CVE Vulnerability Catalog

Vulnerability in ADP Elite System Max 9000 allows remote authenticated users to gain privileges by uploading a .profile that sets the ADPROOT environment variable to the root directory.

The vulnerability in Mac OS X 10.3.9 and earlier allows users to install, create, and execute scripts with setuid/setgid bits set, contrary to the intended design. This may allow attackers to conduct unauthorized activities with escalated privileges via vulnerable scripts.

SQL injection vulnerability in index.php for zOOm Media Gallery 2.1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

Multiple SQL injection vulnerabilities in ProductCart 2.7 allow remote attackers to execute arbitrary SQL commands via the Category or resultCnt parameters to advSearch_h.asp, and possibly the offset parameter to tarinasworld_butterflyjournal.asp.

Multiple buffer overflows in RUMBA 7.3 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted values in a profile file, as demonstrated using a long SysName field.

The vulnerability allows remote code execution via PHP file inclusion by manipulating the 'view' parameter in index.php of AlstraSoft EPay Pro 2.0. An attacker can modify this parameter to point to a URL containing malicious code, which will be executed on the server.

The vulnerability in the 'at' commands on Mac OS X 10.3.7 and earlier is due to improper privilege dropping. This allows a local user to delete arbitrary files via atrm, execute arbitrary programs, or read arbitrary files using the -f argument to batch.

Buffer overflow vulnerability in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in .m3u or .pls playlist files.

Format string vulnerability in auditselect on IBM AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via format string specifiers in a command line argument.

The vulnerability in Squid 2.5 involves incorrect processing of empty Access Control Lists (ACLs) during configuration file parsing, particularly proxy_auth ACLs without defined auth schemes, which effectively removes arguments and could allow remote attackers to bypass intended ACLs if the administrator ignores parser warnings.

A heap-based buffer overflow in multiple F-Secure Anti-Virus and Internet Security products allows remote attackers to execute arbitrary code via a crafted ARJ archive.

A vulnerability in Netfilter in Linux kernel 2.6.8.1 allows a remote attacker to cause a denial of service (kernel crash) via crafted IP packet fragments.

A vulnerability in Microsoft Windows systems allows a remote attacker to cause a denial of service and potentially execute arbitrary code by sending crafted IP packets with malformed options. This flaw affects Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems.

A buffer overflow vulnerability in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, also known as the 'URL Parsing Memory Corruption Vulnerability.'

Vulnerability in Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, responds to 407 proxy auth requests from arbitrary servers, allowing remote attackers to steal NTLM or SPNEGO credentials.

Internet Explorer 5.01, 5.5, and 6 contains a vulnerability that allows remote attackers to execute arbitrary code via drag and drop events. This flaw is known as the 'Drag-and-Drop Vulnerability.'

A buffer overflow vulnerability in the decode_post function in ELOG before version 2.5.7 allows remote attackers to execute arbitrary code via attachments with long file names.

Multiple SQL injection vulnerabilities in DCP-Portal 6.1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the lcat, doc, or uid parameters to index.php, or (2) the mid or bid parameters to forums.php.

A vulnerability in the Linux kernel 2.6 before version 2.6.11 allows a local user to gain elevated privileges by injecting mouse or keyboard events into other user sessions. The issue is due to missing access restrictions on the N_MOUSE line discipline for a TTY.

Vulnerability in AS/400 Telnet 5250 terminal emulation clients (IBM Client Access, Bosanova, PowerTerm, Mochasoft, and others) allows malicious AS/400 servers to execute arbitrary commands on the client workstation. The attack uses a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC Command), e.g., to create a backdoor account via REXEC.