CVE Vulnerability Catalog

Unspecified vulnerability in Microsoft PowerPoint 2000 through 2003, possibly a buffer overflow, allows user-assisted remote attackers to execute arbitrary commands via a malformed record in the BIFF file format used in a PPT file. Exploitation requires user interaction, such as opening a malicious file.

Unspecified vulnerability in Microsoft Hyperlink Object Library (hlink.dll), possibly a buffer overflow, allows user-assisted attackers to execute arbitrary code via crafted hyperlinks that are not properly handled when hlink.dll processes a file containing a malformed function. This is also known as the "Hyperlink Object Function Vulnerability."

The FESTAHES_Load function in pce/hes.c in Festalon 0.5.0 through 0.5.5 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative LoadAddr value in a HES file, which is used as an offset in a memcpy operation and leads to a buffer underflow.

SQL injection vulnerability in profile.php in XennoBB 2.1.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the bday_day, bday_month, and bday_year parameters in the personal section.

Microsoft Internet Explorer 5.01 and 6 does not properly identify the originating domain zone when handling redirects. This allows remote attackers to read cross-domain web pages and possibly execute code via a crafted web page, known as the "Source Element Cross-Domain Vulnerability".

SAPID CMS 123 rc3 contains a remote file inclusion (RFI) vulnerability in usr/extensions/get_infochannel.inc.php and usr/extensions/get_tree.inc.php. An attacker can supply a malicious URL via the root_path parameter or GLOBALS["root_path"], leading to arbitrary PHP code execution on the server.

Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables.

Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section.

Jetbox CMS 2.1 SR1 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the frontsession cookie parameter, the view parameter in index.php, and the login parameter in admin/cms/index.php.

A vulnerability in Microsoft Internet Explorer 5 SP4 and 6 involves improper garbage collection when multiple imports are used on a styleSheets collection to construct a chain of Cascading Style Sheets (CSS). This allows remote attackers to execute arbitrary code via unspecified vectors.

Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code. This is demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, also known as 'COM Object Instantiation Memory Corruption Vulnerability'.

A vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using the document.getElementByID JavaScript function to access crafted Cascading Style Sheet (CSS) elements, and possibly other unspecified vectors involving certain layout positioning combinations in an HTML file.

Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through 10.00.xC3 allows attackers to execute arbitrary code via the SQLIDEBUG environment variable.

Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values.

Symantec Brightmail AntiSpam (SBAS) before 6.0.4 contains multiple directory traversal vulnerabilities. When the Control Center is allowed to connect from any computer, a remote attacker can read and overwrite certain files via directory traversal sequences in DATABLOB-GET and DATABLOB-SAVE requests.

PHP remote file inclusion vulnerability in index.php in Knusperleicht Guestbook 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the GB_PATH parameter.

SQL injection vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. Other vectors are covered by CVE-2006-3139.

PHP remote file inclusion vulnerability in index.php in Knusperleicht Faq 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the faq_path parameter.

PHP remote file inclusion vulnerability in conf.php in WoWRoster (aka World of Warcraft Roster) 1.5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the subdir parameter.

PHP remote file inclusion vulnerability in hsList.php in WoWRoster (World of Warcraft Roster) 1.5.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the subdir parameter.