CVE Vulnerability Catalog

The MS-Logon authentication scheme in UltraVNC 1.0.1 uses weak XOR encryption for challenge/response, allowing remote attackers to sniff and decrypt passwords.

An unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via exceptional conditions that trigger memory corruption. The attack uses an exception handler and nested object tags, being a variant of CVE-2006-1992.

Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via category_id and prod_id parameters. Invalid SQL queries also result in full path disclosure.

A buffer overflow vulnerability in Gene6 FTP Server 3.1.0 affects the MKD and XMKD commands. A remote authenticated attacker can send a long argument, causing a denial of service (crash) and potentially arbitrary code execution.

SQL injection vulnerability in search.php in sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. It can also lead to path disclosure.

CyberBuild contains SQL injection vulnerabilities in the SessionID parameter (login.asp) and ProductIndex parameter (browse0.htm), allowing remote attackers to execute arbitrary SQL commands.

A vulnerability in Truecrypt 4.1 on Linux, running with setuid root privileges, allows a local user to execute arbitrary commands and escalate privileges by manipulating the PATH environment variable to point to a malicious mount command.

FileProtection Express 1.0.1 and earlier allows remote attackers to bypass authentication by setting a cookie with an Admin value of 1.

A remote file inclusion vulnerability exists in admin/addentry.php of phpBB Advanced Guestbook 2.4.0 and earlier. Attackers can exploit the phpbb_root_path parameter when register_globals is enabled to include arbitrary files from remote servers.

SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier. Remote attackers can execute arbitrary SQL commands via the id parameter when the level is set to 'slideshow'.

A PHP remote file inclusion vulnerability in toplist.php of phpBB TopList 1.3.8 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.

EMC Retrospect for Windows does not drop privileges before opening files, allowing local users to execute arbitrary code via the File>Open dialog.

Multiple buffer overflows in client.c in CGI:IRC (CGIIRC) before version 0.5.8 may allow remote attackers to execute arbitrary code via cookies or the query string.

SQL injection vulnerability exists in news.php of AZNEWS. Remote attackers can execute arbitrary SQL commands via the ID parameter.

A PHP remote file inclusion vulnerability in master.php of OpenPHPNuke version 2.3.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

SQL injection vulnerability in login.php of Ruperts News allows remote attackers to execute arbitrary SQL commands via the username parameter.

Pro Publish 2.0 contains multiple SQL injection vulnerabilities in the email, password, find_str, artid, and catid parameters, allowing remote attackers to execute arbitrary SQL commands.

SQL injection vulnerability in index.php of BoonEx Barracuda 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the link_dir_target and link_id_target parameters, likely in the link_edit functionality.

JMK's Picture Gallery contains a vulnerability that allows remote attackers to bypass authentication via a direct request to admin_gallery.php3, possibly related to the 'add' action.

PlanetGallery allows remote attackers to gain administrator privileges via a direct request to admin/gallery_admin.php.