CVE Vulnerability Catalog

The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.

Buffer overflow vulnerability in apply.cgi in Linksys WRT54G routers versions 3.01.03, 3.03.6, and possibly others before 4.20.7. A remote attacker can exploit a long HTTP POST request to execute arbitrary code on the device.

A buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.

The vulnerability in the ezconfig.asp file of the Linksys WRT54G router (versions 3.01.03, 3.03.6, and some configurations of 2.04.4) is due to the lack of an authentication initialization function. A remote attacker can obtain encrypted configuration information and, if the key is known, modify the configuration.

SQL injection vulnerability in WEB//NEWS 1.4 allows remote attackers to execute arbitrary SQL commands via the wn_userpw parameter in startup.php, cat, id, or stof parameters in news.php, and id parameter in print.php.

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as demonstrated using .inc files.

A direct static code injection vulnerability in setcookie.php of PBLang 4.65 allows remote attackers to inject arbitrary PHP code via the 'u' parameter, which is later executed upon login.

The vulnerability in Check Point NGX R60 allows remote attackers to bypass firewall rules for the predefined CIFS service group. The system does not properly verify packets against this rule, enabling attackers to circumvent intended restrictions.

Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands via the fid parameter in misc.php or the Content-Disposition field in the HTTP header in newreply.php.

phpCommunityCalendar 4.0.3 allows remote attackers to bypass authentication and gain unauthorized access via a direct request to the admin directory.

A heap-based buffer overflow in NOD32 2.5 with active scanning enabled allows remote attackers to execute arbitrary code via an ARJ archive containing a file with a long filename.

Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 and earlier allow remote attackers to execute arbitrary SQL commands via the login field in login.php or the LocationID parameter in week.php.

SQL injection vulnerability in class-1 Forum Software 0.24.4 allows remote attackers to execute arbitrary SQL commands and bypass the file extension check via SQL code in the file extension of an uploaded file.

Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.

Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.

The vulnerability in the umount tool from util-linux (versions 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2) and other packages such as loop-aes-utils allows local users with unmount permissions to gain privileges via the -r (remount) option, which causes the file system to be remounted with just the read-only flag, effectively clearing the nosuid, nodev, and other flags.

Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all soft hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.

Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via certain DHCP responses.

SQL injection vulnerability in BlueWhaleCRM allows remote attackers to execute arbitrary SQL commands via the Account ID field.

The ADSL Road Runner modem in the Annex A family has a service running on port 224, which allows remote attackers to login to the modem with a blank password and gain unauthorized access.