CVE Vulnerability Catalog

A vulnerability in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before version 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allows local users to gain Linux shell access by using shell metacharacters in arguments to the 'show' command in the command line interface (CLI).

SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.

Multiple SQL injection vulnerabilities exist in plexum.php of NicPlex Plexum X5 and earlier. Remote attackers can execute arbitrary SQL commands via the pagesize, maxrec, and startpos parameters.

SQL injection vulnerability in plexcart.pl of NicPlex PlexCart X3 and earlier. Remote attackers can execute arbitrary SQL commands via the catid parameter.

SQL injection vulnerability in member.php of Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.

Multiple SQL injection vulnerabilities were found in myEvent 1.x. Remote attackers can manipulate the event_id and event_desc parameters to execute arbitrary SQL commands.

PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3. An attacker can remotely execute arbitrary PHP code by providing a URL in the page parameter.

The config.php file in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values stored in config.php that are later executed. The provenance of this information is unknown; details are obtained solely from third party information.

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite and Applications version 11.5.10CU1. Has unknown impact and attack vectors, known as Vuln# APPS05.

Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.

Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server 9.2.0.7 and 10.1.0.4. An independent researcher claims the issue is SQL injection in the GEN_RID_RANGE_BY_AREA and GEN_RID_RANGE functions of the MDSYS.SDO_PRIDX package.

Multiple unspecified vulnerabilities were found in Oracle E-Business Suite and Applications 11.5.10CU2 in components: Application Install, Oracle Diagnostics Interfaces, Oracle General Ledger, and Oracle Receivables. Their impact and attack vectors are unknown.

Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9. May lead to unknown impacts and attack vectors.

A buffer overflow vulnerability in the Advanced Replication component of Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via the VERIFY_LOG procedure of the DBMS_SNAPSHOT_UTL package.

Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, and 9.2.0.7. Impact and attack vectors are unknown.

Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Security Server 8.95.J1. The impact and attack vectors are unknown, and the issue is tracked as Vuln# JDE01.

Unspecified vulnerability in the PeopleTools component of Oracle PeopleSoft Enterprise 8.46.12 and 8.47.04. Impact and attack vectors are unknown, identified as Vuln# PSE01.

An unspecified vulnerability in Oracle Spatial allows SQL injection via MDSYS.PRVT_IDX functions. The flaw affects Oracle Database versions 8.1.7.4, 9.0.1.5, and 9.2.0.6.

Multiple unspecified vulnerabilities were discovered in Oracle E-Business Suite and Applications version 11.5.10 in components iProcurement, Oracle Application Object Library, Oracle Applications Technology Stack, and Oracle Order Capture. These vulnerabilities have unknown impact and attack vectors.

Two unspecified vulnerabilities (EM01 and EM02) were found in the Reporting Framework component of Oracle Enterprise Manager 9.0.1.5 and 9.2.0.7. Their impact and attack vectors are unknown.