CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before version 0.6.7.1 allow remote attackers to execute arbitrary SQL commands through various parameters.

In the CGI component in PHP, through version 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, there is a vulnerability related to improper consideration of the mapping's length when processing an invalid .php file, leading to out-of-bounds read.

The batadv_frag_merge_packets function in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.

Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to have unspecified impact.

Buffer overflow in NotePad++ version 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file.

CVE-2014-9455 is an SQL injection vulnerability in showads.php in CTS Projects & Software ClassAd 3.0 that allows remote attackers to execute arbitrary SQL commands via the catid parameter.

Multiple stack-based buffer overflows in the DIVA web service API in VDG Security SENSE 2.3.13 allow remote attackers to execute arbitrary code via the user or password parameter in an AuthenticateUser request.

Multiple SQL injection vulnerabilities in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 in chart_bar.php allow remote attackers to execute arbitrary SQL commands via the itemid or periods parameter.

Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long string in a WAX file.

SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php.

CVE-2014-9440 is an SQL injection vulnerability in browse.php in phpMyRecipes version 1.2.2 that allows remote attackers to execute arbitrary SQL commands via the category parameter.

Multiple SQL injection vulnerabilities in Redaxscript version 0.3.2 in includes/password.php allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) password parameter to the password_reset program.

The cdnvote plugin before version 0.4.2 for WordPress has multiple SQL injection vulnerabilities in cdnvote-post.php that allow remote attackers to execute arbitrary SQL commands via the cdnvote_post_id or cdnvote_point parameters.

Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument.

The cmdSave method in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll version 5.0.2 allows remote attackers to write to arbitrary files via a pathname in the argument.

The EaseWeFtp.FtpLibrary ActiveX control in Easewe FTP OCX 4.5.0.9 does not restrict access to certain methods, allowing remote attackers to execute arbitrary files and manipulate files and folders on the local system.

Multiple buffer overflows in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in version 5.0.2 allow remote attackers to execute arbitrary code via a long argument to the (1) cmdExport, (2) cmdImport, (3) cmdOpen, or (4) cmdSave method.

The Social Slider plugin before version 7.4.2 for WordPress has an SQL injection vulnerability in ajax.php, allowing remote attackers to execute arbitrary SQL commands via the rA array parameter.

Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the start_read or AdpcmReadBlock function.

The bb_func_unsub.php file in MiniBB 3.1 before version 20141127 contains an incorrect regular expression, allowing remote attackers to conduct SQL injection attacks via the code parameter in an unsubscribe action to index.php.