CVE Vulnerability Catalog

In unspecified versions of RealNetworks RealPlayer, there is an unverified vulnerability that allows a remote attacker to execute arbitrary code. The description is very vague and contains no verifiable information, and the CVE has been assigned solely for tracking purposes.

In unspecified versions of RealNetworks RealPlayer there is an unverifiable vulnerability that may allow arbitrary code execution. The information about this issue is extremely vague and cannot be independently verified.

An unspecified vulnerability in HP-UX versions B.11.00 through B.11.23, when IPSEC is running, allows remote attackers to have an unknown impact.

Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."

Vulnerability in the fckeditor2rc2 addon for DoceboLMS 2.0.4 allows remote attackers to execute arbitrary PHP code by uploading a file that appears to be an image but contains PHP script via the FileUpload command in connector.php.

Multiple heap-based buffer overflows in QuickTime.qts in Apple QuickTime Player 7.0.3 and iTunes 6.0.1 (3) and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a .mov file with a large Movie Resource atom size or a modified Sample Description Table size in an stsd atom.

SQL injection vulnerability in index.php in phpForumPro 2.2 allows remote attackers to execute arbitrary SQL commands via the parent and day parameters.

PHP remote file inclusion vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter.

Multiple SQL injection vulnerabilities in CFMagic Magic Forum Personal 2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ForumID parameter in view_forum.cfm, and (2) ForumID, (3) Thread, and (4) ThreadID parameters in view_thread.cfm.

Unspecified absolute path vulnerability in umountall in IBM AIX 5.1 through 5.3 allows local users to cause unknown impact via unknown vectors.

Multiple SQL injection vulnerabilities in Alisveristr E-commerce allow remote attackers to bypass authentication and possibly execute arbitrary SQL commands via the username and password parameters in the user login and administrator login pages.

SQL injection vulnerability in view_archive.cfm in CFMagic Magic List Pro 2.5 allows remote attackers to execute arbitrary SQL commands via the ListID parameter.

A heap-based buffer overflow in the StreamPredictor function of Xpdf 3.01, used in multiple products including Poppler, teTeX, KDE kpdf, pdftohtml, KOffice KWord, CUPS, and libextractor, allows remote attackers to execute arbitrary code via a crafted PDF file with an out-of-range numComps field.

Blog System 1.2 contains SQL injection vulnerabilities in the 'cat' parameter in index.php and the 'note' parameter in blog.php, allowing remote attackers to execute arbitrary SQL commands.

SQL injection vulnerability in index.php in Cars Portal 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the page and car parameters.

SQL injection vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter.

SQL injection vulnerability in index.php in PluggedOut Blog 1.9.5 and earlier allows remote attackers to execute arbitrary SQL commands via the categoryid, entryid, year, month, and day parameters.

Multiple SQL injection vulnerabilities in A-FAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the faqid parameter in faqDspItem.asp and the catcode parameter in faqDsp.asp.

A buffer overflow vulnerability in multiple Multi-Tech Systems MultiVOIP devices with firmware before x.08 allows remote attackers to execute arbitrary code via a long INVITE field in a Session Initiation Protocol (SIP) packet.

Unspecified vulnerability in System Communications Services 6 Delegated Administrator 2005Q1 in Sun Java System Messaging Server 2005Q1 allows remote attackers to obtain the Top-Level Administrator (TLA) default password via unknown vectors, possibly involving configure_toplevel_admin.ldif.