CVE Vulnerability Catalog

Integer overflow in Trillian 0.74 and earlier, and Trillian Pro 2.01 and earlier, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.

AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, which allows remote malicious servers to gain administrator access.

ArGoSoft FTP version 1.4.2.4 and earlier does not limit the number of failed login attempts, making it easier for remote attackers to guess passwords via brute force attack.

Unknown vulnerability in Moodle before version 1.3.4, related to handling of strings in Moodle texts. Details about impact and attack vectors are unknown.

Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php.

Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via various functions in Parser.c, Dir.c, loadconfig.c, LangCfg.c, and Html.c.

Omnicron OmniHTTPd version 3.0a and earlier contains a buffer overflow vulnerability in the handling of the Range header in HTTP GET requests. A remote attacker can exploit this to execute arbitrary code on the server.

SQL injection vulnerability in the Reviews module of PHP-Nuke versions 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.

A vulnerability in Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. The affected version was reported to be 4.3.7, but this may be erroneous.

PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_path parameter to reference a URL on a remote web server that contains the code.

Vulnerability in Windows XP Explorer allows attackers to execute arbitrary code via a specially crafted self-executing folder containing HTML and script that references an executable file within the same folder, which is automatically executed when a user accesses the folder.

SQL injection vulnerability in post.php in Invision Power Board (IPB) versions 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the eid or cid parameters.

Unknown vulnerability in RemoteEditor before version 0.1.1, related to oversize submissions, has unknown impact and attack vectors.

Vulnerability in Hired Team: Trial 2.0 and earlier and version 2.200 allows game players to kick other players off the server, including the administrator, without any restrictions.

Unknown vulnerability in the 'access code' in SecureEditor before 0.1.2 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.

Vulnerability in Windows XP Explorer allows a local user to execute arbitrary code via a system folder containing a Desktop.ini file with a .ShellClassInfo specifier that has a CLSID value associated with an executable file.

Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow.

Unknown vulnerability in the 'access code' in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.

Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow remote attackers to execute arbitrary code via an SSH2 packet with a base argument larger than the mod argument, and malicious servers to cause a denial of service or possibly execute arbitrary code via a large bignum during authentication.