CVE Vulnerability Catalog

CGI::Session 4.03-1 does not set proper permissions on temporary files created by Driver::File and Driver::db_file. A local user can read these files and obtain sensitive information such as session keys.

The vulnerability in Classic Planer of AntiVir PersonalEdition Classic 7 is that it does not drop privileges before executing external programs. This allows a local user to gain privileges via notepad.exe, which is used to display scan reports.

Mozilla Firefox 1.0.7 and 1.5.0.1 may crash (denial of service) when viewing the page source of an HTML tag with a large number of script event handlers like onload and onmouseover. Red Hat and Mozilla disputed this issue, suggesting it may be caused by the IE Tab extension rather than Firefox itself.

PHP SimpleNEWS 1.0.0 contains a vulnerability in admin.php that allows a remote attacker to bypass authentication by setting the admin parameter in a cookie.

The Internet Key Exchange implementation in Funkwerk X2300 7.2.1 is vulnerable to a remote attack that can cause denial of service and possibly arbitrary code execution via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite.

SQL injection vulnerability in index.php of OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter.

Multiple SQL injection vulnerabilities were found in ASPPortal 3.00. Their exact impact and attack vectors are unknown.

SQL injection vulnerability in discussion.class.php in xhawk.net discussion 2.0 beta2 allows remote attackers to execute arbitrary SQL commands via the view parameter.

A stack-based buffer overflow in the IMAP service of Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by sending a long string to the LOGIN or SELECT commands.

An unspecified vulnerability in BorderWare MXtreme 5.0 and 6.0 allows remote attackers to have an unknown impact via unknown attack vectors. The details are obtained solely from third party information.

In glFTPd before version 2.01 RC5, an unspecified vulnerability allows remote attackers to bypass IP checks via a crafted DNS hostname that may appear to be an IP address.

Unspecified vulnerability in the Webmail module in Winmail before version 4.3. It may have unknown impact and unknown remote attack vectors.

In Microsoft Commerce Server 2002 before SP2, sample files in the authfiles directory allow authentication bypass. An attacker can log in to authfiles/login.asp with a valid username and any password, then navigate to the main site twice to gain access without proper authorization.

SQL injection vulnerability in Maian Support 1.0 allows remote attackers to execute arbitrary SQL commands via the email or pass parameter in admin/index.php.

An Eval Injection vulnerability in cal.php of Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary PHP code via the 'date' parameter to index.php.

An unspecified vulnerability in the mklvcopy tool within the BOS.RTE.LVM component of IBM AIX 5.3 allows local users to execute arbitrary commands. The issue is likely due to an untrusted search path vulnerability when mklvcopy calls external commands.

A buffer overflow vulnerability exists in mshtml.dll of Microsoft Internet Explorer 6.0.2900.2180 (and likely other versions). A remote attacker can exploit an HTML tag with a large number of event handlers (e.g., onclick, onload, onmouseover), causing memory corruption and arbitrary code execution.

An unspecified vulnerability in certain versions of xpdf after 3.00, used in various products including pdfkit.framework, gpdf, pdftohtml, and libextractor, has unknown impact and requires user interaction. The vulnerability may involve errors in gmem.c, SplashXPathScanner.cc, JBIG2Stream.cc, JPXStream.cc, or Stream.cc.

In Simple PHP Blog (SPB) 0.4.7.1 and earlier, the install05.php file contains a directory traversal vulnerability. An attacker can remotely include and execute arbitrary local files by using directory traversal sequences and a NUL (%00) character in the blog_language parameter, allowing injection of PHP code into the Apache access_log file and its execution.

DSNewsletter 1.0 has multiple SQL injection vulnerabilities in the email parameter in include/sub.php, include/confirm.php, and include/unconfirm.php. An attacker can remotely execute arbitrary SQL commands if magic_quotes_gpc is disabled.