CVE Vulnerability Catalog

Buffer overflow vulnerability in the sppp driver in FreeBSD, NetBSD, and OpenBSD. A remote attacker can send crafted Link Control Protocol (LCP) packets with an option length exceeding the overall length, triggering the overflow. This leads to a kernel panic (denial of service), sensitive information disclosure, and possibly arbitrary code execution.

Multiple PHP remote file inclusion vulnerabilities in Shadows Rising RPG (Pre-Alpha) 0.0.5b and earlier allow remote attackers to execute arbitrary PHP code. The flaw is triggered via a URL in the CONFIG[gameroot] parameter to security.inc.php, smarty.inc.php, and qlib/smarty.inc.php.

SQL injection vulnerability in list.php in CityForFree indexcity 1.0 occurs when magic_quotes_gpc is disabled. A remote attacker can execute arbitrary SQL commands via the cate_id parameter.

PHP remote file inclusion vulnerability in sef.php in the OpenSEF 2.0.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

An unquoted Windows search path vulnerability in multiple SSH Tectia products (Client/Server/Connector 5.0.0 and 5.0.1, Client/Server before 4.4.5, and Manager 2.12 and earlier) running on Windows allows local users to place a malicious executable in "Program Files" or its subdirectories, potentially leading to privilege escalation.

A vulnerability in SSH Tectia Management Agent 2.1.2 allows local users to gain root privileges. When the "Restart" action is selected from the Management server GUI, the agent locates a program named sshd from the process listing and restarts it with root privileges, enabling execution of arbitrary user programs as root.

Unspecified vulnerability in the format command in Sun Solaris 8 and 9 before 20060821 allows local users to modify arbitrary files via unspecified vectors involving profiles that permit running format with elevated privileges. This is a different issue than CVE-2006-4306 and CVE-2006-4319.

The VNC server on AK-Systems Windows Terminal 1.2.5 ExVLP is not password protected. This allows remote attackers to log in and view RDP or Citrix sessions.

An unspecified vulnerability in Sun Solaris 8 and 9 before 20060821 allows local users to execute arbitrary commands. The issue involves the default Role-Based Access Control (RBAC) settings in the "File System Management" profile.

PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the 'folder' parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php.

Vulnerability in the SCTP implementation in the Linux kernel (versions 2.6.x before 2.6.17.10 and 2.4.23 up to 2.4.33) in the sctp_make_abort_user function. A local user can cause a kernel panic (denial of service) and possibly gain root privileges. The attack vectors are unknown.

PHP remote file inclusion vulnerability in classes/Tar.php in the bigAPE-Backup component (com_babackup) for Mambo 1.1 allows remote attackers to include arbitrary files via the mosConfig_absolute_path parameter.

Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions of the MS06-042 patch before 20060824. A remote attacker can cause a denial of service (crash) or execute arbitrary code by sending a long URL on a website that uses HTTP 1.1 compression.

SQL injection vulnerability in comments.asp in SimpleBlog 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters.

PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo. Remote attackers can execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. The issue has been disputed by third parties who state that contentpublisher.php protects against direct request in the most recent version.

Buffer overflow in Sony VAIO Media Server 2.x, 3.x, 4.x, and 5.x before 20060626 allows remote attackers to execute arbitrary code via unspecified vectors.

A PHP remote file inclusion (RFI) vulnerability in news.php in Fantastic News 2.1.3 and earlier (later reported that 2.1.5 is also affected) allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter.

Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter. The vulnerability affects multiple scripts, including phphtmllib/includes.php, tag_utils/, and widgets/.

PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter.