CVE Vulnerability Catalog

SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter in search.php and the email parameter in user.php.

A SQL injection vulnerability was found in VEGO Web Forum 1.26 and earlier in functions.php, functions_update.php, and functions_display.php. Remote attackers can execute arbitrary SQL commands via the theme_id parameter in index.php.

SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.

PHPjournaler 1.0 contains an SQL injection vulnerability in index.php. Remote attackers can execute arbitrary SQL commands via the readold parameter.

CubeCart contains a PHP remote file inclusion vulnerability in includes/orderSuccess.inc.php, allowing an attacker to execute arbitrary PHP code by supplying a crafted URL in the glob[rootDir] parameter.

In Zina 0.12.07 and earlier, the index.php file is vulnerable to SQL injection. Remote attackers can execute arbitrary SQL commands via the p parameter.

A buffer overflow vulnerability in petris before version 1.0.1 allows remote attackers to execute arbitrary code via unspecified attack vectors.

A vulnerability in hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, allowing remote attackers to gain unauthorized privileges.

Unspecified vulnerability in the ptrace mechanism in SCO UnixWare 7.1.3 and 7.1.4 allows local users to gain privileges via unknown attack vectors.

Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before version 2.0.3, used for user authentication against a PostgreSQL database, allow remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.

Integer underflow in Apple QuickTime before 7.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Color Map Entry Size in a TGA image file.

A stack-based buffer overflow in the call function of IBM DB2 versions 7.x and 8.1 allows remote attackers to execute arbitrary code by sending a long libname parameter. This vulnerability can lead to full server compromise.

The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.

The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.

Multiple SQL injection vulnerabilities in Copernicus Europa allow remote attackers to execute arbitrary SQL commands via unknown vectors. The provenance of this information is unknown; details are obtained solely from third party information.

Multiple cross-site request forgery (CSRF) vulnerabilities in YaPIG 0.95b and earlier allow remote attackers to perform unauthorized actions as a logged-in user, e.g., tricking an administrator into accessing a page that triggers a mod_info action in modify_gallery.php.

Integer overflow in Apple QuickTime before 7.0.4 allows remote attackers to execute arbitrary code via a specially crafted TIFF image file with modified image height and width (ImageWidth) tags.

SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via the addr_id parameter. The provenance of this information is unknown; details are obtained solely from third party information.

A vulnerability in BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, and 7.0 SP5 and earlier, involves improper validation of derived Principals with multiple PrincipalValidators. This could allow an attacker to gain unauthorized privileges.

An unspecified vulnerability in the www_add method in Asset.pm in Plain Black WebGUI 6.3.0 and earlier versions before 6.7.6 allows attackers to execute arbitrary code via unknown attack vectors.