CVE Vulnerability Catalog

Vulnerability in PHP 4.x up to 4.3.9 and PHP 5.x up to 5.0.2, running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended directory by using shell metacharacters in the current directory name.

Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.

Buffer overflow vulnerability in hpsockd before version 0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code.

The HyperTerminal application in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value saved in a session file, allowing remote attackers to execute arbitrary code via a malicious .ht session file, website, or Telnet URL in an email, triggering a buffer overflow.

Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.

Format string vulnerability in Soldner Secret Wars 30830 and earlier allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in a message.

Multiple SQL injection vulnerabilities in ReviewPost PHP Pro before version 2.84 allow remote attackers to execute arbitrary SQL commands via the cat parameter in showcat.php and the product parameter in addfav.php.

A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, which causes emails to remain in IIS or Exchange mail queues.

A vulnerability in FlatNuke 2.5.1 allows a remote attacker to inject and execute arbitrary PHP code by placing it in the url_avatar field.

Buffer overflow vulnerability in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command containing a file name with a long extension.

Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F, (2) name, (3) en, (4) upscript, (5) downscript, (6) retries, (7) timeout, (8) scriptdetach, (9) noscript, (10) nodetach, (11) remote_mac, or (12) local_mac flags.

A directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.

Multiple SQL injection vulnerabilities in Land Down Under (LDU) v701 allow remote attackers to execute arbitrary SQL commands or obtain the installation path via parameters including (1) s, w, and d in users.php, (2) id in comments.php, (3) rusername in auth.php, or (4) h in plug.php.

Unknown vulnerability in the dotlock implementation in mailutils before version 1:0.5-4 on Debian GNU/Linux allows attackers to gain privileges.

SQL injection vulnerability in the sloth TCL script in QuoteEngine before version 1.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

A directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter.

PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch_path parameter.

The set_time_limit function in Gallery before version 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which allows remote attackers to upload and execute arbitrary scripts before they are deleted, if the temporary directory is under the web root.

Vulnerability in Jaws 0.3 allows remote attackers to bypass authentication by sending an HTTP request to admin.php with the 'logged' cookie set to the MD5 hash of a null password, which is compared against the 'logged' session variable in the logged_on function in application.php.

The vulnerability in Tomcat before version 5.0.27-r3 on Gentoo Linux sets default permissions on init scripts to tomcat:tomcat, but executes them with root privileges, allowing local users in the tomcat group to execute arbitrary commands as root by modifying the scripts.