CVE Vulnerability Catalog

Heap-based buffer overflow in Image-Line Software FL Studio 5.0.1 allows remote attackers to execute arbitrary code via a .flp file containing a long path to a .mid or .wav file.

A vulnerability in the nslookup.cgi program by Avi Alkalay, dated June 16, 2002, allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters in the query parameter.

The notify program by Avi Alkalay, dated 19 Aug 2001, contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the 'from' parameter.

Stack-based buffer overflow in AbiWord before version 2.2.10 allows attackers to execute arbitrary code via the RTF import mechanism.

SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the user_pass_sha1 value in a cookie.

Simplog 0.9.1 might allow remote attackers to execute arbitrary SQL commands or trigger SQL error messages via invalid (1) pid, (2) blogid, (3) cid, or (4) m parameters to archive.php, or the (5) blogid parameter to blogadmin.php.

Unspecified vulnerability in Eric Integrated Development Environment (eric3) before version 3.7.2. The flaw has unknown impact and attack vectors, related to a potential security exploit.

PHP remote file inclusion vulnerability in index.php of AlstraSoft E-Friends 4.0 allows remote attackers to execute arbitrary PHP code via the mode parameter.

SQL injection vulnerability in the file pages/forum/submit.html in Interchange versions 4.9.3 through 5.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in MailGust 1.9 allows remote attackers to execute arbitrary SQL commands via the email field on the password reminder page.

Multiple stack-based buffer overflows in PowerArchiver versions 8.10 through 9.5 Beta 4 and Beta 5 allow remote attackers to execute arbitrary code via a long filename in a specially crafted ACE or ARJ archive.

SQL injection vulnerability in Zengaia before version 0.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in rsyslogd in RSyslog before 1.0.1 and before 1.10.1 allows remote attackers to execute arbitrary SQL commands via crafted syslog messages.

Multiple unspecified vulnerabilities were found in Opera 8.50 on Linux and Windows. They relate to handling of the 'must-revalidate' cache directive for HTTPS pages and a display issue with cookie comment encoding.

The ARJ plugin (arj.dll) version 3.9.2.0 for 7-Zip 3.13, 4.23, and 4.26 BETA contains a stack-based buffer overflow. A remote attacker can exploit this vulnerability by sending a specially crafted large ARJ block, leading to arbitrary code execution.

SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitrary SQL commands via the phrase field.

SQL injection vulnerability in module/down.inc.php in jportal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the search field to download.php.

Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.

Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.

Vulnerability in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with 'zero-width non-joiner' characters.