CVE Vulnerability Catalog

SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitrary SQL commands via the phrase field.

Vulnerability in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with 'zero-width non-joiner' characters.

Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.

Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.

A stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.

The vulnerability in the miniserv.pl script in Webmin before version 1.230 and Usermin before version 1.160, when 'full PAM conversations' is enabled, allows a remote attacker to bypass authentication by spoofing session IDs using certain metacharacters (line feed or carriage return).

A buffer overflow vulnerability in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code by sending a long USER name.

SQL injection vulnerability in AddItem.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idOption_Dropdown_2 parameter.

A buffer overflow vulnerability in vxTftpSrv 1.7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TFTP request with a long filename argument.

SQL injection vulnerability in infopage.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idPage parameter.

The Compuware DriverStudio Remote Control service (DSRsvc.exe) versions 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.

Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in scripts like announcement.php, thread.php, user.php, and others.

Multiple SQL injection vulnerabilities in vBulletin before version 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in different scripts.

A stack-based buffer overflow vulnerability exists in AhnLab V3Pro 2004, V3 VirusBlock 2005, and V3Net for Windows Server 6.0 (all build 6.0.0.383). A remote attacker can exploit a long filename in an ACE archive to execute arbitrary code.

Multiple unspecified vulnerabilities have been discovered in the WYSIWYG editor in PHP-Nuke before version 7.9 Final. Their impact and attack vectors are unknown.

Vulnerability in Tofu 0.2 allows remote attackers to execute arbitrary Python code via crafted pickled objects, which Tofu unpickles and executes.

SQL injection vulnerability in Interakt MX Shop 3.2.0 allows remote attackers to execute arbitrary SQL commands via the idp, id_ctg, or id_prd parameters to the pages module in index.php.

SQL injection vulnerability in index.php in NooTopList 1.0.0 release 17. Remote attackers can execute arbitrary SQL commands via the 'o' or 'sort' parameters.

A direct static code injection vulnerability in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.