CVE Vulnerability Catalog

A direct static code injection vulnerability in ticker.db.php of Chucky A. Ivey N.T. 1.1.0 allows remote administrators to inject arbitrary PHP code into the config file. This code is then included by other N.T. scripts, leading to arbitrary code execution on the server.

SQL injection vulnerability in forum.php of Arab Portal 2.0.1 stable allows remote attackers to execute arbitrary SQL commands via the mineID parameter.

The vulnerability in newimage.php in Crafty Syntax Image Gallery (CSIG) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code by sending a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php.

Multiple format string vulnerabilities in the logging code of Clam AntiVirus (ClamAV) before version 0.88.1 might allow remote attackers to execute arbitrary code. However, as of April 2006, it is unclear whether this is a real vulnerability, as there is evidence that arguments are properly sanitized.

A vulnerability in OpenVPN 2.0 through 2.0.5 allows a remote malicious server to execute arbitrary code on the client by setting the LD_PRELOAD environment variable via the setenv directive.

SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter.

In ESET NOD32 before version 2.51.26, the 'restore to' selection in the 'quarantine a file' capability allows restoring a file to any directory that the user has read access to. This enables local users to create new files in directories where they lack write permissions.

A PHP remote file inclusion vulnerability in loadkernel.php in AngelineCMS 0.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the installPath parameter.

In the vserver tool from util-vserver 0.30.209, when the suexec userid parameter is invalid and non-numeric, the command is executed as root. This may cause local users to inadvertently execute dangerous commands with root privileges.

Multiple buffer overflows exist in UltraVNC 1.0.1 and earlier and in tabbed_viewer 1.29. A malicious server can send a long string to a client on TCP port 5900, causing an overflow in Log::ReallyPrint and enabling remote code execution. Additionally, a long HTTP GET request on TCP port 5800 triggers an overflow in VNCLog::ReallyPrint, leading to a denial of service (server crash).

An unspecified logical programming mistake in SMART SynchronEyes Student and Teacher 6.0 (and possibly earlier versions) allows remote attackers to cause a denial of service by sending a large packet to the Teacher discovery port (UDP 5496), terminating a thread and preventing communication on that port.

Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules for ICMP and TCP protocols by sending IPv6 packets. However, this issue has been disputed, noting that ISA Server 2004 does not support IPv6 filtering.

PHP remote file inclusion vulnerability in get_header.php of VWar 1.5.0 R12 and earlier. An attacker can supply a malicious URL in the vwar_root parameter, leading to arbitrary PHP code execution on the server.

Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the id parameter in comments.php and the poll_id parameter in page.php.

The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, allowing remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.

A format string vulnerability in the Con_message and conPrintf functions in con_main.c of the Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in the JOIN command argument and possibly other command arguments.

A format string vulnerability in the SMTP server of McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code by sending a crafted email address containing format specifiers in the domain name. The flaw occurs when a bounce message is constructed without proper sanitization.

An unspecified vulnerability in Exponent CMS before version 0.96.5 RC 1, related to variables not being typecasted, allows remote attacks with unknown impact.

A remote file inclusion vulnerability exists in the VWar_Account module for PHPNuke Clan 3.0.1. Attackers can exploit the vwar_root2 parameter in includes/functions_common.php to include arbitrary files from external servers.

An unspecified vulnerability in the banner module of Exponent CMS before version 0.96.5 RC 1 allows PHP injection via unknown attack vectors.