CVE Vulnerability Catalog

The jammail.pl script in JamMail 1.8 allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the mail parameter.

Vulnerability in mtnpeak.net File Upload Manager allows unauthorized attackers to read and delete arbitrary files on the server. Lack of proper authentication checks for 'view' and 'del' actions enables manipulation of a base64-encoded file parameter.

Heap-based buffer overflow in the CGI extension for Pico Server (pServ) 3.3 allows remote attackers to execute arbitrary code via a long HTTP request.

A vulnerability in Cisco switches supporting 802.1x security allows a remote attacker to bypass port security and gain access to the VLAN by sending spoofed Cisco Discovery Protocol (CDP) messages.

The eTrace_validaddr function in the eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the etrace_host parameter.

PHP remote file inclusion vulnerability in utilit.php of Ovidentia Portal allows remote attackers to execute arbitrary PHP code via the babInstallPath parameter.

Buffer overflow in ptrace in the Linux Kernel for 64-bit architectures allows local users to write bytes into kernel memory.

Vulnerability in I-Man 0.9 and earlier versions allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension.

The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed buddy icon that causes an integer underflow in a loop counter variable.

SQL injection vulnerability in Invision Blog before version 1.1.2 Final allows remote attackers to execute arbitrary SQL commands via the eid and mid parameters.

Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.

Unknown vulnerability in FlexCast Audio Video Streaming Server before version 2.0. Details about impact and attack vectors are unknown.

The vulnerability in hints.pl in Webhints 1.03 allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.

SQL injection vulnerability in login.asp of JiRo's Upload System (JUS) 1 allows remote attackers to execute arbitrary SQL commands via the password parameter.

The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by modifying certain critical code addresses that are later accessed by privileged programs.

A vulnerability in Perception LiteWeb allows remote attackers to bypass access controls for files by adding an extra leading slash (/) or backslash (\) in the URL.

A direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker.

Vulnerability in Sawmill before version 7.1.6 allows a remote attacker to bypass authentication and gain administrative privileges or add a license.

Multiple buffer overflows in Crob FTP 3.6.1, and possibly earlier versions, allow remote attackers to execute arbitrary code via (1) an FTP command with a large string followed by the RMD command with a long string or (2) a globbing ("*") character followed by a long string.

An unknown vulnerability in the privilege system of Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges due to an improperly implemented input check.