CVE Vulnerability Catalog

In sNews 1.3, the index.php file is vulnerable to SQL injection via the category and id parameters. This allows a remote attacker to execute arbitrary SQL commands on the database.

A double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.

A buffer overflow vulnerability in Metamail 2.7-50 occurs when processing a long 'boundary' attribute in email messages. An attacker can send a crafted email causing a denial of service or potentially arbitrary code execution.

Zen Cart before version 1.2.7 does not protect the admin/includes directory, allowing remote attackers to cause unknown impact via unspecified vectors, likely direct requests.

SQL injection vulnerability in Zen Cart before version 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

TTS Time Tracking Software 3.0 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

In Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier, the change_password.php script does not verify the old password when a user changes the password. This allows a remote attacker to change the password without knowing the old one, potentially leading to unauthorized access.

In Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier, the add_user.php script does not check user privileges when adding a new administrative user. This allows a remote attacker to create an admin account without authorization.

In Virtual Hosting Control System (VHCS) version 2.4.7.1 and earlier, the check_login function in login.php does not exit after authentication failure. This allows a remote attacker to gain unauthorized access to the system.

A format string vulnerability in powerd.c of Power Daemon (powerd) version 2.0.2 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the WHATIDO variable.

Heap-based buffer overflow in the bitmap processing routine of Microsoft Windows Media Player. A crafted BMP file with size 0 but containing extra data allows remote attackers to execute arbitrary code.

The LDAP component in Fedora Directory Server 1.0 is vulnerable to a denial of service attack via a crafted BER sequence that causes a free of uninitialized memory, leading to a server crash. The issue was demonstrated using the ProtoVer LDAP test suite.

A buffer overflow vulnerability in the plug-in for Microsoft Windows Media Player 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.

A vulnerability in Microsoft Windows XP SP1/SP2 and Server 2003 up to SP1 allows a remote attacker to cause a system hang by sending an IGMP packet with an invalid IP option. This is known as the IGMP v3 DoS vulnerability.

A vulnerability in the ShellAbout API call of the Korean Input Method Editor (IME) in Windows XP SP1/SP2, Windows Server 2003 up to SP1, and Office 2003 allows a local user to gain privileges by launching the "shell about dialog box" and clicking the End-User License Agreement link, which executes Notepad with the privileges of the program displaying the about box.

A vulnerability in telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.

Multiple SQL injection vulnerabilities exist in Magic Calendar Lite 1.02 in cms/index.php via the $total_login and $total_password parameters when magic_quotes_gpc is disabled. Remote attackers can execute arbitrary SQL commands.

Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before version 1.0.06. Impact and attack vectors are unknown.

SQL injection vulnerability in index.php of PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in message.php within the espace_membre module. The provenance of this information is unknown; details are obtained solely from third party sources.

Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the Forum and pages parameters. The vendor disputes this, stating the forum does not use an SQL database, and researchers suggest the issue may be a VBScript parsing error.