CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in config.php in NukedWeb GuestBookHost 2005.04.25 allow remote attackers to execute arbitrary SQL commands via the email and password parameters.

SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g (and possibly earlier versions) may allow remote attackers to execute arbitrary SQL commands via unknown vectors. Due to lack of details from Oracle advisory, it cannot be conclusively proven that this issue has been addressed.

Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors. Due to lack of details from Oracle advisory, it is unclear if this issue has been addressed.

A vulnerability in urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a specially crafted BGSOUND element with a SRC attribute containing a large number of hyphens.

An unspecified vulnerability in index.php of an application available on www.egeinternet.com allows remote attackers to execute arbitrary code by sending malicious code in the 'key' parameter. It is likely a PHP remote file inclusion vulnerability where the attack vector is a URL in the 'key' parameter.

Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements as the SYS user and bypass audit logging by modifying the AUTH_ALTER_SESSION attribute during TNS authentication.

A buffer overflow in an unspecified Oracle Client utility may allow remote attackers to execute arbitrary code or cause a denial of service. Lack of details from the Oracle advisory prevents conclusive confirmation that the issue has been addressed.

SQL injection vulnerability in the Oracle Text component of Oracle Database 10g (and possibly earlier versions) allows remote attackers to execute arbitrary SQL commands via unknown vectors. Due to lack of details from Oracle advisory, it is uncertain if the issue has been addressed.

An unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as root to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.

A buffer overflow vulnerability exists in the POP3 server of Kinesphere Corporation eXchange prior to version 5.0.060125. Remote attackers can exploit a long RCPT TO argument to execute arbitrary code.

The vulnerability in the Javascript interpreter (jsinterp.c) in Mozilla and Firefox before version 1.5.1 allows a remote attacker to cause a denial of service (crash) or execute arbitrary code through improper object dereferencing during garbage collection.

A vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey allows remote code execution by changing an element's style from position:relative to position:static, causing Gecko to operate on freed memory.

The vulnerability in the function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and potentially execute arbitrary code via user-defined methods that trigger garbage collection operating on freed objects.

A vulnerability in BIND 4 and BIND 8 allows remote attackers to gain privileged access via a Kashpureff-style DNS cache corruption attack when the server is used as a target forwarder.

In SPIP 1.8.2-e and earlier, and 1.9 Alpha 2 (5539) and earlier, multiple SQL injection vulnerabilities exist in the file formulaires/inc-formulaire_forum.php3. Remote attackers can execute arbitrary SQL commands via the id_forum, id_article, or id_breve parameters to forum.php3, as well as through unspecified vectors related to session handling and when posting petitions.

SQL injection vulnerability in the Authentication Servlet of Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via specially crafted URL requests.

The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program.

SQL injection vulnerability in global.php in MyBB before version 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.

SQL injection vulnerability in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the 'site' parameter in index.php.