CVE Vulnerability Catalog

Vulnerability in Java Runtime Environment (JRE) and Software Development Kit (SDK) versions 1.4.2_08, 1.4.2_09, 1.5.0_05 and possibly others allows remote attackers to cause a denial of service (JVM unresponsive) via a crafted serialized object, such as a font object as demonstrated on JBoss.

A buffer overflow vulnerability has been discovered in the LZX decompression function of CHM Lib (chmlib) version 0.35, used in products such as KchmViewer. The impact and attack vectors are unknown.

SQL injection vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the forum parameter.

Vulnerability in ImageMagick before version 6.2.4.2-r1 allows local users in the portage group to escalate privileges by placing a shared object in the Portage temporary build directory, which is added to the search path allowing it to be loaded at runtime.

A buffer overflow vulnerability in FileZilla Server Terminal 0.9.4d allows remote attackers to cause a denial of service (terminal crash) by sending a long USER FTP command.

SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability in the report module of ibProArcade 2.5.2 and earlier. Remote attackers can execute arbitrary SQL commands via the 'user' parameter in index.php.

A SQL injection vulnerability was found in the index.php file of Peel versions 2.6 through 2.7. Remote attackers can execute arbitrary SQL commands via the rubid parameter.

In Clam AntiVirus (ClamAV) before version 0.87.1, improper boundary checks in petite.c allow attackers to perform unknown attacks via unknown vectors.

An unknown vulnerability in the remshd daemon on HP-UX B.11.00, B.11.11, and B.11.23 running in Trusted Mode allows remote attackers to gain unauthorized system access via unknown attack vectors.

By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to gain control of the computer.

Vulnerability in GDAL before version 1.3.0-r1 allows local users in the portage group to escalate privileges via a shared object in the Portage temporary build directory, which is added to the search path allowing objects in it to be loaded at runtime.

A vulnerability in Zone Labs (ZoneAlarm) software allows remote attackers to bypass the 'Advanced Program Control and OS Firewall filters' setting using URLs in HTML Modal Dialogs (window.location.href) embedded in JavaScript tags.

Macromedia Flash plugin (Flash.ocx 7.0.19.0 and earlier for Windows, libflashplayer.so before 7.0.25.0 for Unix) is vulnerable to a crash and potential arbitrary code execution via a crafted SWF file. The issue occurs when calling ActionDefineFunction in ActionScript, leading to improper memory access.

The envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.

SQL injection vulnerability in admin.php in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privileges via the username field.

SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields in adminlogin.asp.

SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.

A buffer overflow vulnerability in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name and then executing the XPWD command.