CVE Vulnerability Catalog

Buffer overflow in ptrace in the Linux Kernel for 64-bit architectures allows local users to write bytes into kernel memory.

The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed buddy icon that causes an integer underflow in a loop counter variable.

Vulnerability in Sawmill before version 7.1.6 allows a remote attacker to bypass authentication and gain administrative privileges or add a license.

A vulnerability in Perception LiteWeb allows remote attackers to bypass access controls for files by adding an extra leading slash (/) or backslash (\) in the URL.

Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.

PHP remote file inclusion vulnerability in last_gallery.php of YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code via the YAPIG_PATH parameter.

An unknown vulnerability in the privilege system of Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges due to an improperly implemented input check.

A direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker.

Multiple buffer overflows in Crob FTP 3.6.1, and possibly earlier versions, allow remote attackers to execute arbitrary code via (1) an FTP command with a large string followed by the RMD command with a long string or (2) a globbing ("*") character followed by a long string.

SQL injection vulnerability in login.asp of JiRo's Upload System (JUS) 1 allows remote attackers to execute arbitrary SQL commands via the password parameter.

The vulnerability in Symantec Brightmail AntiSpam before version 6.0.2 involves a hard-coded database administrator password. A remote attacker can exploit this flaw to gain unauthorized privileges.

Multiple SQL injection vulnerabilities in Calendarix Advanced 1.5 allow remote attackers to execute arbitrary SQL commands via the catview parameter in cal_week.php, cal_cat.php, cal_day.php, and the id parameter in cal_pophols.php.

Unknown vulnerability in FlexCast Audio Video Streaming Server before version 2.0. Details about impact and attack vectors are unknown.

The vulnerability in hints.pl in Webhints 1.03 allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.

The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by modifying certain critical code addresses that are later accessed by privileged programs.

Buffer overflow vulnerability in the Modweb agent for Novell NetMail 3.52 before 3.52C, when renaming folders, may allow attackers to execute arbitrary code.

Vulnerability in LaunchServices on Apple Mac OS X 10.4.x up to 10.4.1 does not properly mark file extensions and MIME types as unsafe if an Apple Uniform Type Identifier (UTI) is not created when the type is added to the database of unsafe types, which could allow attackers to bypass intended restrictions.

Buffer overflow in the IMAP command continuation function in Novell NetMail 3.52 before 3.52C may allow remote attackers to execute arbitrary code.

A vulnerability in the NFS service on Apple Mac OS X 10.4.x up to 10.4.1 causes the system to improperly obey the -network or -mask flags for a filesystem and exports it to everyone, allowing remote attackers to bypass intended access restrictions.

SilverCity before version 0.9.5-r1 installs scripts cgi-styler-form.py, cgi-styler.py, and source2html.py with world-readable and world-writable permissions, allowing local users to execute arbitrary code.