CVE Vulnerability Catalog

Unknown vulnerability in Adminedit.pl in YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.

SQL injection vulnerability in pmwh.php of PHPMyWebHosting version 0.3.4 and earlier. A remote attacker can modify SQL queries via the 'password' parameter.

SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in tttadmin/settings.php of Turbo Traffic Trader PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the ttt_admin parameter.

A vulnerability in LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a server crash and client CPU consumption by sending a username starting with a percent sign (%) followed by a null character.

The vulnerability in edituser.php3 in PHPMyChat 0.14.5 allows remote attackers to bypass authentication and gain administrative privileges by setting the do_not_login parameter to false.

Unknown vulnerability in Moodle before version 1.3.3, related to language settings, has unknown impact and attack vectors.

Unknown vulnerability in the 'admin of paypal email addresses' in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors.

A vulnerability in NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the 'autorized=admin; root=admin' value.

A vulnerability in Check Point Firewall-1 versions 4.1 through NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an IKE packet with a specific Vendor ID payload, causing the firewall to respond with version and other details.

The MIME transformation system in phpMyAdmin versions 2.5.0 through 2.6.0-pl1 contains a vulnerability that allows remote attackers to execute arbitrary commands by injecting shell metacharacters in unspecified vectors.

Unknown vulnerability in Rippy the Aggregator before version 0.10, when register_globals is enabled, has unknown attack vectors and impact, possibly related to the user-controlled filter.

ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid characters that are not properly extracted.

SQL injection vulnerability in Ansel 2.1 and earlier allows remote attackers to modify SQL statements via the image parameter.

phpMyAdmin versions 2.5.1 through 2.5.7 contain a vulnerability that allows remote attackers to modify configuration settings by manipulating $cfg['Servers'] variables, potentially leading to unauthorized access to MySQL servers.

Serv-U FTP server before version 5.1.0.0 has a default account and password for local administration. A local user can use this account to create a new user, log in as that user, and then execute arbitrary commands using the SITE EXEC command.

Unknown vulnerability in IlohaMail before version 0.8.14-rc1 has unknown impact and attack vectors.

The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number of POST requests to /Search.

The exit_thread function in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows other processes to access the per-TSS pointers, access restricted memory locations, and possibly gain privileges.

Stack-based buffer overflow in xvbmp.c in XV allows remote attackers to execute arbitrary code via a crafted image file.