CVE Vulnerability Catalog

Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument.

A buffer overflow in the POP3 server of 1st Class Mail Server 4.0 via an APOP USER command with a long second parameter (digest) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.

Unknown vulnerability in Tutti Nova versions 0.10 through 0.12 (Beta) and 0.9.4, when register_globals is enabled, has unknown impact and attack vectors.

Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the sortBy, sortOrder, startReg, U, LastCheck, and R parameters.

The setup routine (setup.php) in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vectors.

A directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.

SQL injection vulnerability in the announce and notes modules of phpWebSite before version 0.9.3-2. An attacker can remotely execute arbitrary SQL queries, for example via the ANN_id parameter in the announce module.

SQL injection vulnerability in the compose message form in HELM 3.1.19 and earlier. An attacker can remotely execute arbitrary SQL commands via the messageToUserAccNum parameter.

Vulnerability in Jaws 0.3 allows remote attackers to bypass authentication by sending an HTTP request to admin.php with the 'logged' cookie set to the MD5 hash of a null password, which is compared against the 'logged' session variable in the logged_on function in application.php.

Multiple unspecified vulnerabilities in the H.323 protocol implementation for Sun SunForum 3.2 and 3D 1.0 allow remote attackers to cause a denial of service (segmentation fault and process crash), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.

Multiple unknown vulnerabilities in IBM Lotus Notes 6.5.x before 6.5.4 and 6.0.x before 6.0.5, related to Java applets, have unknown impact and attack vectors, identified as (1) KSPR5YS6GR and (2) KSPR62F4D3.

SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication via the login or password fields. This issue was later reported to also affect firmware 4.0.34.

PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch_path parameter.

SQL injection vulnerability in the sloth TCL script in QuoteEngine before version 1.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

Unknown vulnerability in the dotlock implementation in mailutils before version 1:0.5-4 on Debian GNU/Linux allows attackers to gain privileges.

PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using checkdb.inc.php.

Unknown vulnerability in RemoteEditor before version 0.1.1, related to oversize submissions, has unknown impact and attack vectors.

Unknown vulnerability in the 'access code' in SecureEditor before 0.1.2 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.

Unknown vulnerability in the 'access code' in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.

The vulnerability in the ImageManager component in e107 before version 0.617 allows a remote attacker to execute arbitrary code by uploading a PHP file due to improper file type validation.