CVE Vulnerability Catalog

A heap-based buffer overflow in the demo version of Bakbone Netvault, and possibly other versions, allows remote attackers to execute arbitrary commands via a large packet to port 20031.

SQL injection vulnerability in view_user.php in WowBB 1.6, 1.61, and 1.62 allows remote attackers to execute arbitrary SQL commands via the sort_by parameter.

GeoVision Digital Video Surveillance System versions 6.04, 6.1 and 7.0 use a weak encryption scheme to protect passwords. This allows a remote attacker to obtain the password via network sniffing.

The Acrowave AAP-3100AR wireless router allows remote attackers to bypass authentication by pressing CTRL-C at the username or password prompt in a telnet session, which causes the shell to crash and restart, then leave the user in the new shell.

The vulnerability in easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the 'print' parameter.

APG Technology ClassMaster does not properly restrict access to sensitive folders, which allows remote attackers to access folders via a network share.

A stack-based buffer overflow in libTIFF before version 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag.

SQL injection vulnerability in index.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary SQL commands via the entry parameter.

Windows Media Player 9 and 10, in certain cases, allows content protected by Windows Media Digital Rights Management (WMDRM) to redirect the user to a web site to obtain a license, even when the 'Acquire licenses automatically for protected content' setting is not enabled.

A vulnerability in Bugzilla versions 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to enter bugs into products that are closed for bug entry by modifying the URL to specify the product name.

Vulnerability in Firefox before 1.0.4 and Mozilla Suite before 1.7.8 due to improper privilege limitation of JavaScript eval and Script objects in the calling context, allowing remote attackers to perform unauthorized activities via non-DOM property overrides, a variant of CVE-2005-1160.

SQL injection vulnerability in topic.php in DirectTopics 2.1 and 2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.

Vulnerability in Firefox before version 1.0.4 and Mozilla Suite before version 1.7.8 allows an attacker to execute script via specially crafted URLs with 'javascript:' prefix. The flaw results from improper implementation of security checks for script injection, allowing bypass of protection mechanisms.

An integer overflow in the searchfs system call in Mac OS X 10.3.9 and earlier allows local users to execute arbitrary code via crafted parameters.

Unknown vulnerability in the nfs_mount call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments.

Vulnerability in PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie.

The vulnerability in users.ini.php in BoastMachine 3.0 does not properly restrict file upload types, allowing remote attackers to execute arbitrary code.

Stack-based buffer overflow in the URL parsing function in Gaim before 1.3.0 allows remote attackers to execute arbitrary code via an instant message (IM) with a large URL.

Vulnerability in PwsPHP 1.2.2 allows remote attackers to obtain sensitive information via a direct request to the admin directory, which reveals the path in an error message.

Multiple SQL injection vulnerabilities in myBloggie 2.1.1 and 2.1.3 allow remote attackers to execute arbitrary SQL commands via parameters in search.php and index.php.