CVE Vulnerability Catalog

PHP remote file inclusion vulnerability in CaLogic 1.2.2 allows remote attackers to execute arbitrary code via the CLPATH parameter to (1) cl_minical.php, (2) clmcpreload.php, (3) mcconfig.php, or (4) mcpi-demo.php.

The JPEG decoder in Microsoft Internet Explorer allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via certain crafted JPEG images, as demonstrated using (1) mov_fencepost.jpg, (2) cmp_fencepost.jpg, (3) oom_dos.jpg, or (4) random.jpg.

A vulnerability in WebCalendar before version 1.0.0 allows remote attackers to gain unauthorized privileges due to insufficient access restrictions on the assistant_edit.php script.

Vulnerability in inc.login.php in PHPsFTPd versions 0.2 through 0.4 allows a remote attacker to bypass the login mechanism and obtain the administrator's username and password by setting the do_login parameter and performing an edit action using user.php, which causes the password to leak in the response.

The vulnerability in management.php in Realnode Emilda 1.2.2 and earlier allows remote attackers to perform actions as other users by modifying the user_id parameter.

Vulnerability in Shorewall versions 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.

Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916.

A vulnerability in Check Point SecuRemote NG with Application Intelligence R54 allows attackers to obtain credentials and gain privileges via unknown attack vectors.

Multiple SQL injection vulnerabilities were found in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed. An attacker can modify SQL statements via the id parameter in viewattach.php, viewuser_id parameter in users.php, or the id or forum parameter in viewforum.php.

DG Remote Control Server 1.6.2 is vulnerable to a denial of service (crash or high CPU consumption) and possible arbitrary code execution via a long message sent to TCP port 1071 or 1073, likely due to a buffer overflow.

Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors.

WebEOC before version 6.0.2 does not properly check user authorization, allowing remote attackers to gain privileges via a direct request to a resource.

WebEOC before version 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords.

In MailEnable Professional 1.54, a stack-based buffer overflow exists in the IMAP daemon (imapd). A remote authenticated user can exploit this by sending a status command with a long mailbox name, leading to arbitrary code execution.

Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain valid TCP or UDP request.

WPS Web Portal System 0.7.0 contains a vulnerability in the wps_shop.cgi script that allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters in the 'art' and 'cat' variables.

Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename argument of a PUT command.

The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including USANet Shopping Mall Software, Domain Name Auction Software, Standard Classified Ads Software, and MakeBid Reverse Auction, allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.

Vulnerability in Firefox before version 1.0.5 allows remote attackers to steal information and potentially execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.

Vulnerability in Firefox, Thunderbird, Mozilla, Netscape, and K-Meleon browsers allows XBL scripts to run even when JavaScript is disabled. A remote attacker can exploit this flaw to bypass script protection.