CVE Vulnerability Catalog

SQL injection vulnerability in the ReMOSitory Server add-on module for Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.

Vulnerability in Baal Smart Forms before version 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.

Multiple unknown vulnerabilities have been discovered in Real Estate Management Software 1.0. Their impact and attack vectors are unspecified.

Multiple unknown vulnerabilities have been discovered in Online Recruitment Agency 1.0. Their impact and attack vectors are unspecified.

SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.

SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.

Multiple overflows in the io_edgeport driver for Linux kernel 2.4.x have unknown impact and unknown attack vectors.

Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.

EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chosen plaintext attack.

The vulnerability in login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.

Multiple buffer overflows in LaTeX2rtf 1.9.15 and possibly other versions allow remote attackers to execute arbitrary code via the expandmacro function, and possibly Environments and TranslateCommand.

The print-from-email feature in Canon ImageRUNNER 5000i and C3200 allows remote attackers to print arbitrary text without authentication by sending a text/plain email to TCP port 25, when IP address range filtering is not used.

Unknown vulnerability in F-Secure Anti-Virus (FSAV) 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV.

SQL injection vulnerability in index.cfm of CFWebstore 5.0 allows remote attackers to execute arbitrary SQL commands via category_id, product_id, or feature_id parameters.

Vulnerability in Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options handled by iftpmgr.exe.

Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the 'product' parameter in showproduct.php or the 'cat' parameter in showcat.php.

A stack-based buffer overflow in the DecodeBase16 function, used in the IRC module and web server in eMule 0.42d, allows remote attackers to execute arbitrary code via a long string.

A format string vulnerability in the logging function of IGI 2 Covert Strike server version 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in RCON commands.

An unspecified vulnerability exists in SurgeMail before version 2.2c10 related to a Webmail security bug. The impact and attack vectors are unknown.