CVE Vulnerability Catalog

The vulnerability in upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code.

A vulnerability in Symantec AntiVirus 9 Corporate Edition allows local users to gain privileges via the 'Scan for viruses' option, which launches a help window with raised privileges. This is a reintroduction of a vulnerability originally identified and addressed in CVE-2002-1540.

The HTTP proxy in Astaro Security Linux 6.0 does not properly filter HTTP CONNECT requests to localhost, which allows remote attackers to bypass firewall rules and connect to local services.

SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the username value in the pafiledbcookie cookie.

Stack-based buffer overflow in the ACE archive decompression library (vrAZace.dll) in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall, when compressed file scanning is enabled, allows remote attackers to execute arbitrary code via an ACE archive that contains a file with a long filename.

A buffer overflow vulnerability in ad_pcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via crafted PCM audio data, as demonstrated using a video file with an audio header containing a large value in a stream format (strf) chunk.

The event_pin_code_request function in the btsrv daemon (btsrv.c) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name.

PHP remote file inclusion vulnerability in WebCalendar before version 1.0.1. An attacker can remotely execute arbitrary PHP code when opening settings.php, possibly via send_reminders.php or other scripts.

A buffer overflow vulnerability in WinAce 2.6.0.5 and possibly earlier versions allows remote attackers to execute arbitrary code via a temporary (.tmp) file containing an entry with a long file name.

SQL injection vulnerability in search.php of MyBulletinBoard (MyBB) versions 1.00 Release Candidate 1 through 4. A remote attacker can execute arbitrary SQL commands via the uid parameter.

SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via a direct request to admin/PhpMyExplorer/editerfichier.php, then editing the desired file to contain the PHP code, as demonstrated using header.php in the fichier parameter. NOTE: it is possible that this vulnerability stems from PhpMyExplorer, which is a separate package.

Directory traversal vulnerability in SaveWebPortal 3.4 allows remote attackers to include arbitrary files and execute arbitrary local PHP programs via '..' sequences in the SITE_Path parameter to menu_dx.php or CONTENTS_Dir parameter to menu_sx.php.

Vulnerability in Mantis 0.19.0a1 through 1.0.0a3 in core/database_api.php, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type variable and monitoring the speed of responses.

Multiple SQL injection vulnerabilities in RunCMS 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the addquery and subquery parameters in the newbb plus module, the forum parameter in newtopic.php, edit.php, and reply.php of the newbb plus module, and the msg_id parameter in print.php of the messages module.

The vulnerability in includes/common.php in RunCMS 1.2 and earlier uses the extract function with EXTR_OVERWRITE on HTTP POST variables, allowing remote attackers to overwrite arbitrary variables, potentially leading to arbitrary code execution.

SQL injection vulnerability in the Downloads module of PostNuke 0.760-RC4b allows administrators to execute arbitrary SQL commands via the 'show' parameter in dl-viewdownload.php.

PHP remote file inclusion vulnerability in SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via the SITE_Path parameter to menu_dx.php or CONTENTS_Dir parameter to menu_sx.php.

Multiple SQL injection vulnerabilities in PHPKit 1.6.1 allow remote attackers to execute arbitrary SQL commands via the letter parameter in login/member.php or the im_receiver parameter in login/imcenter.php.

The vulnerability in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 relies on AUTH_UNIX authentication, which uses user ID for authentication and allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID.

The vulnerability in EMC Legato NetWorker, Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 6.0 through 7.2 is due to improper verification of authentication tokens. A remote attacker can modify an authentication token to gain unauthorized privilege escalation.