CVE Vulnerability Catalog

Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows.

Stack-based buffer overflow in the HTTP server in NetChat 7.3 and earlier allows remote attackers to execute arbitrary code via a long GET request.

In the Linux kernel 2.4.25 and earlier, an integer overflow exists in the SCTP_SOCKOPT_DEBUG_NAME socket option. A local user can pass an optlen value of -1, causing kmalloc to allocate 0 bytes of memory, enabling arbitrary code execution.

The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.

PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to reference a URL on a remote web server that contains phpshop.cfg.

An unknown vulnerability related to the handling of large requests in RAdmin for Mac OS X 10.3.3 and Mac OS X 10.2.8 may allow attackers to have unknown impact via unknown attack vectors.

SCO OpenServer versions 5.0.5 through 5.0.7 only support Xauthority style access control when logging in using scologin. This allows remote attackers to gain unauthorized access to an X session via other X login methods.

Buffer overflow in the Entrust LibKmp ISAKMP library, used by Symantec Enterprise Firewall and other products, allows remote attackers to execute arbitrary code via a crafted ISAKMP payload.

The Altiris Client Service for Windows 5.6 SP1 Hotfix E (5.6.181) allows local users to execute arbitrary commands by opening the AClient tray icon and using the View Log File option, a different vulnerability than CVE-2005-1590.

Vulnerability in Macallan Mail Solution 2.8.4.6 (Build 260) and earlier versions allows a remote attacker to bypass authentication in the web interface by sending an HTTP GET request with two slashes ("//") after the server name.

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via various parameters in PHP files.

Finjan SurfinGate 6.0 and 7.0 in proxy mode do not authenticate FHTTP commands on TCP port 3141, allowing remote attackers to restart the service, view log information, or force a policy update from the database server.

Multiple SQL injection vulnerabilities in QuadComm Q-Shop allow remote attackers to execute arbitrary SQL commands via certain parameters to multiple ASP scripts.

SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.

Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.

CSRF vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php.

SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the sortdir or criteria parameter to ladder-log.asp or the memberid or teamid parameter to view-profile.asp.

Unknown vulnerability in Windows File Sharing for Mac OS X versions 10.1.5 through 10.3.2 that does not 'shutdown properly'.

Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.

SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action.