CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in Internet Software Sciences Web+Center 4.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the ISS_TECH_CENTER_LOGIN cookie in search.asp and (2) one or more cookies in DoCustomerOptions.asp.

SCO OpenServer versions 5.0.5 through 5.0.7 only support Xauthority style access control when logging in using scologin. This allows remote attackers to gain unauthorized access to an X session via other X login methods.

Buffer overflow in the Entrust LibKmp ISAKMP library, used by Symantec Enterprise Firewall and other products, allows remote attackers to execute arbitrary code via a crafted ISAKMP payload.

An unknown vulnerability related to the handling of large requests in RAdmin for Mac OS X 10.3.3 and Mac OS X 10.2.8 may allow attackers to have unknown impact via unknown attack vectors.

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via various parameters in PHP files.

The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitrary scripts.

Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.

SQL injection vulnerability in DMXReady Site Chassis Manager allows remote attackers to execute arbitrary SQL commands via unknown vectors.

Buffer overflow vulnerability in the KSDWRTB function of the dbms_system package in Oracle Database 9i and 8i. A remote authorized user can exploit a long second argument to execute arbitrary code on the database server.

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.

Unknown vulnerability in the PageEditor component in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact.

SQL injection vulnerability in mailorder.asp or payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL commands via the strItems parameter.

SQL injection vulnerability in application_top.php in Zen Cart 1.1.3 before patch 2 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.

Multiple stack-based buffer overflows in Agent Common Services (cam.exe and awservices.exe) in Unicenter TNG 2.4 allow remote attackers to execute arbitrary code.

SQL injection vulnerability in PostCalendar 4.0.0 allows remote attackers to execute arbitrary SQL commands via search queries.

Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via long output from wc to shar, or unknown vectors in unshar.

Vulnerability in VocalTec VGW4/8 Gateway 8.0 allows remote attackers to bypass authentication by sending an HTTP request to home.asp with a trailing slash.

SQL injection vulnerability in GoSmart Message Board allows remote attackers to execute arbitrary SQL code via the QuestionNumber and Category parameters to Forum.asp or the Username and Password parameters to Login_Exec.asp.

SQL injection vulnerability in bBlog 0.7.2 and 0.7.3 allows remote attackers to execute arbitrary SQL commands via the p parameter.

Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.