CVE Vulnerability Catalog

The Lurm Constructor component (com_lurm_constructor) 0.6b and earlier for Mambo contains a remote file inclusion (RFI) vulnerability in admin.lurm_constructor.php. An attacker can execute arbitrary PHP code by supplying a malicious URL in the lm_absolute_path parameter.

A PHP remote file inclusion (RFI) vulnerability in index.php in RedBLoG 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. The provenance of this information is unknown; details are from third-party sources.

A vulnerability in Alt-N WebAdmin 3.2.3 and 3.2.4 (running with MDaemon 9.0.5 and possibly earlier) allows a remote authenticated domain administrator to change a global administrator's password via the userlist.wdm file, leading to privilege escalation.

Buffer overflow in the HTTP header parsing in Streamripper before 1.61.26 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted HTTP headers.

Multiple PHP remote file inclusion vulnerabilities in VistaBB 2.0.33 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/functions_mod_user.php or (2) includes/functions_portal.php.

The Eichhorn Portal from Guder und Koch Netzwerktechnik contains multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via unspecified vectors, possibly including the profil_nr, sprache, suchstring, GaleryKey, Breadcrumbs, and GGBNSaction parameters.

Multiple PHP remote file inclusion vulnerabilities exist in the Rssxt component for Joomla! (com_rssxt), possibly in versions 2.0 Beta 1, 1.0 and earlier. A remote attacker could execute arbitrary PHP code via the mosConfig_absolute_path parameter in pinger.php, RPC.php, or rssxt.php. However, another researcher has disputed this issue, stating the attacker cannot control this parameter, and the original researcher has been unreliable in other reports.

PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD (com_contxtd) component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. Another researcher has disputed this issue, saying that the software prevents the attack by checking whether _VALID_MOS is defined.

SQL injection vulnerability in alltopics.php in the All Topics Hack 1.5.0 and earlier for phpBB 2.0.21 allows remote attackers to execute arbitrary SQL commands via the start parameter.

A vulnerability in the Fuji Xerox FXPS print engine allows attackers to use the FTP printing interface as a proxy (FTP bounce). By manipulating PORT arguments in FTP requests, an attacker can connect to systems that would otherwise be restricted.

PHP remote file inclusion vulnerability in config.kochsuite.php in the Kochsuite (com_kochsuite) 0.9.4 component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

SQL injection vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability in user logon authentication request handling in Cool_CoolD.exe in Cool Manager 5.0 (5,60,90,28) and Cool Messenger Office/School Server 5.5 (5,65,12,13). A remote attacker can execute arbitrary SQL commands via the username field.

A PHP remote file inclusion (RFI) vulnerability in ToendaCMS 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tcms_administer_site parameter. The issue has been disputed by a third party, who states that $tcms_administer_site is initialized to a constant value within index.php.

Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.

A stack-based buffer overflow exists in channels/chan_mgcp.c in MGCP in Asterisk versions 1.0 through 1.2.10. A remote attacker can execute arbitrary code by sending a crafted audit endpoint (AUEP) response.

PHP remote file inclusion vulnerability in sef.php in the OpenSEF 2.0.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

SQL injection vulnerability in list.php in CityForFree indexcity 1.0 occurs when magic_quotes_gpc is disabled. A remote attacker can execute arbitrary SQL commands via the cate_id parameter.

Buffer overflow vulnerability in the sppp driver in FreeBSD, NetBSD, and OpenBSD. A remote attacker can send crafted Link Control Protocol (LCP) packets with an option length exceeding the overall length, triggering the overflow. This leads to a kernel panic (denial of service), sensitive information disclosure, and possibly arbitrary code execution.

The EstateAgent component (com_estateagent) for Mambo contains a remote file inclusion vulnerability in estateagent.php. When register_globals is enabled, a remote attacker can execute arbitrary PHP code by supplying a URL in the mosConfig_absolute_path parameter.