CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in the mySAP.com architecture for SAP allow remote attackers to execute arbitrary code via a long HTTP Host header to Message Server, Web Dispatcher, or Application Server.
CVE-2003-1037 describes a format string vulnerability in the WGate component for SAP Internet Transaction Server (ITS) that allows remote attackers to execute arbitrary code via a high 'trace level.'
Multiple stack-based buffer overflows in the encode_mime, encode_uuencode, and decode_uuencode functions for emil 2.1.0 and earlier allow remote attackers to execute arbitrary code via e-mail messages containing attachments with filenames.
Opera allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, causing Opera to send the cookie outside the specified URL subsets.
PHP remote file inclusion vulnerability in affich.php of Gemitel 3.50 allows remote attackers to execute arbitrary PHP code via the base parameter.
Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets.
The WrapNISUM ActiveX component (WrapUM.dll) in Norton Internet Security 2004 is marked safe for scripting, allowing remote attackers to execute arbitrary programs via the LaunchURL method.
The instdbmsrv and instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program. This allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.
Multiple buffer overflows in iso2022jp.c and shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code when a Unicode character is out of BMP range.
CVE-2003-0257 describes a format string vulnerability in the printer capability for IBM AIX versions 3, 5.1, and 5.2, allowing local users to gain printq or root privileges.
The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does.
Vulnerability in ZoneAlarm Pro 4.5.538.001 and possibly other versions allows remote attackers to bypass email protection via attachments whose names contain certain non-English characters.
SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.
SQL injection vulnerability in auth.php and admin.php files of PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account by sending base64-encoded SQL in the admin parameter.
The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wiki_up URL.
Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode and offset parameters in many PHP scripts.
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the Theme, Country, Real Name, or Displayed time zone fields in a User Profile, or the Name, Description, URL, or Country fields in a Directory/Add Site operation.
X-Micro WLAN 11b Broadband Router versions 1.2.2, 1.2.2.3, 1.2.2.4, and 1.6.0.0 contain a hardcoded administrative account named "super" with a default password. This allows a remote attacker to gain full access to the device without authorization.
The X-Micro WLAN 11b Broadband Router version 1.6.0.1 contains hardcoded credentials: username and password "1502". This allows remote attackers to gain access to the device.
Multiple buffer overflows in LCDProc 0.4.1 and possibly other 0.4.x versions up to 0.4.4 allow remote attackers to execute arbitrary code via (1) a long invalid command to parse_all_client_messages function, or (2) long argv command to test_func_func function.