CVE Vulnerability Catalog

SQL injection vulnerability in calendar.php in Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which sets the $this->chosen_month variable.

Buffer overflow vulnerability in the web server of Webcam Watchdog 3.63 allows remote attackers to execute arbitrary code via a long HTTP GET request.

LICQ versions 1.2.6, 1.0.3, and possibly others have a format string vulnerability that allows remote attackers to perform unknown actions via format string specifiers.

iisPROTECT versions 2.1 and 2.2 allow remote attackers to bypass authentication via an HTTP request containing URL-encoded characters.

PHP treats unknown methods such as 'PoSt' as GET requests, which could allow attackers to bypass intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0.

Buffer overflow in mIRC before version 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.

Directory traversal vulnerability in Advanced Poll 2.0.2 allows remote attackers to read arbitrary files or inject arbitrary local PHP files via .. sequences in the base_path or pollvars[lang] parameters.

RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute force guessing attacks.

Multiple integer overflows in the 32bit emulation for AMD64 architectures in Linux 2.4 kernel before 2.4.21 may allow attackers to cause a denial of service or gain root privileges via unspecified vectors that trigger copy_from_user function calls with improper length arguments.

Buffer overflow in Epic Games Unreal Engine versions 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.

Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges.

TinyWeb 1.9 allows remote attackers to cause a denial of service (CPU consumption) via a '.%00.' in an HTTP GET request to the cgi-bin directory.

XMMS.pm in X2 XMMS Remote allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086.

The SIP implementation in Mediatrix Telecom VoIP Access Devices and Gateways running SIPv2.4 and SIPv4.3 firmware allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages.

Integer overflow in MP3Broadcaster for Apple QuickTime/Darwin Streaming Server 4.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed ID3 tags in MP3 files.

Versions of Monit from 1.4 to 4.1 contain a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code via a long HTTP request.

DotBr 0.1 stores config.inc with insufficient access control under the web document root, allowing remote attackers to obtain sensitive information such as SQL usernames and passwords.

CVE-2003-1178 describes an eval injection vulnerability in comments.php in Advanced Poll 2.0.2 that allows remote attackers to execute arbitrary PHP code via the (1) id, (2) template_set, or (3) action parameter.

Buffer overflow in rcp for AIX 4.3.3, 5.1 and 5.2 allows local users to gain privileges.

An unknown vulnerability in sendmail for Solaris 7, 8, and 9 allows local users to cause a denial of service and possibly gain privileges via certain constructs in a .forward file.