CVE Vulnerability Catalog

Lynx versions before 2.8.6dev.15 allow remote attackers to execute arbitrary system commands via lynxcgi:, lynxexec, and lynxprog links, which are not properly restricted in the default configuration in some environments.

An unquoted Windows search path vulnerability in VMWare Workstation 5.0.0 build-13124 might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder.

Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.

An unquoted Windows search path vulnerability in Microsoft Antispyware 1.0.509 (Beta 1) might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder, involving the programs GIANTAntiSpywareMain.exe, gcASNotice.exe, gcasServ.exe, gcasSWUpdater.exe, or GIANTAntiSpywareUpdater.exe.

An integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values.

Stack-based buffer overflow in a shared library used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterprise Server 5.0 MP1 to MP5 and 5.1 up to MP3A allows remote attackers to execute arbitrary code via a crafted packet.

Vulnerability in iTunesHelper.exe in iTunes 4.7.1.30 and iTunes 5 for Windows due to an unquoted Windows search path. A local user can exploit a malicious C:\program.exe file to escalate privileges.

The CodeSupport.ocx ActiveX control, used by Sony to uninstall the First4Internet XCP DRM, has 'safe for scripting' enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode.

Multiple SQL injection vulnerabilities in the get_record function in datalib.php in Moodle 1.5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in category.php and info.php.

The vulnerability in the PNP_GetDeviceList (upnp_getdevicelist) function in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows a remote attacker to cause a denial of service (DoS) through excessive memory consumption. The attack involves sending a DCE RPC request with a large output buffer size.

Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in logout.php and index.php.

Vulnerability in IBM Informix Dynamic Database server on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account by supplying an invalid username.

PHP file inclusion vulnerability in the osTicket module in Help Center Live before 2.0.3 allows remote attackers to access or include arbitrary files via the 'file' parameter, possibly due to a directory traversal vulnerability.

IBM DB2 database server running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account without supplying a password.

Multiple buffer overflows in the IMAP Groupware Mail server of Floosietek FTGate (FTGate4) 4.1 allow remote attackers to execute arbitrary code via long arguments to various IMAP commands, as demonstrated with the EXAMINE command.

Vulnerability in Oracle Databases running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication by supplying a valid username.

SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.

A buffer overflow vulnerability has been discovered in the LZX decompression function of CHM Lib (chmlib) version 0.35, used in products such as KchmViewer. The impact and attack vectors are unknown.

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.

In Clam AntiVirus (ClamAV) before version 0.87.1, improper boundary checks in petite.c allow attackers to perform unknown attacks via unknown vectors.