CVE Vulnerability Catalog

The _httpsrequest function in Snoopy 1.2, used in products such as WordPress, MagpieRSS, Ampache, and Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL. The issue is due to improper handling of these characters by the fetch function.

SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

PHP remote file inclusion vulnerability in common.php in PunBB versions 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.

Vulnerability in Data ONTAP 7.0 and earlier allows an attacker to bypass iSCSI authentication by using a modified client that skips the Security (Start) mode required by the Login Negotiation protocol and directly enters Operational mode without proving identity.

The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the (1) DiscoveryWeb and (2) DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password.

PHP remote file inclusion vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.

Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via the id parameter in detail.php and the catid parameter in get.php and index.php.

Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via the username parameter in the Your Account page, the url parameter in the Downloads module, and the description parameter in the Web_Links module.

Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the forum_id, thread_id, link_id, artid, and dl_id parameters.

Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights that should be restricted to administrators.

The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers to execute arbitrary code.

Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute arbitrary code via a crafted GIF file.

Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute arbitrary code.

Stack-based buffer overflow in ppp in SCO Unixware 7.1.3 and 7.1.4, and possibly earlier versions, allows local users to execute arbitrary code via a long argument to the prompt or defprompt command.

Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.

Multiple buffer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.

The FTP server in HP-UX 10.20, B.11.00, and B.11.11 allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.

Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.

SQL injection vulnerability in Accelerated Mortgage Manager allows remote attackers to execute arbitrary SQL commands via the password field.

Splatt Forum versions 3.0 through 3.2 contain a vulnerability that allows remote attackers to bypass authentication via unknown vectors.