CVE Vulnerability Catalog

Unknown vulnerability in Moodle before version 1.2, related to improper text filtering. The impact and attack vectors are unknown.

Unknown vulnerability in Moodle before version 1.3.4, related to handling of strings in Moodle texts. Details about impact and attack vectors are unknown.

Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php.

A vulnerability in Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. The affected version was reported to be 4.3.7, but this may be erroneous.

Unknown vulnerability in RemoteEditor before version 0.1.1, related to oversize submissions, has unknown impact and attack vectors.

Unknown vulnerability in the 'access code' in SecureEditor before 0.1.2 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.

Unknown vulnerability in the 'access code' in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.

The vulnerability in the ImageManager component in e107 before version 0.617 allows a remote attacker to execute arbitrary code by uploading a PHP file due to improper file type validation.

Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060) allows remote attackers to obtain sensitive information and gain privileges by using TFTP to download the nvram file, then extracting the username, password, and other data from the file.

SQL injection vulnerability in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL via the referer field in an HTTP request.

A vulnerability in Novell Client Firewall (NCF) 2.0, based on Agnitum Outpost Firewall, allows local users to execute arbitrary code with SYSTEM privileges by opening the NCF tray icon and using the Help functionality to launch programs with elevated privileges.

A buffer overflow vulnerability in pop3.c in gnubiff before version 2.0.0 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code.

An unspecified vulnerability in Hitachi Web Page Generator and Web Page Generator Enterprise version 4.01 and earlier allows remote attackers to cause a denial of service (DoS) via unknown attack vectors when a web site is improperly accessed.

Unspecified vulnerability in MadBMS before version 1.1.5, related to logins, has unknown impact and attack vectors.

Unspecified vulnerability in Jetty HTTP Server, as used in IBM Trading Partner Interchange before 4.2.4 and CA Unicenter Web Services Distributed Management (WSDM) before 3.11, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

Buffer overflow vulnerability in the LDAP component of Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems. A remote attacker can exploit this flaw to execute arbitrary code.

The Webmail, admin, and SMTP services in Ability Mail Server 1.18 allow remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous connections to the service.

A vulnerability in GnuTLS 1.0.16 allows remote attackers to cause a denial of service (CPU consumption) via X.509 certificates with long chains and signed with large RSA keys.

The ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack vector involving a string that contains escape sequences represented with overlong UTF-8 encoding.

The GUI in MDaemon 7.2 and earlier (including 6.8) executes child processes such as NOTEPAD.EXE with SYSTEM privileges when users create new files, allowing local users with physical access to gain privileges.