CVE Vulnerability Catalog

Multiple cross-site request forgery (CSRF) vulnerabilities in YaPIG 0.95b and earlier allow remote attackers to perform unauthorized actions as a logged-in user, e.g., tricking an administrator into accessing a page that triggers a mod_info action in modify_gallery.php.

SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via the addr_id parameter. The provenance of this information is unknown; details are obtained solely from third party information.

A vulnerability in BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, and 7.0 SP5 and earlier, involves improper validation of derived Principals with multiple PrincipalValidators. This could allow an attacker to gain unauthorized privileges.

An unspecified vulnerability in the www_add method in Asset.pm in Plain Black WebGUI 6.3.0 and earlier versions before 6.7.6 allows attackers to execute arbitrary code via unknown attack vectors.

Multiple SQL injection vulnerabilities in PEARLINGER Pearl Forums 2.4 were found in the forumsId and topicId parameters in index.php. They allow remote attackers to execute arbitrary SQL commands.

SQL injection vulnerability in index.php in class-1 Poll Software 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the pollid or previouspoll parameters.

In Zina 0.12.07 and earlier, the index.php file is vulnerable to SQL injection. Remote attackers can execute arbitrary SQL commands via the p parameter.

SMBCMS 2.1 is vulnerable to SQL injection, allowing remote attackers to execute arbitrary SQL commands via unspecified search parameters.

A heap-based buffer overflow vulnerability in Research in Motion (RIM) BlackBerry Attachment Service allows remote attackers to cause a denial of service (hang) via an email attachment with a crafted TIFF file.

A vulnerability in Research in Motion (RIM) BlackBerry Router allows a remote attacker to cause a denial of service (communication disruption) via crafted Server Routing Protocol (SRP) packets.

A stack-based buffer overflow in db2fmp in IBM DB2 versions 7.x and 8.1 allows local users to execute arbitrary code via a long parameter.

A remote file inclusion vulnerability in Siteframe before version 3.2.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the LOCAL_PATH parameter in web/classes.php.

A buffer overflow vulnerability in HP HTTP Server versions 5.0 through 5.95 of the HP Web-enabled Management Software allows remote attackers to execute arbitrary code via unknown vectors.

A stack-based buffer overflow in libdb2.so in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long DB2LPORT environment variable.

Buffer overflow in Domain Name Relay Daemon (DNRD) before version 2.19.1 allows remote attackers to execute arbitrary code by sending a large number of large DNS packets with the Z and QR flags cleared.

SQL injection vulnerability in project-edit.asp of Digger Solutions Intranet Open Source (IOS) version 2.7.2. Attackers can execute arbitrary SQL commands via the project_id parameter.

Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 may allow context-dependent attackers to execute arbitrary code via long function parameters, as demonstrated in cups_get_dest_options.

Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via parameters including the m parameter in auth.php, the f parameter in events.php, or the e parameter in plug.php.

A format string vulnerability in ui.c in Textbased MSN Client (TMSNC) before version 0.2.5 allows attackers to cause a denial of service and possibly execute arbitrary code by injecting format strings into the wprintw function.

A buffer overflow vulnerability in the mod_radius module of ProFTPD before version 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a long password.