CVE Vulnerability Catalog

Multiple unspecified vulnerabilities in the Command Line Interface (CLI) for Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1 allow local CS-MARS administrators to execute arbitrary commands as root.

VBZooM 1.11 and earlier contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the UserID parameter in ignore-pm.php, sendmail.php, reply.php, or sub-join.php.

Multiple off-by-one errors exist in Wireshark (formerly Ethereal) versions 0.9.7 through 0.99.0 within the NCP NMAS and NDPS dissectors. The vulnerability can be exploited remotely, but the exact impact is unknown.

Oracle Database versions 9.2.0.6 and 10.1.0.4 contain multiple unspecified vulnerabilities with unknown impact and attack vectors. They affect Web Distributed Authoring and Versioning (DAV) and XMLDB components, identified as Oracle Vuln# DB04 and DB23.

Unspecified vulnerability in InterMedia for Oracle Database 9.0.1.5, 9.2.0.6, and 10.1.0.4 has unknown impact and attack vectors, aka oracle Vuln# DB07.

A vulnerability in jmx-console/HtmlAdaptor in the jmx-console of the JBoss web application server, as shipped with Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allows remote attackers to gain privileges as the CS-MARS administrator and execute arbitrary Java code via an invokeOp action in the BSHDeployer jboss.scripts service name.

Buffer overflow in Wireshark (formerly Ethereal) versions 0.8.16 through 0.99.0. A remote attacker can exploit this via the NFS dissector, causing a denial of service and possibly executing arbitrary code.

A PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.

Unspecified vulnerability in the Oracle ODBC Driver for Oracle Database 10.1.0.4 has unknown impact and attack vectors, aka Oracle Vuln# 10.1.0.4.

Oracle Database 10.1.0.5 contains multiple unspecified vulnerabilities with unknown impact and attack vectors, identified as Oracle Vuln# DB21 (Statistics) and DB22 (Upgrade & Downgrade). According to a reliable researcher, DB21 is a local SQL injection vulnerability in SYS.DBMS_STATS, and DB22 is SQL injection in SYS.DBMS_UPGRADE.

MiniBB Forum 1.5a and earlier contains multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code by supplying a malicious URL in the absolute_path parameter to components/com_minibb.php or components/minibb/index.php.

Multiple unspecified vulnerabilities exist in Oracle E-Business Suite and Applications 11.5.9, affecting Oracle Application Object Library and Oracle XML Gateway. Technical details, impact, and attack vectors have not been disclosed.

An integer overflow vulnerability in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code by passing a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, leading to an invalid memory copy.

Multiple unspecified vulnerabilities in Oracle Management Service for Oracle Enterprise Manager 10.1.0.5 and 10.2.0.1 have unknown impact and attack vectors, aka Oracle Vuln# EM03 and EM04.

A stack-based buffer overflow exists in the Universal Plug and Play (UPnP) service of multiple D-Link routers (including DI-524, DI-604, DI-624, DI-784, WBR-1310, WBR-2310, EBR-2310). A remote attacker can send a long M-SEARCH request to UDP port 1900 to execute arbitrary code.

Eskolar CMS 0.9.0.0 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the gr_1_id, gr_2_id, gr_3_id, and doc_id parameters in index.php, the uid and pwd parameters in php/esa.php, and possibly other vectors in files under php/lib/.

Unspecified vulnerability in PeopleSoft Enterprise Portal for Oracle PeopleSoft Enterprise Portal 8.4 Bundle #16, 8.8 Bundle #10, and 8.9 Bundle #3. The impact and attack vectors are unknown, referred to as Oracle Vuln# PSE01.

Unspecified vulnerability in Calendar for Oracle Collaboration Suite 10.1.2. The impact and attack vectors are unknown, and it is referred to as Oracle Vuln# OCS01.

SQL injection vulnerability in category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id parameter.

The Touch Control ActiveX control version 2.0.0.55 allows remote attackers to read and possibly execute arbitrary files by supplying a "file///" URI in the sPath parameter to the Execute function.