CVE Vulnerability Catalog

SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.

SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.

Multiple SQL injection vulnerabilities in the Info-DB module (info_db.php) in Woltlab Burning Board 2.7 and earlier allow remote attackers to execute arbitrary SQL commands and possibly upload files via the fileid and subkatid parameters.

Multiple SQL injection vulnerabilities in DboardGear allow remote attackers to execute arbitrary SQL commands via (1) the buddy parameter in buddy.php, (2) the u2uid parameter in u2u.php, and (3) an invalid theme file in the themes action to ctrtools.php.

PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.

The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the (1) DiscoveryWeb and (2) DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password.

PHP remote file inclusion vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.

PHP remote file inclusion vulnerability in common.php in PunBB versions 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.

Vulnerability in Data ONTAP 7.0 and earlier allows an attacker to bypass iSCSI authentication by using a modified client that skips the Security (Start) mode required by the Login Negotiation protocol and directly enters Operational mode without proving identity.

Multiple buffer overflows in Ethereal 0.10.12 and earlier might allow remote attackers to execute arbitrary code via unknown vectors in the SLIMP3 and AgentX dissector.

Multiple SQL injection vulnerabilities were found in ACID 0.9.6b20 and BASE 1.2 in scripts acid_qry_main.php and base_qry_main.php. Remote attackers can execute arbitrary SQL commands via the sig[1] parameter and other parameters.

SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.

A vulnerability in the docutils component in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.

Multiple stack-based buffer overflows in ZipGenius versions 5.5.1.468 and 6.0.2.1041, and other versions before 6.0.2.1050, allow remote attackers to execute arbitrary code via a crafted ZIP archive with a long filename, a long original name in UUE/XXE/MIM files, or an ACE archive with a long filename.

Buffer overflow vulnerability in Skype for Windows versions 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via specially crafted callto:// and skype:// links or a non-standard VCARD, likely due to an error in the SysUtils.WideFmtStr Delphi routine.

Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS, before 1.2.x.18 on Linux, and 1.1.x.6 and earlier allows remote attackers to cause a denial of service (crash) via crafted network data with a large Object Counter value, which leads to a resultant heap-based buffer overflow.

Vulnerability in Mantis before version 0.19.3 causes the User ID to be cached longer than necessary. The impact and attack vectors are unknown.

SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

The _httpsrequest function in Snoopy 1.2, used in products such as WordPress, MagpieRSS, Ampache, and Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL. The issue is due to improper handling of these characters by the fetch function.