CVE Vulnerability Catalog

A stack-based buffer overflow in pads.c in Passive Asset Detection System (Pads) might allow local users to execute arbitrary code via a long report file name argument. NOTE: since Pads is not normally installed setuid, this may not be a vulnerability.

SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the admin_name or admin_pass parameters.

An unknown vulnerability in Serviceguard and Cluster Object Manager on HP-UX and HP Linux allows remote attackers to gain unauthorized privileges via unknown attack vectors.

The vulnerability in init.php of WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the user_inc parameter.

The vulnerability in the filediff tool in CVStrac allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters into the rcsinfo parameter.

Cross-site scripting (XSS) vulnerability in icq.cgi in Board Power 2.04PF allows remote attackers to inject arbitrary web script or HTML via the action parameter.

SQL injection vulnerability in bug.php in phpBugTracker 0.9.1 allows remote attackers to execute arbitrary SQL commands via the bug_id parameter (viewvotes operation) or the project parameter (add operation).

SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.

Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow remote attackers to execute arbitrary code via an SSH2 packet with a base argument larger than the mod argument, and malicious servers to cause a denial of service or possibly execute arbitrary code via a large bignum during authentication.

The vulnerability in UUDeview 0.5.20 and earlier is due to insecure handling of temporary files during decoding. The attack vectors and impact are unknown.

SQL injection vulnerability in action.php in Nucleus CMS 3.01 allows remote attackers to execute arbitrary SQL statements via the itemid parameter.

Vulnerability in Hired Team: Trial 2.0 and earlier and version 2.200 allows game players to kick other players off the server, including the administrator, without any restrictions.

A vulnerability in SurgeLDAP 1.0g (Build 12) and possibly earlier versions before 1.0h allows remote attackers to bypass authentication for the administration interface via a direct request to admin.cgi with a modified utoken parameter.

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the eid or cid parameters.

SQL injection vulnerability in post.php in Invision Power Board (IPB) versions 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.

PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to reference a URL on a remote web server that contains phpshop.cfg.

PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_path parameter to reference a URL on a remote web server that contains the code.

SQL injection vulnerability in the ibProArcade module for Invision Power Board (IPB) versions 1.x and 2.x. Remote attackers can execute arbitrary SQL commands via the 'cat' parameter in index.php.

ArGoSoft FTP version 1.4.2.4 and earlier does not limit the number of failed login attempts, making it easier for remote attackers to guess passwords via brute force attack.

Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1 allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to includes/calendar.php or includes/setup.php.