CVE Vulnerability Catalog

Cacti before version 0.6.8 allows attackers to execute arbitrary commands via the 'Data Input' option in console mode.

SQL injection vulnerability in CafeLog b2 Weblog Tool allows remote attackers to execute arbitrary SQL code via the tablehosts variable.

CVE-2002-1482 describes an SQL injection vulnerability in login.php for phpGB version 1.20 and earlier, when magic_quotes_gpc is not enabled. This allows remote attackers to gain administrative privileges by injecting SQL code into the password field.

Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root.

DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems via a request for a URL that specifies the target IP address and port.

The scponly program does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls.

In Cacti before version 0.6.8, the graphs.php file allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.

The savesettings.php file in phpGB version 1.20 and earlier does not require authentication, allowing remote attackers to cause a denial of service or execute arbitrary PHP code by modifying config.php.

CafeLog b2 Weblog Tool version 2.06pre4, with allow_fopen_url enabled, allows remote attackers to execute arbitrary PHP code via the b2inc variable.

The print_html_to_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, allowing remote attackers to modify home pages of other users.

CVE-2002-0690 describes a format string vulnerability in McAfee Security ePolicy Orchestrator (ePO) 2.5.1 that allows remote attackers to execute arbitrary code via an HTTP GET request with a URI containing format strings.

HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 characters, possibly triggering a buffer overflow.

Integer signedness error in select() on OpenBSD 3.1 and earlier allows local users to overwrite arbitrary kernel memory via a negative value for the size parameter.

In dotProject version 0.2.1.5, there is a vulnerability that allows remote attackers to bypass authentication using a cookie or URL with the user_cookie parameter set to 1.

The Gallery photo album package before version 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL containing a malicious init.php script.

The upgrade of IRIX on Origin 3000 to versions 6.5.13-6.5.16 changes the system's MAC address, which could affect intended access restrictions based on the MAC address.

An unknown vulnerability in HP OpenView EMANATE 14.2 snmpModules allows the SNMP read-write community name to be exposed. The issue relates to both 'read-only' community access and an easily guessable community name.

FUDforum versions before 2.2.0 have SQL injection vulnerabilities that allow remote attackers to perform unauthorized database operations via report.php, selmsg.php, and showposts.php.

TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, allowing remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.

RCONAG6 for Novell Netware SP2, while running RconJ in secure mode, allows remote attackers to bypass authentication using the RconJ 'Secure IP' (SSL) option during a connection.