CVE Vulnerability Catalog

Ipswitch WS_FTP Server 4.0.2 contains a backdoor account named XXSESS_MGRYY with a default password, allowing remote attackers to gain access.

Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the ID parameter in more.asp and category_news.asp, and the filter parameter in news_sort.asp.

SQL injection vulnerability in Member Management System 2.1 allows remote attackers to execute arbitrary SQL via the ID parameter in resend.asp or news_view.asp scripts.

The admin.ib file in Borland Interbase 7.1 for Linux has default world writable permissions, which allows local users to gain database administrative privileges.

News Manager Lite 2.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN parameter in the NEWS_LOGIN cookie.

SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) versions 2.6.0 through 2.6.5 allows remote attackers to execute arbitrary code via a long URL.

Buffer overflow in the skey_challenge function in ftpd.c for wu-ftp daemon (wu-ftpd) version 2.6.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a s/key (SKEY) request with a long name.

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, causing Squid to use only a portion of the requested URL when comparing it against the access control lists.

Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10 could allow local users to execute arbitrary code via a long filename if ltrace is installed setuid.

Unknown vulnerability in CoreFoundation for Mac OS X 10.3.2, related to 'notification logging.'

Heap-based buffer overflow in the ISS Protocol Analysis Module (PAM) affects certain versions of RealSecure and BlackICE products. Remote attackers can execute arbitrary code by sending an SMB packet containing an authentication request with a long username.

The vulnerability in smbmnt in Samba 2.x and 3.x on Linux 2.6 allows local users to gain root privileges by mounting a Samba share that contains a setuid root program.

In Calife versions 2.8.5 and earlier, a heap-based buffer overflow may allow local users to execute arbitrary code via a long password.

PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary PHP code by modifying the basepath parameter to reference a URL on a remote web server that contains fileFunctions.php.

SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to inject SQL code via the gid parameter, potentially leading to privilege escalation or unauthorized database operations.

The Symantec FireWall/VPN Appliance model 200 records a cleartext password for the password administration page, which may be cached on the administrator's local system or in a proxy.

DiskArbitration in Mac OS X 10.2.8 and 10.3.2 does not properly initialize writable removable media, which may lead to handling issues.

XFree86 version 4.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an out-of-bounds array index when using the GLX extension and Direct Rendering Infrastructure (DRI).

CVE-2004-0159 in hsftp 1.11 has a format string vulnerability that allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an 'ls' command.