CVE Vulnerability Catalog

The vulnerability in Norton SystemWorks and SystemWorks Premier 2005 and 2006 stores temporary copies of files in the hidden Norton Protected Recycle Bin (NProtect) directory. This directory is hidden from the FindFirst and FindNext Windows APIs, allowing remote attackers to hide arbitrary files from virus scanners and other security products.

SQL injection vulnerability in the search module of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter in modules/Search/index.php.

A buffer overflow vulnerability was found in certain functions in src/fileio.c and src/unix/fileio.c in xmame before January 11, 2006. Providing a long -lang, -ctrlr, -pb, or -rec argument on many operating systems, or a long -jdev argument on Ubuntu Linux, may allow a local user to gain privileges.

Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2. Local users can exploit format specifiers in the quote command, leading to unknown impact. Due to lack of setuid and typical local use, privilege escalation risk is low.

PHP remote file inclusion vulnerability in index.php of OrjinWeb E-commerce. An attacker can execute arbitrary code remotely by sending a crafted URL in the 'page' parameter.

The addresses.php3 script in MyPhPim 01.05 does not restrict uploaded files, allowing remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory.

Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by invoking /usr/bin/script with a long command line argument or setting the -c option of /etc/nu to the name of a file containing a long line.

An unspecified vulnerability in Microsoft Outlook 2000-2003, Exchange 5.0 SP2, 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an email with a crafted TNEF MIME attachment, related to message length validation.

Critical vulnerability in Microsoft Windows T2EMBED.DLL allows remote code execution via a crafted Embedded Open Type (EOT) font in an email or web page. A heap-based buffer overflow occurs during font decompression.

An unspecified Microsoft WMF parsing application, used in Internet Explorer and other components, contains an integer overflow vulnerability when processing a crafted WMF file with a manipulated header size. This can lead to a denial of service (crash) and potentially arbitrary code execution.

A heap-based buffer overflow in libclamav/upx.c in ClamAV before version 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.

A vulnerability in 427BB 2.2 and 2.2.1 allows authentication bypass by manipulating cookies. An attacker can impersonate any user by setting appropriate cookie values.

SQL injection vulnerability in index.php of CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.

SQL injection vulnerability in showthread.php in 427BB 2.2 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the ForumID parameter.

SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the parent, root, and topic_id parameters to post.php3.

SQL injection vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to execute arbitrary SQL commands via the email parameter. Details are obtained solely from third party information.

The vulnerability in sudo 1.6.8 and other versions is due to not clearing the PYTHONINSPECT environment variable, allowing limited local users to escalate privileges via a Python script. This is a variant of CVE-2005-4158.

The server.php test script in ADOdb for PHP before version 4.70, used in multiple products including Mantis, PostNuke, Moodle, Cacti, Xaraya, PHPOpenChat, MAXdev MD-Pro, and MediaBeez, allows remote attackers to execute arbitrary SQL commands via the sql parameter when the MySQL root password is empty.

The vulnerability in the go-pear.php script of PHP PEAR 0.2.2, used in Apache2Triad, allows a remote attacker to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.

Multiple format string vulnerabilities were found in the auth_ldap_log_reason function in Apache auth_ldap version 1.6.0 and earlier. Remote attackers can exploit these flaws, for example via a crafted username, potentially leading to arbitrary code execution.