CVE Vulnerability Catalog

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters.

The U.S. Robotics USR808054 wireless access point allows remote attackers to cause a denial of service (device crash) and possibly execute arbitrary code via an HTTP GET request with a long version string.

Vulnerability in dbsnmp and nmo programs in Oracle 8i, 9i, and Oracle IAS 9.0.2.0.1 on Unix systems uses a default path to find and execute library files while operating at raised privileges, allowing certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0.

Vulnerability in WpQuiz versions 2.60b1 through 2.60b8 allows remote attackers to gain elevated privileges by directly requesting the adminrestore.php file in the extras directory.

Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag.

SQL injection vulnerability in session.php in LinPHA 0.9.4 allows remote attackers to execute arbitrary SQL code and bypass authentication via the linpha_userid or linpha_password cookies.

SQL injection vulnerability in controlpanel.php of Jaws Framework and Content Management System 0.4 allows remote attackers to execute arbitrary SQL queries and bypass authentication via the user, password, or crypted_password parameters.

A double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause an application crash via a malformed GIF image.

Multiple SQL injection vulnerabilities in the Search module in Php-Nuke allow remote attackers to execute arbitrary SQL via the (1) min or (2) categ parameters.

Integer overflow in imgbmp.cxx in Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.

A buffer overflow vulnerability in Whisper FTP Surfer 1.0.7 allows remote FTP servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long filename.

The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.

The vulnerability in HP OpenView Select Access versions 5.0 through 6.0 is due to incorrect decoding of UTF-8 encoded Unicode characters in a URL. This allows a remote attacker to bypass access restrictions.

Adobe Reader 6.0 improperly handles null characters when splitting a filename path into components, allowing a remote attacker to execute arbitrary code via a file with a long extension not normally handled by Reader, triggering a buffer overflow.

A buffer overflow vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication.

Multiple cross-site scripting vulnerabilities were found in the Search module of Php-Nuke in index.php. A remote attacker can inject arbitrary web script or HTML via the sid, max, sel1-5, match, mod1-3 parameters.

Stack-based buffer overflow in the FTP service for 4D WebSTAR 5.3.2 and earlier allows remote attackers to execute arbitrary code via a long FTP command.

Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.

An unknown vulnerability in the administrative controls of Bugzilla versions 2.17.1 through 2.17.7 allows users with 'grant membership' privileges to grant memberships to groups they do not control.

MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has higher privileges.