CVE Vulnerability Catalog

INDEXU 5.0.0 and 5.0.1 contain multiple PHP remote file inclusion vulnerabilities. An attacker can use the theme_path parameter in 25 scripts and the base_path parameter in invoice.php to execute arbitrary PHP code.

In Debian GNU/Linux, during the configuration of mnogosearch in the mnogosearch-common 3.2.31-1 package, debconf uses the world-readable config.dat file instead of the restricted passwords.dat file to store the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, allowing local users to view the password.

Multiple SQL injection vulnerabilities in Simplog 0.9.2 and earlier allow remote attackers to execute arbitrary SQL commands via the blogid, m, y, and sql parameters.

A directory traversal vulnerability in the pbcs.dll component of SAXoTECH SAXoPRESS (formerly Publicus) allows remote attackers to read arbitrary files and potentially execute arbitrary programs by using '..' sequences in the url parameter.

Multiple PHP remote file inclusion vulnerabilities in AzDGVote allow an attacker to execute arbitrary PHP code by supplying a URL in the int_path parameter. The affected files are vote.php, view.php, admin.php, and admin/index.php.

A directory traversal vulnerability in doc/index.php in Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter. The attack can be performed by injecting PHP code into the Apache error_log file, which is then included by doc/index.php.

PHP remote file inclusion vulnerability in doc/index.php in Simplog 0.9.2 and earlier. Remote attackers can execute arbitrary PHP code by supplying a crafted URL in the 's' parameter.

SQL injection vulnerability in index.php of Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area.

SQL injection vulnerability in admin.php of MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

A directory traversal vulnerability exists in index.php of blur6ex 0.3.452 via the 'shard' parameter, allowing remote attackers to include arbitrary files. This can also lead to XSS and path disclosure.

Hosting Controller 6.1 stores the file forum/db/forum.mdb under the web document root with insufficient access control, allowing remote attackers to obtain sensitive information such as usernames and passwords.

SQL injection vulnerability in index.php in SWSoft Confixx 3.0.6, 3.0.8, and 3.1.2 allows remote attackers to execute arbitrary SQL commands via the SID parameter.

The __group_complete_signal function in the RCU signal handling (signal.c) in Linux kernel 2.6.16 and possibly other versions has unknown impact and attack vectors related to improper use of BUG_ON.

A PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to multiple scripts in the admin folder. This can lead to full server compromise.

PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. This issue also affects version 2.01.

Multiple SQL injection vulnerabilities exist in form.php of JBook 1.4 via the nom and mail parameters. Remote attackers can execute arbitrary SQL commands.

Multiple SQL injection vulnerabilities in MvBlog before version 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

A vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via specially crafted HTML elements with a certain tag, leading to memory corruption.

A buffer overflow in URLMON.DLL of Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS).