CVE Vulnerability Catalog

Vulnerability in Windows XP Explorer allows a local user to execute arbitrary code via a system folder containing a Desktop.ini file with a .ShellClassInfo specifier that has a CLSID value associated with an executable file.

Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.

A stack-based buffer overflow vulnerability in the FTP daemon of HP-UX 11.11i with the -v (debug) option enabled allows remote attackers to execute arbitrary code via a long command request.

Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow.

CSRF vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php.

The read_list_from_file function in vacation.pl for OpenWebmail before version 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.

Multiple buffer overflows in Gyach Enhanced (Gyach-E) before version 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by sending certain typing statuses or setting the chat room status bar to the current chat room name.

SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.

Multiple buffer overflows in Gyach Enhanced (Gyach-E) before version 1.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to avatar retrieval.

In Novell Web Manager for Novell NetWare 6.5, the webadmin-apache.conf file uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, allowing remote attackers to bypass access control to the WEB-INF folder.

Buffer overflow vulnerability in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the username and password parameters.

SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter in the recentTopics and welcome functions.

A vulnerability in the i-mall.cgi script of I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters in the p parameter.

A stack-based buffer overflow in pads.c in Passive Asset Detection System (Pads) might allow local users to execute arbitrary code via a long report file name argument. NOTE: since Pads is not normally installed setuid, this may not be a vulnerability.

SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.

The vulnerability in UUDeview 0.5.20 and earlier is due to insecure handling of temporary files during decoding. The attack vectors and impact are unknown.

A vulnerability in SurgeLDAP 1.0g (Build 12) and possibly earlier versions before 1.0h allows remote attackers to bypass authentication for the administration interface via a direct request to admin.cgi with a modified utoken parameter.

The vulnerability in the ImageManager component in e107 before version 0.617 allows a remote attacker to execute arbitrary code by uploading a PHP file due to improper file type validation.

Unknown vulnerability in the 'access code' in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.