CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (1) name or (2) module parameter.

Multiple unknown vulnerabilities in PROMS 0.11 allow non-authorized users to view or modify the project member list or modify the todos list.

A format string vulnerability in Warrior Kings: Battles 1.23 and earlier and Warrior Kings 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname.

The vulnerability in BEA WebLogic Server and WebLogic Express versions 8.1 through Service Pack 3 and 7.0 through Service Pack 5 involves improper handling of exceptions thrown by a security provider. This may result in using an incorrect identity for the thread or failing to audit security exceptions.

Format string vulnerability in the logPrintBadfile function in delbadfiles.c in Iron Bars SHell (ibsh) before 0.3d allows users to access files outside the home directory and possibly execute arbitrary code via certain inputs that are not properly handled in a syslog call.

GDB before version 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running GDB.

Vulnerability in the fixproc tool of Net-snmp versions 5.x before 5.2.1-r1 causes insecure creation of temporary files. A local user can modify the contents of these files to execute arbitrary commands or overwrite arbitrary files via a symlink attack.

SQL injection vulnerability in PortailPHP 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in the News, File, Liens, or Faq modules.

Multiple SQL injection vulnerabilities in PROMS before version 0.11 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

Integer overflow vulnerability in Computer Associates Vet Antivirus library allows remote attackers to gain elevated privileges by sending a crafted compressed VBA directory with a project name length of -1, leading to a heap-based buffer overflow.

Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for viruses, which does not return an error code and prevents viruses from being detected.

An unknown vulnerability in ALWIL avast! antivirus version 4 (4.6.6230) and earlier, running on Windows NT 4.0, causes improper detection of certain viruses.

Unknown vulnerability in MailScanner 4.41.3 and earlier, related to incomplete reporting of viruses in zip files, allows remote attackers to bypass virus detection.

Unknown vulnerability in Blue Coat Reporter before 7.1.2 allows remote unauthenticated attackers to add a license.

SQL injection vulnerability in the Xanthia module for PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga[0] parameter in pnadmin.php.

The vulnerability in PROMS version 0.11 is due to improper handling of certain combinations of rights, resulting in users being granted more privileges than intended.

A format string vulnerability in gxine versions 0.3 through 0.4.4 allows remote attackers to execute arbitrary code via a crafted RAM file where the URL hostname contains format string specifiers.

PHP remote file inclusion vulnerability in common.php in phpATM 1.21 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via a URL in the include_location parameter to index.php.

The vulnerability in episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.

Unknown vulnerability in Groove Virtual Office before version 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 allows remote attackers to bypass restrictions on COM objects.