CVE Vulnerability Catalog

SQL injection vulnerability in tickets.php in cSupport 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pg parameter.

A directory traversal vulnerability in eFileGo 3.01 allows remote attackers to execute arbitrary code, read arbitrary files, and upload arbitrary files via a triple dot (...) in the URL on port 608 or in the argument to upload.exe.

SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

SQL injection vulnerability in index.php of HelpDeskPoint 2.38 and earlier. Remote attackers can execute arbitrary SQL commands via the 'page' parameter.

SQL injection vulnerability in index.php of ClientExec 2.3 allows remote attackers to execute arbitrary SQL commands via the billshowid, billdetailid, fuse, and frmClientID parameters.

SQL injection vulnerability in poll_frame.php of Vote! Pro 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.

SQL injection vulnerability in home.php in eazyCMS 2.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.

SQL injection vulnerability in index.php of Antharia OnContent // CMS allows remote attackers to execute arbitrary SQL commands via the pid parameter.

Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code as Local System.

Multiple SQL injection vulnerabilities exist in PHP-Nuke 7.8 in modules.php via the name, sid, and pid parameters in POST requests when magic_quotes_gpc is disabled. Attackers can bypass GET request security checks and execute arbitrary SQL commands.

SQL injection vulnerability in post.php of PhpTagCool 1.0.3 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field in an HTTP header.

SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter.

A vulnerability in the PEAR Text_Password 1.0 library stems from improper seeding of the random number generator, potentially leading to predictable password generation. The exact impact and attack vectors are unspecified.

BEA WebLogic Server and WebLogic Express versions 8.1 SP3 and earlier, and 7.0 SP5 and earlier, improperly constrain a slash (/) servlet root URL pattern. This could allow a remote attacker to bypass intended servlet protections.

A vulnerability in BEA WebLogic Server and WebLogic Express causes the boot password to be stored in cleartext in the registry. A local user can read it and gain unauthorized administrative access.

A vulnerability in BEA WebLogic Server and WebLogic Express may inadvertently expose passwords in IIOP exception messages. When IIOP is used, a password can be included in an error message sent to a client or stored in a log file.

SQL injection vulnerability in manage_account.php in Tux Racer TuxBank 0.7x and 0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter in a manageaccount action to index.php.

Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, NetBSD-2 before 20050913, and NetBSD-1.6 before 20050914. Local users can cause heap corruption, system crash, and potentially gain root privileges.

Multiple unspecified vulnerabilities in the web utility function in Hitachi Cm2/Network Node Manager and JP1/Cm2/Network Node Manager before September 30, 2005 allow attackers to execute arbitrary commands, disable services, and exploit other vulnerabilities.

A stack-based buffer overflow in the as_bad function in messages.c in GNU Binutils before July 21, 2005 allows attackers to execute arbitrary code via a .c file with crafted inline assembly code.