CVE Vulnerability Catalog

The PHP remote file inclusion vulnerability in EasyDynamicPages 2.0 allows remote attackers to execute arbitrary PHP code by modifying the edp_relative_path parameter to reference a malicious serverdata.php script on a remote web server.

The CVE-2004-0068 vulnerability in PhpDig 1.6.5 and earlier allows remote attackers to execute arbitrary PHP code by modifying the $relative_script_path parameter to reference a URL on a remote web server containing the code.

The SPP_VerifyPVV function in nCipher payShield SPP library versions 1.3.12, 1.5.18, and 1.6.18 returns a Status_OK value even if the HSM returns a different status code. This could lead applications to make incorrect security-critical decisions, such as accepting an invalid PIN number.

Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in versions 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.

tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets.

An unknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gain access to restricted functions.

The vulnerability in Red-M Red-Alert 2.7.5 with software 3.1 build 24 binds authentication to IP addresses. A remote attacker can bypass authentication by connecting from the same IP address as an active authenticated user.

Unknown vulnerability in SandSurfer before version 1.7.0 allows remote attackers to gain access as a logged-in user.

Vulnerability in Windows Media Player 9 allows remote attackers to execute arbitrary code via a specially crafted PNG file with large width or height values, known as the 'PNG Processing Vulnerability'.

Vulnerability in Linux-VServer 1.24 allows local users with root privileges on a virtual server to gain access to the filesystem outside the virtual server via a modified chroot-again exploit using the chmod command.

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions through various methods, such as using the NavigateAndFind method or window.open to load a JavaScript URL.

Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow remote attackers to execute arbitrary code.

The calendar module for phpgroupware 0.9.14 does not enforce the 'save extension' feature for holiday files, allowing remote attackers to create and execute PHP files.

Buffer overflow in Yahoo Instant Messenger 5.6.0.1351 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in the download feature.

vbox3 version 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, allowing local users to gain elevated privileges.

Cisco Personal Assistant versions 1.4(1) and 1.4(2) disables password authentication when 'Allow Only Cisco CallManager Users' is enabled, allowing remote attackers to gain access with a valid username.

An unknown vulnerability in minimalist mailing list manager versions 2.4, 2.2, and possibly others, allows remote attackers to execute arbitrary commands.

The mod_digest_apple module for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.

The mod_auth_shadow module 1.4 and earlier does not properly enforce the expiration of a user account and password, which could allow remote authenticated users to bypass intended access restrictions.

Jitterbug version 1.6.2 does not properly sanitize inputs, allowing remote authenticated users to execute arbitrary commands.