CVE Vulnerability Catalog

Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements as the SYS user and bypass audit logging by modifying the AUTH_ALTER_SESSION attribute during TNS authentication.

An unspecified vulnerability in index.php of an application available on www.egeinternet.com allows remote attackers to execute arbitrary code by sending malicious code in the 'key' parameter. It is likely a PHP remote file inclusion vulnerability where the attack vector is a URL in the 'key' parameter.

SQL injection vulnerability in the Oracle Text component of Oracle Database 10g (and possibly earlier versions) allows remote attackers to execute arbitrary SQL commands via unknown vectors. Due to lack of details from Oracle advisory, it is uncertain if the issue has been addressed.

A buffer overflow in an unspecified Oracle Client utility may allow remote attackers to execute arbitrary code or cause a denial of service. Lack of details from the Oracle advisory prevents conclusive confirmation that the issue has been addressed.

An unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as root to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.

A buffer overflow vulnerability exists in the POP3 server of Kinesphere Corporation eXchange prior to version 5.0.060125. Remote attackers can exploit a long RCPT TO argument to execute arbitrary code.

The vulnerability in the Javascript interpreter (jsinterp.c) in Mozilla and Firefox before version 1.5.1 allows a remote attacker to cause a denial of service (crash) or execute arbitrary code through improper object dereferencing during garbage collection.

A vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey allows remote code execution by changing an element's style from position:relative to position:static, causing Gecko to operate on freed memory.

The vulnerability in the function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and potentially execute arbitrary code via user-defined methods that trigger garbage collection operating on freed objects.

A vulnerability in BIND 4 and BIND 8 allows remote attackers to gain privileged access via a Kashpureff-style DNS cache corruption attack when the server is used as a target forwarder.

SQL injection vulnerability in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the 'site' parameter in index.php.

In SPIP 1.8.2-e and earlier, and 1.9 Alpha 2 (5539) and earlier, multiple SQL injection vulnerabilities exist in the file formulaires/inc-formulaire_forum.php3. Remote attackers can execute arbitrary SQL commands via the id_forum, id_article, or id_breve parameters to forum.php3, as well as through unspecified vectors related to session handling and when posting petitions.

SQL injection vulnerability in global.php in MyBB before version 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.

The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program.

SQL injection vulnerability in the Authentication Servlet of Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via specially crafted URL requests.

SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action.

A PHP remote file inclusion vulnerability in loginout.php of FarsiNews 2.1 Beta 2 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter.

MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, allowing remote attackers to perform unspecified privileged actions by directly accessing files via a URL.

Multiple SQL injection vulnerabilities were found in PHP GEN before version 1.4. Unknown attack vectors allow remote attackers to inject arbitrary SQL commands.

Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via the catview parameter in cal_functions.inc.php and the login parameter in cal_login.php.