CVE Vulnerability Catalog

A remote file inclusion vulnerability in IceWarp Web Mail 5.5.1, used by Merak Mail Server 8.3.0r and VisNetic Mail Server 8.3.0 build 1, when register_globals is enabled, allows remote attackers to include arbitrary local and remote PHP files via the lang_settings and language parameters in accounts/inc/include.php and admin/inc/include.php.

A buffer overflow vulnerability exists in Golden FTP Server 1.92 when handling the APPE command. Remote attackers can exploit this to execute arbitrary code on the server.

The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php.

A vulnerability in scponlyc (scponly 4.1 and earlier) allows a local user to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LD_PRELOAD to alter expected function calls in the setuid application.

The Chatspot 2.0.0a7 module for phpBB might allow remote attackers to impersonate other users via unknown vectors. This vulnerability could lead to unauthorized access to accounts and data.

Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via the setLang parameter in index.php and unspecified search module parameters.

Multiple SQL injection vulnerabilities were found in Mantis 1.0.0rc3 and earlier in the manage user page. Remote attackers can execute arbitrary SQL commands via the 'prefix' and 'sort' parameters in manage_user_page.php and the 'sort' parameter in view_all_set.php.

SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown vectors.

An argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via getopt-style argument specifications that are not filtered.

A vulnerability in Mantis before version 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the max_file_size parameter in bug_file_add.php, bug_report.php, bug_report_advanced_page.php, and proj_doc_add_page.php.

A buffer overflow vulnerability in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.

SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter. The provenance of this information is unknown; details are obtained solely from third party information.

WebDB 1.1 and earlier contain an SQL injection vulnerability via unspecified search parameters (possibly Search0). The vendor disputes this, stating the code was added for a specific client and has been removed, with all clients receiving updates automatically.

An unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i (patch 11) and CMA 3.5 (patch 5) allows local users to gain privileges by placing a malicious "program.exe" file in the C: folder, which is executed by naPrdMgr.exe when it attempts to run EntVUtil.EXE.

A vulnerability in the khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier, used by Safari and TextEdit, allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute in a TD tag.

SQL injection vulnerability in phpBB 2 before version 2.0.18 allows remote attackers to execute arbitrary SQL commands via the topic type parameter.

Buffer overflow vulnerability in the Network Block Device (nbd) server versions 2.7.5 and earlier, and 2.8.0 through 2.8.2. A remote attacker can send an oversized request that is written past the end of the buffer because nbd does not account for memory taken by the reply header, allowing arbitrary code execution.

SQL injection vulnerability in MusicBox 2.3 allows remote attackers to execute arbitrary SQL commands via the show and type parameters. The provenance of this information is unknown, although it was later rediscovered.

The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators generates a random internal ACL name that is also used as a hidden username and password. An attacker can sniff this name from the cleartext portion of a RADIUS session and use the password to log in to another device using Cisco Secure Access Control Server (CS ACS).