CVE Vulnerability Catalog

Multiple unspecified vulnerabilities were found in the FUSE client and NOOFS daemon before version 0.9.0. Their impact and attack vectors are not specified.

Multiple buffer overflows in BomberClone before version 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.

SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 and earlier. An attacker can remotely execute arbitrary SQL commands via the username variable (Nickname field) in index.php.

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis (DFMSA), used in some environments with CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error and possibly execute arbitrary SQL commands via certain query data, likely involving the profile name.

SQL injection vulnerability in search.php of webSPELL 4.01.00 and earlier allows remote attackers to inject arbitrary SQL commands via the title_op parameter.

SQL injection vulnerability in pmlite.php in RunCMS versions 1.2 and 1.3a. Remote attackers can execute arbitrary SQL commands via the to_userid parameter.

SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the yy, mm, and dd parameters.

SQL injection vulnerability in member_login.php in PHP Classifieds 6.18–6.20. Remote attackers can execute arbitrary SQL commands via the username (email field) and password parameters.

Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via specially crafted m3u or pls files with long URLs ending in .wma or long filenames.

Unspecified vulnerabilities in Zen Cart before version 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to other attempted exploits than SQL injection.

Ansilove before version 1.03 does not filter uploaded file extensions, allowing remote attackers to execute arbitrary code by uploading files with dangerous extensions and then accessing them directly in the upload directory.

In CALimba 0.99.2 beta and earlier, multiple SQL injection vulnerabilities exist in rb_auth.php via the login and password parameters. Remote attackers can execute arbitrary SQL commands and bypass login authentication.

A PHP remote file inclusion vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.

Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the yr, month, day, and job parameters in index.php and changehrs.php.

SQL injection vulnerability in Zen Cart before version 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

TTS Time Tracking Software 3.0 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

In sNews 1.3, the index.php file is vulnerable to SQL injection via the category and id parameters. This allows a remote attacker to execute arbitrary SQL commands on the database.

A buffer overflow vulnerability in Metamail 2.7-50 occurs when processing a long 'boundary' attribute in email messages. An attacker can send a crafted email causing a denial of service or potentially arbitrary code execution.

A double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.

Zen Cart before version 1.2.7 does not protect the admin/includes directory, allowing remote attackers to cause unknown impact via unspecified vectors, likely direct requests.