CVE Vulnerability Catalog

SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via the username field on the login page or the eventid parameter to calendar.asp.

Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to execute arbitrary SQL commands via the (1) keywords parameter to search.asp, (2) handle parameter to profile.asp, (3) txtUserHandle parameter to reg2.asp, or (4) txtUserEmail parameter to forgot.asp.

PHP remote file inclusion vulnerability in index.php of GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the 'doc' parameter to reference a URL on a remote web server containing the code.

The addImage method in admin.class.php of Image Gallery Web Application 0.9.10 does not properly validate filenames, allowing remote attackers to upload and execute arbitrary files.

Multiple buffer overflows in the digest authentication functionality in Pavuk 0.9.28-r2 and earlier allow remote attackers to execute arbitrary code.

SQL injection vulnerability in ttlast.php and last10.php scripts in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parameter, as demonstrated using last.php.

The Transaction Language 1 (TL1) login interface in Cisco ONS 15327 versions 4.6(0) and 4.6(1) and 15454 and 15454 SDH versions 4.6(0) and 4.6(1) allows remote attackers to gain unauthorized access. The vulnerability occurs when a user account is configured with a blank password and the attacker logs in with a password longer than 10 characters.

DansGuardian 2.8 and earlier allows remote attackers to bypass the extension filtering rule via a hex encoded extension or . in the filename.

Cisco Secure Access Control Server (ACS) version 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and authenticating NDS users with NDS, allows remote attackers to gain unauthorized access to AAA clients via a blank password.

The set_time_limit function in Gallery before version 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which allows remote attackers to upload and execute arbitrary scripts before they are deleted, if the temporary directory is under the web root.

CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline (%0a) before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.

Buffer overflow vulnerability in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command containing a file name with a long extension.

Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F, (2) name, (3) en, (4) upscript, (5) downscript, (6) retries, (7) timeout, (8) scriptdetach, (9) noscript, (10) nodetach, (11) remote_mac, or (12) local_mac flags.

A directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter.

Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the order, project_id, pro_main, or hours_id parameters to index.php or ticket_id to viewticket_details.php.

TikiWiki before version 1.8.4.1 does not properly verify uploaded images, allowing remote attackers to upload and execute arbitrary PHP scripts. This is a different vulnerability than CVE-2005-0200.

PHP remote file inclusion vulnerability in main.inc in KorWeblog 1.6.2-cvs and earlier allows remote attackers to execute arbitrary PHP code by modifying the G_PATH parameter to reference a URL on a remote web server that contains the code, as demonstrated in index.php when using .. (dot dot) sequences in the lng parameter to cause main.inc to be loaded.

Multiple unknown vulnerabilities have been discovered in the ActiveX and HTML file browsers in Symantec Clientless VPN Gateway 4400 Series version 5.0. These vulnerabilities have unknown attack vectors and unknown impact.

Stack-based buffer overflow in the administration interface in Monit 1.4 through 4.2 allows remote attackers to execute arbitrary code via a long username.

A buffer overflow vulnerability in hsrun.exe for HAHTsite Scenario Server 5.1 Patch 06 (build 91) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long project name.