CVE Vulnerability Catalog

Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.

NewsPHP 2006 PRO contains multiple SQL injection vulnerabilities in index.php and inc/rss_feed.php. Remote attackers can inject arbitrary web script or HTML via the words, id, topmenuitem, cat_id, and category parameters.

PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter.

A vulnerability in Papyrus NASCAR Racing 4 (4.1.3.1.6 and earlier), 2002 Season (1.1.0.2 and earlier), and 2003 Season (1.2.0.1 and earlier) allows remote attackers to cause a denial of service (CPU consumption) by sending an empty UDP datagram, which is not properly discarded due to the use of the FIONREAD asynchronous socket.

SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. It is uncertain whether this is a vulnerability or a feature of the product.

A stack-based buffer overflow exists in the CG_ServerCommand function of the Quake 3 Engine as used by Soldier of Fortune 2 (SOF2MP) GOLD 1.03. A remote attacker can send a long command from the server, causing a denial of service and potentially executing arbitrary code.

Buffer overflow in jetAudio 6.2.6.8330 (Basic), and possibly other versions, allows user-assisted attackers to execute arbitrary code via an audio file (such as WMA) with long ID Tag values including Title, Author, and Album. The overflow triggers in the tooltip display string if the sound card driver is disabled or incorrectly installed.

The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call. This could allow local users to gain privileges by causing setuid to fail, such as exceeding PAM limits for the maximum number of user processes, which prevents the winbind NTLM authentication helper from dropping privileges.

SQL injection vulnerability in index.php in deV!Lz Clanportal DZCP 1.3.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Multiple SQL injection vulnerabilities exist in SmS Script. A remote attacker can execute arbitrary SQL commands via the CatID parameter in cat.php and add.php.

Siemens Speedstream Wireless Router 2624 allows local users to bypass authentication and access protected files by using the Universal Plug and Play UPnP/1.0 component.

HSPcomplete versions 3.2.2, 3.3 Beta and earlier contain multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via the 'type' parameter in report.php and the 'level' parameter in custom_buttons.php.

SQL injection vulnerability in tree.php in MyNewsGroups 0.6 allows remote attackers to execute arbitrary SQL commands via the grp_id parameter.

SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbitrary SQL commands via the lid parameter.

PHP remote file inclusion vulnerability in recipe/cookbook.php in CrisoftRicette 1.0pre15b allows remote attackers to execute arbitrary PHP code via a URL in the crisoftricette parameter.

An unspecified vulnerability in the mkdir utility in HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows local users to gain privileges via unknown attack vectors.

PHP remote file inclusion vulnerability in admin/admin.php in MF Piadas 1.0 allows remote attackers to execute arbitrary PHP code via the page parameter. The same vector can be used for cross-site scripting, but CVE analysis suggests that this is resultant from file inclusion of HTML or script.

SQL injection vulnerability in search.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the rate parameter.

SQL injection vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to execute arbitrary SQL commands via the offset, tid, fromid, sortby, fromfrommethod, and fromfromlist parameters.

Buffer overflow vulnerability in the png_decompress_chunk function in pngrutil.c in libpng before version 1.2.12. A context-dependent attacker can cause a denial of service and possibly execute arbitrary code via unspecified vectors related to chunk error processing, possibly involving the chunk_name.