute arbitrary code.

Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.

The FTP server in HP-UX 10.20, B.11.00, and B.11.11 allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.