CVE Vulnerability Catalog

Vulnerability in ZoneAlarm Pro 4.5.538.001 and possibly other versions allows remote attackers to bypass email protection via attachments whose names contain certain non-English characters.

SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.

SQL injection vulnerability in auth.php and admin.php files of PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account by sending base64-encoded SQL in the admin parameter.

The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wiki_up URL.

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode and offset parameters in many PHP scripts.

Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the Theme, Country, Real Name, or Displayed time zone fields in a User Profile, or the Name, Description, URL, or Country fields in a Directory/Add Site operation.

The X-Micro WLAN 11b Broadband Router version 1.6.0.1 contains hardcoded credentials: username and password "1502". This allows remote attackers to gain access to the device.

X-Micro WLAN 11b Broadband Router versions 1.2.2, 1.2.2.3, 1.2.2.4, and 1.6.0.0 contain a hardcoded administrative account named "super" with a default password. This allows a remote attacker to gain full access to the device without authorization.

A format string vulnerability in the test_func_func function in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the str variable.

Multiple buffer overflows in LCDProc 0.4.1 and possibly other 0.4.x versions up to 0.4.4 allow remote attackers to execute arbitrary code via (1) a long invalid command to parse_all_client_messages function, or (2) long argv command to test_func_func function.

A buffer overflow vulnerability in the parse_all_client_messages function in LCDproc versions 0.4.x through 0.4.4 allows remote attackers to execute arbitrary code by sending a large number of arguments.

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 and 10 allow remote attackers to inject arbitrary web script or HTML via parameters such as email, file, dns, account, db, login, or ip in URLs.

GTKSee versions 0.5 and 0.5.1 have a heap-based buffer overflow that allows remote attackers to execute arbitrary code via a PNG image of certain color depths.

Buffer overflow in cd9660.util in Apple Mac OS X versions 10.0 through 10.3.2 and Apple Mac OS X Server versions 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.

mod_access in Apache 1.3 before 1.3.30, when running on big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.

Workgroup Manager in Apple Mac OS X Server 10.2 through 10.2.6 does not disable a password for a new account before it is saved, allowing remote attackers to gain unauthorized access via the new account before it is saved.

Synaesthesia 2.2 and earlier allows local users to execute arbitrary code via a symlink attack on the configuration file.

Directory Services in Apple Mac OS X versions 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server versions 10.2 through 10.3.2 accept authentication server information from unknown LDAP or NetInfo sources, which can be exploited by a malicious DHCP server.

Apple Mac OS X versions 10.0 through 10.2.8 allow local users with a USB keyboard to gain unauthorized access. This can be achieved by holding down the CTRL and C keys during system boot, which crashes the init process and leaves the user in a root shell.

An unknown vulnerability in rpc.mountd on SGI IRIX versions 6.5.18 through 6.5.22 allows remote attackers to mount from unprivileged ports even with the -n option disabled.