CVE Vulnerability Catalog

A buffer overflow vulnerability exists in multiple 'p' commands in IBM AIX 5.1, 5.2, and 5.3. A local user can exploit long command line arguments to execute arbitrary code via commands such as penable, pdisable, pstart, phold, pdelay, or pshare.

Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the data or torrents directories with insufficient access control, allowing remote attackers to obtain sensitive information such as account names and password hashes, as demonstrated using data/newusers.

Buffer overflow in the diagTasksWebSM command in IBM AIX 5.1, 5.2 and 5.3 might allow local users to execute arbitrary code via long command line arguments.

Buffer overflow vulnerability in the getlvname command in IBM AIX 5.1, 5.2 and 5.3. A local user can exploit long command line arguments to execute arbitrary code.

A stack-based buffer overflow in Microsoft Word 2000 and Word 2002, and Microsoft Works Suites 2000 through 2004, might allow remote attackers to execute arbitrary code via a .doc file with long font information.

Format string vulnerability in the swcons command in IBM AIX 5.3, and possibly other versions, allows local users to execute arbitrary code via long command line arguments.

Multiple SQL injection vulnerabilities in Dragonfly Commerce allow remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the key parameter to dc_Categoriesview.asp, dc_productslist_Clearance.asp, PID parameter to ratings.asp, dc_Productsview.asp, start, key_mp, searchtype, or psearch parameters to dc_forum_Postslist.asp. The vendor disputes this, claiming errors arise from invalid category and product numbers, but the issue still meets the CVE definition of exposure.

The ReadLog function in kaiseki.cgi in pngren allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.

Vulnerability in phpWishlist before version 0.1.15 allows remote attackers to bypass authentication via a direct request to admin.php, bypassing login.

Multiple SQL injection vulnerabilities in CartWIZ allow remote attackers to modify SQL statements via the idProduct parameter to tellAFriend.asp, sortType parameter to viewSupportTickets.asp, or the id parameter to updateCreditCards.asp or deleteCreditCards.asp.

Multiple unknown vulnerabilities in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allow attackers to bypass authentication.

Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the 'Messages waiting' message.

PHP remote file inclusion vulnerability in lang.php in SPiD before 1.3.1 allows remote attackers to execute arbitrary code via the lang_path parameter.

A buffer overflow in the mms_interp_header function in mms.c in MMS Ripper before 0.6.4 might allow remote attackers to execute arbitrary code via a file with more than 20 streams.

SQL injection vulnerability in sql.cls.php in Id Board 1.1.3 allows remote attackers to modify SQL queries via the f parameter in index.php.

The vulnerability in eRoom 6.x allows a remote attacker to attach .lnk files, enabling arbitrary command execution on the server.

SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute arbitrary SQL statements via the temp array, which is not initialized before it is used and prevents the attacker-supplied portions of the array from being properly escaped.

The vulnerability in the class.xmail.php script in PhpXmail versions 0.7 through 1.1 is due to improper handling of long passwords. As a result, no error message is returned, allowing a remote attacker to bypass authentication and gain unauthorized access.

Multiple SQL injection vulnerabilities in Comersus shopping cart allow remote attackers to execute arbitrary SQL commands via the email parameter to comersus_optAffiliateRegistrationExec.asp or idProduct parameter to comersus_optReviewReadExec.asp.

The vulnerability in eRoom is due to the lack of an expiration date for cookies, allowing a remote attacker to capture cookies and conduct replay attacks.