CVE Vulnerability Catalog

Cisco Secure Access Control Server (ACS) version 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and authenticating NDS users with NDS, allows remote attackers to gain unauthorized access to AAA clients via a blank password.

The set_time_limit function in Gallery before version 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which allows remote attackers to upload and execute arbitrary scripts before they are deleted, if the temporary directory is under the web root.

CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline (%0a) before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.

Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F, (2) name, (3) en, (4) upscript, (5) downscript, (6) retries, (7) timeout, (8) scriptdetach, (9) noscript, (10) nodetach, (11) remote_mac, or (12) local_mac flags.

A directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter.

Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the order, project_id, pro_main, or hours_id parameters to index.php or ticket_id to viewticket_details.php.

TikiWiki before version 1.8.4.1 does not properly verify uploaded images, allowing remote attackers to upload and execute arbitrary PHP scripts. This is a different vulnerability than CVE-2005-0200.

PHP remote file inclusion vulnerability in main.inc in KorWeblog 1.6.2-cvs and earlier allows remote attackers to execute arbitrary PHP code by modifying the G_PATH parameter to reference a URL on a remote web server that contains the code, as demonstrated in index.php when using .. (dot dot) sequences in the lng parameter to cause main.inc to be loaded.

Multiple unknown vulnerabilities have been discovered in the ActiveX and HTML file browsers in Symantec Clientless VPN Gateway 4400 Series version 5.0. These vulnerabilities have unknown attack vectors and unknown impact.

Stack-based buffer overflow in the administration interface in Monit 1.4 through 4.2 allows remote attackers to execute arbitrary code via a long username.

A buffer overflow vulnerability in hsrun.exe for HAHTsite Scenario Server 5.1 Patch 06 (build 91) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long project name.

PHP remote file inclusion vulnerability in HotNews 0.7.2 and earlier allows remote attackers to execute arbitrary PHP code via the config[header] parameter to hotnews-engine.inc.php3 or config[incdir] parameter to hnmain.inc.php3.

A vulnerability in the athenareg.php script in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass parameter.

Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the img, cat, sort_key, order_key, user, or album parameters.

In certain OpenBSD versions, PF (Packet Filter) with stateful filtering enabled does not restrict packets for a session to the original interface, allowing remote attackers to bypass intended packet filters via spoofed packets to other interfaces.

PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to reference a URL on a remote web server that contains phpshop.cfg.

Stack-based buffer overflow in the HTTP server in NetChat 7.3 and earlier allows remote attackers to execute arbitrary code via a long GET request.

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via various parameters in PHP files.

In the Linux kernel 2.4.25 and earlier, an integer overflow exists in the SCTP_SOCKOPT_DEBUG_NAME socket option. A local user can pass an optlen value of -1, causing kmalloc to allocate 0 bytes of memory, enabling arbitrary code execution.

The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.