CVE Vulnerability Catalog

Multiple integer overflows in xzgv 0.8 and earlier allow remote attackers to execute arbitrary code via images with large width and height values, which trigger a heap-based buffer overflow, as demonstrated in the read_prf_file function in readprf.c.

The gui_popup_view_fly function in gui_tview_popup.c in junkie 0.3.1 allows remote malicious FTP servers to execute arbitrary commands via shell metacharacters in a filename.

Woltlab Burning Book 1.0 Gold, 1.1.1e, and possibly other versions contain an SQL injection vulnerability in addentry.php. Remote attackers can execute arbitrary SQL commands via the user-agent parameter.

The vulnerability in the changepassword.cgi script of ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious 'make' program.

Buffer overflow vulnerability in the process_abc function in abc.c of abc2mtex 1.6.1 allows remote attackers to execute arbitrary code via crafted ABC files.

A buffer overflow vulnerability in the C2S module of the open source Jabber 2.x server (Jabberd) allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long username.

The load_elf_binary function in the binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 does not properly check return values from calls to the kernel_read function, which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.

Buffer overflow vulnerability in the parse_html function in o3read.c of o3read 0.0.3 allows remote attackers to execute arbitrary code via a crafted SXW file.

In PHP versions 4.x to 4.3.9 and 5.x to 5.0.2, the safe mode checks truncate the file path before passing data to the realpath function, which could allow attackers to bypass safe mode restrictions.

The vulnerability in the LSASS (Local Security Authority Subsystem Service) on Windows 2000 Server and Windows Server 2003 is due to improper validation of connection information. This allows a local user to elevate privileges by running a specially crafted program.

Multiple buffer overflows in the event_text and event_specific functions in abc2midi 2004.12.04 allow remote attackers to execute arbitrary code via crafted ABC files.

The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the 'DHCP Request Vulnerability.'

Vulnerability in WinRAR 3.40 and earlier versions allows remote attackers to execute arbitrary code via a crafted ZIP file containing a file with a long filename. The issue stems from an integer overflow leading to a buffer overflow.

Buffer overflow vulnerability in the switch_voice function in parse.c of jcabc2ps 20040902 allows remote attackers to execute arbitrary code via a crafted ABC file.

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the module, action, or theme parameters to index.php, the theme parameter to Login.php, and possibly other parameters or scripts.

A format string vulnerability in Kreed 1.05 and earlier allows remote attackers to execute arbitrary code via format specifiers in a nickname or message text.

Unknown vulnerability in the bsd.a kernel networking for SGI IRIX versions 6.5.22 through 6.5.25, and possibly earlier, in which 't_unbind changes t_bind's behavior.'

Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.

The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacters.

The binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 may create a non-NULL-terminated interpreter name string, leading to strings longer than PATH_MAX and buffer overflows. A local user can exploit this to cause a denial of service (hang) and potentially execute arbitrary code.