CVE Vulnerability Catalog

Vulnerability in Windows XP Explorer allows attackers to execute arbitrary code via a specially crafted self-executing folder containing HTML and script that references an executable file within the same folder, which is automatically executed when a user accesses the folder.

Vulnerability in Windows XP Explorer allows a local user to execute arbitrary code via a system folder containing a Desktop.ini file with a .ShellClassInfo specifier that has a CLSID value associated with an executable file.

Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow.

The read_list_from_file function in vacation.pl for OpenWebmail before version 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.

SQL injection vulnerability in the ReMOSitory Server add-on module for Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.

Unspecified vulnerability in procfs in the Linux-VServer stable branch for the 2.4 kernel before 1.23 and development branch before 1.3.5. The flaw allows write access to specific proc entries from a vserver context, potentially leading to unspecified impacts.

Buffer overflow vulnerability in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

The vulnerability in PeerSec MatrixSSL before version 1.1 caches session keys for an indefinitely long time, making it easier for remote attackers to hijack a session.

Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.

A vulnerability in the i-mall.cgi script of I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters in the p parameter.

Multiple vulnerabilities were found in the H.323 protocol implementation in First Virtual Communications products (Click to Meet Express, Premier, Conference Server, and V-Gate). A remote attacker can exploit these flaws to cause a denial of service (DoS), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.

An ActiveX control in McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages using the control's RegQueryValue() method.

A stack-based buffer overflow in pads.c in Passive Asset Detection System (Pads) might allow local users to execute arbitrary code via a long report file name argument. NOTE: since Pads is not normally installed setuid, this may not be a vulnerability.

Vulnerability in Baal Smart Forms before version 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.

The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter to a non-zero value.

An unknown vulnerability related to the handling of large requests in RAdmin for Mac OS X 10.3.3 and Mac OS X 10.2.8 may allow attackers to have unknown impact via unknown attack vectors.

SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.

The vulnerability in UUDeview 0.5.20 and earlier is due to insecure handling of temporary files during decoding. The attack vectors and impact are unknown.

Unspecified vulnerability in ASN.1 Compiler (asn1c) before version 0.9.7, occurring when processing "CHOICE" types with "indefinite length structures." Impact and attack vectors are unknown.

Unspecified vulnerability in ArGoSoft FTP server before version 1.4.2.2 allows attackers to upload .lnk files via unknown vectors.