CVE Vulnerability Catalog

The vulnerability in the edit_image.asp script of Uapplication Uphotogallery allows remote attackers to upload arbitrary files to the server.

Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute arbitrary SQL commands via parameters in various ASP scripts.

Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) versions 1.x and 2.x allows remote attackers to execute arbitrary commands via unknown vectors.

Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.

The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.

A format string vulnerability in the client for Mtp-Target 1.2.2 and earlier allows remote attackers to execute arbitrary code via game messages or other text.

SQL injection vulnerability in login.asp of WWWguestbook 1.1 allows remote attackers to execute arbitrary SQL commands via the password parameter.

SQL injection vulnerability in the admin login panel of Ocean12 Mailing List Manager 1.06 allows remote attackers to execute arbitrary SQL commands via the Admin_id parameter.

Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the search parameter in index.php, phpcoinsessid in login.php, and id, dtopic_id, or dcat_id in mod.php.

Unknown vulnerability in the function used to validate path-names for uploading media in Serendipity before version 0.8. The impact details are unknown.

Claroline versions 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, contain multiple PHP remote file inclusion vulnerabilities. These flaws allow remote attackers to execute arbitrary PHP code on the server via unknown vectors.

Vulnerability in the OHS component versions 1.0.2 through 10.x, when UseWebcacheIP is disabled, allows a remote attacker to bypass HTTP Server mod_access restrictions by sending a request to the webcache TCP port 7778.

Multiple unknown vulnerabilities in OpenView Network Node Manager (OV NNM) versions 6.2, 6.4, 7.01, and 7.50 allow attackers to cause a denial of service or execute arbitrary code.

A buffer overflow vulnerability in the add_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header.

In Claroline 1.5.3 through 1.6 Release Candidate 1 and possibly Dokeos, the scripts document.php and insertMyDoc.php contain directory traversal vulnerabilities. This allows remote project administrators to upload arbitrary files.

SQL injection vulnerability in the notes module for phpBB, in posting_notes.php, allows remote attackers to execute arbitrary SQL commands via the p parameter (used in the $post_id variable) and other attack vectors.

Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the username or password parameters to admin_login.asp, or the searchstring and possibly ID parameters to default.asp.

Vulnerability in PostgreSQL versions 7.3.x through 8.0.x grants public EXECUTE access to certain character conversion functions, allowing unprivileged users to call these functions with malicious values, with unknown impact.

PHP remote file inclusion vulnerability in main.php of osTicket allows remote attackers to execute arbitrary PHP code via the include_dir parameter.

Vulnerability in Serendipity before version 0.8 allows Chief users to hide plugins installed by other users.