CVE Vulnerability Catalog

Unspecified vulnerability in the Core RDBMS component of Oracle Database versions 9.0.1.5 and 9.2.0.6. The impact and attack vectors are unknown, referred to as Oracle Vuln# DB02.

Unspecified vulnerability in Calendar for Oracle Collaboration Suite 10.1.2. The impact and attack vectors are unknown, and it is referred to as Oracle Vuln# OCS01.

MyBB (MyBulletinBoard) 1.1.4 contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via unspecified vectors.

Oracle E-Business Suite and Applications 11.5.10CU2 contain multiple unspecified vulnerabilities with unknown impact and attack vectors. The vulnerabilities affect various components, including Internet Expenses, Oracle Application Object Library, Oracle Applications Technology Stack, Oracle Call Center Technology, Oracle Common Applications, Oracle Self-Service Web Applications, and Oracle Workflow Cartridge.

Multiple unspecified vulnerabilities in Oracle Exchange for Oracle E-Business Suite and Applications 6.2.4 have unknown impact and attack vectors, identified as APPS16 and APPS17.

PHP remote file inclusion vulnerability in Include/editor/rich_files/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the class_path parameter.

PHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

A vulnerability in jmx-console/HtmlAdaptor in the jmx-console of the JBoss web application server, as shipped with Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allows remote attackers to gain privileges as the CS-MARS administrator and execute arbitrary Java code via an invokeOp action in the BSHDeployer jboss.scripts service name.

Eskolar CMS 0.9.0.0 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the gr_1_id, gr_2_id, gr_3_id, and doc_id parameters in index.php, the uid and pwd parameters in php/esa.php, and possibly other vectors in files under php/lib/.

Multiple unspecified vulnerabilities in the Command Line Interface (CLI) for Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1 allow local CS-MARS administrators to execute arbitrary commands as root.

An integer overflow vulnerability in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code by passing a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, leading to an invalid memory copy.

Multiple unspecified vulnerabilities in Oracle Database versions 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 have unknown impact and attack vectors, identified as Oracle Vuln# DB06, DB08-DB14, DBC01, DB16-DB20, DBC02-DBC04. They affect components Export, OCI, Query Rewrite/Summary Mgmt, RPC, and Semantic Analysis. DB06 is suspected to be related to SQL injection via DBMS_EXPORT_EXTENSION.

SQL injection vulnerability in Room.php in Francisco Charrua Photo-Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

An unspecified vulnerability in PeopleSoft Enterprise Portal for Oracle PeopleSoft Enterprise Portal 8.8 with Enforcer Portal Pack Bundle #10 and 8.9 Bundle #3. The impact and attack vectors are unknown, referred to as Oracle Vuln# PSE02.

Unspecified vulnerability in Sybase/Financial Fusion Consumer Banking Suite versions before 20060706. Its impact and attack vectors are unknown, but remote exploitation is possible.

Cross-site request forgery (CSRF) vulnerability in the communicate function in estmaster.c for Hyper Estraier before 1.3.3 allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a request to TCP port 515.

A vulnerability in nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a large number handled by the id_req_handler function.

A vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2004 allows remote attackers to bypass file extension filters via a request with a trailing '#' character. As of July 15, 2006, this could not be reproduced by third parties.

SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. The vendor disputes the issue, but source code analysis suggests it may be legitimate, and the parameter is sanitized in version 1.5.3.1.