CVE Vulnerability Catalog

SQL injection vulnerability in Ideal Science IdealBB versions 1.4.9 through 1.5.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chosen plaintext attack.

A buffer overflow vulnerability in pop3.c in gnubiff before version 2.0.0 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code.

Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.

A vulnerability in Novell Client Firewall (NCF) 2.0, based on Agnitum Outpost Firewall, allows local users to execute arbitrary code with SYSTEM privileges by opening the NCF tray icon and using the Help functionality to launch programs with elevated privileges.

SQL injection vulnerability in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL via the referer field in an HTTP request.

Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060) allows remote attackers to obtain sensitive information and gain privileges by using TFTP to download the nvram file, then extracting the username, password, and other data from the file.

Mbedthis AppWeb HTTP server before version 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters.

Format string vulnerability in the gpsd_report function of the BerliOS GPD daemon (gpsd, formerly pygps) versions 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via crafted GPS requests containing format string specifiers that are not properly handled in syslog calls.

The vulnerability in distcc 2.x, used in XCode 1.5 and others, allows remote attackers to execute arbitrary commands by sending compilation jobs, which are executed without authorization checks when the server is not configured to restrict access to the port.

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to the Telnet proxy service, a different vector than CVE-2004-2416.

An unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service (device reset) via a crafted request to the web management interface. The provenance of this information is unknown; details are obtained from third party reports.

Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files.

Unknown vulnerability in Network Appliance NetCache 5.2 and Data ONTAP 6.0 allows remote attackers to cause a denial of service (panic and reboot) and possibly other impacts via unknown attack vectors, possibly related to unspecified worms.

Stack-based buffer overflow in the HTTP server in NetChat 7.3 and earlier allows remote attackers to execute arbitrary code via a long GET request.

Fastream NETFile Server 7.1.2 improperly handles keep-alive connection timeouts and does not close the connection after a HEAD request, allowing remote attackers to perform a denial of service (connection consumption) by sending a large number of HTTP HEAD requests.

A buffer overflow vulnerability exists in the vsybase.c library of vpopmail version 5.4.2 and earlier. This could allow an attacker to cause a denial of service or execute arbitrary code.

Unknown vulnerability in IBM Parallel Environment (PE) 3.2 and 4.1 allows attackers to execute arbitrary commands as root via unknown vectors in the sample code.

A format string vulnerability in the logging function of IGI 2 Covert Strike server version 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in RCON commands.

A stack-based buffer overflow in the DecodeBase16 function, used in the IRC module and web server in eMule 0.42d, allows remote attackers to execute arbitrary code via a long string.