CVE Vulnerability Catalog

SQL injection vulnerability in the file pages/forum/submit.html in Interchange versions 4.9.3 through 5.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

PHP remote file inclusion vulnerability in index.php of AlstraSoft E-Friends 4.0 allows remote attackers to execute arbitrary PHP code via the mode parameter.

SQL injection vulnerability in rsyslogd in RSyslog before 1.0.1 and before 1.10.1 allows remote attackers to execute arbitrary SQL commands via crafted syslog messages.

SQL injection vulnerability in Zengaia before version 0.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in MailGust 1.9 allows remote attackers to execute arbitrary SQL commands via the email field on the password reminder page.

Multiple stack-based buffer overflows in PowerArchiver versions 8.10 through 9.5 Beta 4 and Beta 5 allow remote attackers to execute arbitrary code via a long filename in a specially crafted ACE or ARJ archive.

Unspecified vulnerability in Eric Integrated Development Environment (eric3) before version 3.7.2. The flaw has unknown impact and attack vectors, related to a potential security exploit.

Simplog 0.9.1 might allow remote attackers to execute arbitrary SQL commands or trigger SQL error messages via invalid (1) pid, (2) blogid, (3) cid, or (4) m parameters to archive.php, or the (5) blogid parameter to blogadmin.php.

Multiple unspecified vulnerabilities were found in Opera 8.50 on Linux and Windows. They relate to handling of the 'must-revalidate' cache directive for HTTPS pages and a display issue with cookie comment encoding.

The ARJ plugin (arj.dll) version 3.9.2.0 for 7-Zip 3.13, 4.23, and 4.26 BETA contains a stack-based buffer overflow. A remote attacker can exploit this vulnerability by sending a specially crafted large ARJ block, leading to arbitrary code execution.

SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitrary SQL commands via the phrase field.

SQL injection vulnerability in module/down.inc.php in jportal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the search field to download.php.

Vulnerability in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with 'zero-width non-joiner' characters.

Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.

Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.

A stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.

The vulnerability in the miniserv.pl script in Webmin before version 1.230 and Usermin before version 1.160, when 'full PAM conversations' is enabled, allows a remote attacker to bypass authentication by spoofing session IDs using certain metacharacters (line feed or carriage return).

SQL injection vulnerability in AddItem.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idOption_Dropdown_2 parameter.

A buffer overflow vulnerability in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code by sending a long USER name.

A buffer overflow vulnerability in vxTftpSrv 1.7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TFTP request with a long filename argument.