CVE Vulnerability Catalog

Macromedia Flash plugin (Flash.ocx 7.0.19.0 and earlier for Windows, libflashplayer.so before 7.0.25.0 for Unix) is vulnerable to a crash and potential arbitrary code execution via a crafted SWF file. The issue occurs when calling ActionDefineFunction in ActionScript, leading to improper memory access.

SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.

A buffer overflow vulnerability in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name and then executing the XPWD command.

A format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.

SQL injection vulnerability in resetcore.php in e107 versions 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the a_name parameter or user field of the login page.

Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the INCLUDE_PATH, SQUIZLIB_PATH, and PEAR_PATH parameters in several script files.

Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via banner.php or the id parameter in print.php, comment.php, and news.php.

SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_searches parameter.

SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.

The vulnerability in the chfn tool in pwdutils version 3.0.4 and earlier on SuSE Linux (and possibly other operating systems) does not properly validate arguments for the GECOS field, allowing local users to gain privileges.

A vulnerability in ClamAV versions 0.80 through 0.87, in the FSG unpacker function (fsg.c), allows a remote attacker to cause memory corruption and execute arbitrary code via a crafted FSG 1.33 file.

A buffer overflow vulnerability in the swcons utility in IBM AIX 5.2, when debug malloc is enabled, allows remote attackers to cause a core dump and potentially execute arbitrary code.

In Asus Video Security 3.5.0.0 and earlier, when using authorization, a buffer overflow occurs. A remote attacker can exploit a long username/password string to execute arbitrary code.

Vulnerability in Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.

A vulnerability in Frisk F-Prot Antivirus allows remote attackers to bypass protection by sending a ZIP file with a version header greater than 15, which prevents the software from decompressing and analyzing the file.

Multiple buffer overflows in the receiver function in loop.c in FlatFrag 0.3 and earlier allow remote attackers to execute arbitrary code via the (1) version, (2) name, and (3) model fields.

SQL injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to execute arbitrary SQL commands via the serviceid parameter. Although the vendor disputed this report, further investigation confirms the vulnerability exists.

The libungif library before version 4.1.0 contains a memory corruption vulnerability via a crafted GIF file, which can lead to arbitrary code execution. The issue is caused by an out-of-bounds write.

Vulnerability in Scorched 3D 39.1 (bf) and earlier allows a remote attacker to cause a denial of service (long loop and server hang) by sending a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp.