CVE Vulnerability Catalog

SQL injection vulnerability in Invision Power Board (IPB) 2.1.5 in index.php during a showtopic operation. Remote attackers can execute arbitrary SQL commands via the st parameter.

PHP-Stats 0.1.9.1 and earlier contains a directory traversal vulnerability via the option[language] and option[template] parameters in admin.php and other scripts. A remote unauthenticated attacker can read and potentially execute arbitrary files on the server.

A format string vulnerability in the visualization function in Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname, dedicated server name, or map name in a level (.lxl) file.

An unspecified vulnerability in the session handling of Geeklog versions 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.

SQL injection vulnerability in Akarru Social BookMarking Engine before version 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter in akarru.lib/users.php.

A buffer overflow vulnerability exists in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier when a Unicode string is converted to a narrow string. This flaw may allow a remote attacker to cause an unknown impact.

Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier. Unknown impact and attack vectors.

Multiple buffer overflows in LISTSERV 14.3 and 14.4 (including Lite and HPO) with the web archive interface enabled allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.

SQL injection vulnerability in Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

An unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostic tests via unknown attack vectors.

A vulnerability in config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter.

In Joomla! 1.0.7 and earlier, multiple SQL injection vulnerabilities exist in the Admin functionality. They allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.

An eval injection vulnerability in the decode function of rpc_decoder.php in phpRPC 0.7 and earlier, used by runcms, exoops, and other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag.

Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier are related to permissions. Their impact and attack vectors are unknown.

JFacets before version 0.2 allows remote attackers to gain privileges of any account by sending a GET request with a modified account profile ID.

Buffer overflow vulnerability in the IsComponentInstalled method of Internet Explorer 6.0 on Windows 2000 before SP4 and Windows XP before SP1. A remote attacker can execute arbitrary code via JavaScript calling this method with a long first argument.

SQL injection vulnerability in MgrLogin.asp of Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter. The details are obtained solely from third party information.

In SMartBlog (SMBlog) 1.2, the index.php file contains a remote file inclusion vulnerability. An attacker can use the pg parameter or a query string without a parameter to include and execute arbitrary PHP code from an external source.

SQL injection vulnerability in forumlib.php in Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter.

SQL injection vulnerability in poems.php of DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.