CVE Vulnerability Catalog

A vulnerability in Check Point SecuRemote NG with Application Intelligence R54 allows attackers to obtain credentials and gain privileges via unknown attack vectors.

A double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.

WPS Web Portal System 0.7.0 contains a vulnerability in the wps_shop.cgi script that allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters in the 'art' and 'cat' variables.

Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain valid TCP or UDP request.

In MailEnable Professional 1.54, a stack-based buffer overflow exists in the IMAP daemon (imapd). A remote authenticated user can exploit this by sending a status command with a long mailbox name, leading to arbitrary code execution.

WebEOC before version 6.0.2 does not properly check user authorization, allowing remote attackers to gain privileges via a direct request to a resource.

Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors.

WebEOC before version 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords.

Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename argument of a PUT command.

The vulnerability in Firefox before version 1.0.5 and Mozilla before version 1.7.9 is due to improper cloning of base objects. A remote attacker can exploit the prototype chain to access a privileged object and execute arbitrary code.

The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.

The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including USANet Shopping Mall Software, Domain Name Auction Software, Standard Classified Ads Software, and MakeBid Reverse Auction, allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.

Vulnerability in Firefox before version 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the sidebar using the _search target, then injecting script into other pages via a data: URL.

Vulnerability in Firefox, Thunderbird, Mozilla, Netscape, and K-Meleon browsers allows XBL scripts to run even when JavaScript is disabled. A remote attacker can exploit this flaw to bypass script protection.

Multiple unknown vulnerabilities have been discovered in Jinzora 2.0.1, with unknown impact and attack vectors, possibly involving a PHP file inclusion vulnerability.

Vulnerability in Firefox before version 1.0.5 allows remote attackers to steal information and potentially execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.

Buffer overflow vulnerability in the Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary code via a long filename in an OBEX file share.

Vulnerability in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 involves improper verification of DOM node name types within the context of their namespaces. This allows a remote attacker to modify tag properties, potentially leading to arbitrary script or code execution, as demonstrated using an XHTML document with IMG tags with custom properties.

PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTION_RM_ID cookie to the user ID.

PHP remote file inclusion vulnerability in photolist.inc.php in Squito Gallery 1.33 allows remote attackers to execute arbitrary code via the photoroot parameter.