CVE Vulnerability Catalog

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.

Unspecified vulnerability in Journalness 3.0.7 and earlier allows remote attackers to create or modify posts via unknown attack vectors.

Vulnerability in JSSE 1.0.3 through 1.0.3_2 causes improper validation of the client or server certificate chain, allowing a remote attacker to falsely authenticate peers for SSL/TLS.

Unspecified vulnerability in IBM Tivoli SecureWay Policy Director 3.8, Access Manager for e-business 3.9 to 5.1, Access Manager Identity Manager Solution 5.1, Configuration Manager 4.2, Configuration Manager for Automated Teller Machines 2.1.0, and IBM WebSphere Everyplace Server, Service Provider Offering for Multi-platforms 2.1.3 to 2.15 allows remote attackers to hijack sessions of authenticated users via unknown attack vectors involving certain cookies, aka 'Potential Credential Impersonation Attack.'

A buffer overflow vulnerability in the logging component of CCProxy allows remote attackers to execute arbitrary code via a long HTTP GET request.

A buffer overflow vulnerability in the strip_html_tags method in Gyach Enhanced (Gyach-E) before version 1.0.4 allows remote attackers to cause a denial of service and potentially execute arbitrary code via unknown vectors involving HTML tags.

Buffer overflow in queue.c and queued.c in queue before version 1.30.1 may allow remote attackers to execute arbitrary code.

The vulnerability in rexecd for AIX 4.3.3 is due to improper use of a local copy of the pwd structure when calling getpwnam. This may cause the structure to be overwritten by the authenticate function and assign privileges to the wrong user.

The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.

Unknown vulnerability in Moodle before version 1.2 allows teachers to log in as administrators.

A buffer overflow vulnerability in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.

SQL injection vulnerability in NatterChat 1.12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in DUware DUforum versions 3.0 through 3.1. Allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, MSG_ID parameter in messageDetail.asp, or password parameter in the login form.

Buffer overflow in SlimFTPd 3.15 and earlier allows local users to execute arbitrary code via a long command, such as CWD, STOR, MKD, and STAT.

Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument.

A buffer overflow in the POP3 server of 1st Class Mail Server 4.0 via an APOP USER command with a long second parameter (digest) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.

Unknown vulnerability in Tutti Nova versions 0.10 through 0.12 (Beta) and 0.9.4, when register_globals is enabled, has unknown impact and attack vectors.

SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before version 4.0.0.81 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Unspecified vulnerability in ASN.1 Compiler (asn1c) before version 0.9.7, occurring when processing "ANY" type tags.

Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the sortBy, sortOrder, startReg, U, LastCheck, and R parameters.