CVE Vulnerability Catalog

SQL injection vulnerability in phpBB 2 before version 2.0.18 allows remote attackers to execute arbitrary SQL commands via the topic type parameter.

Buffer overflow vulnerability in the Network Block Device (nbd) server versions 2.7.5 and earlier, and 2.8.0 through 2.8.2. A remote attacker can send an oversized request that is written past the end of the buffer because nbd does not account for memory taken by the reply header, allowing arbitrary code execution.

SQL injection vulnerability in MusicBox 2.3 allows remote attackers to execute arbitrary SQL commands via the show and type parameters. The provenance of this information is unknown, although it was later rediscovered.

Multiple SQL injection vulnerabilities in Papoo 2.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the menuid parameter in index.php and guestbook.php, and the forumid and reporeid_print parameters in print.php.

The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators generates a random internal ACL name that is also used as a hidden username and password. An attacker can sniff this name from the cleartext portion of a RADIUS session and use the password to log in to another device using Cisco Secure Access Control Server (CS ACS).

SQL injection vulnerability in article.php of phpSlash 0.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the story_id parameter.

SQL injection vulnerability in index.cfm in SpireMedia mx7 allows remote attackers to execute arbitrary SQL commands via the cid parameter. Although the vendor disputed this issue, further research by CVE and OSVDB suggests it might be path disclosure due to invalid SQL syntax.

SQL injection vulnerability in Quantum Art QP7.Enterprise (formerly Q-Publishing) allows remote attackers to execute arbitrary SQL commands via the p_news_id parameter in news_and_events_new.asp and news.asp scripts. The vendor disputed the report, but CVE analysis confirmed a forced SQL syntax error in one script.

A stack-based buffer overflow in the Macromedia JRun 4 web server (JWS) occurs due to improper handling of a long request during conversion to wide characters. A remote attacker can exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.

A vulnerability in Ingate Firewall and SIParator before version 4.3.4 allows a remote attacker to cause a kernel deadlock by sending a SYN packet for a TCP stream, which requires an RST packet in response.

In Blender BlenLoader versions 2.0 through 2.40pre, a heap-based buffer overflow exists in the get_bhead function in readfile.c. An attacker can remotely cause a denial of service or potentially execute arbitrary code via a .blend file with a negative bhead.len value, leading to less memory allocation than expected, possibly due to an integer overflow.

The IKEv1 implementation in NEC UNIVERGE IX1000, IX2000, and IX3000 devices contains a vulnerability that allows a remote attacker to cause a denial of service and potentially execute arbitrary code via crafted IKE packets. This was demonstrated using the PROTOS ISAKMP Test Suite for IKEv1.

Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via the username field in login.php or the user_language, user_email, and user_gedcomid parameters in login_register.php, which are directly inserted into authenticate.php.

Heap-based buffer overflow in the SIPParser function in i3sipmsg.dll in Interaction SIP Proxy before 3.0.011. A remote attacker can send a REGISTER request with a SPI version number containing a large number of space or tab characters, causing a denial of service and potentially arbitrary code execution.

A remote file inclusion vulnerability in PHPGedView 3.3.7 and earlier allows arbitrary code execution via the PGV_BASE_DIRECTORY parameter in help_text_vars.php. An attacker can execute malicious PHP code by supplying a crafted URL.

A PHP remote file inclusion vulnerability in usermods.php of Tolva PHP website system 0.1.0 allows remote attackers to execute arbitrary code via a URL in the ROOT parameter.

SQL injection vulnerability in index.php of Beehive Forum 0.6.2 and earlier. Remote attackers can execute arbitrary SQL commands via the user_sess parameter.

A heap-based buffer overflow in VMware NAT networking components (vmnat.exe and vmnet-natd) in Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted EPRT and PORT FTP commands.

A vulnerability in UserProfile.cs in Ultraapps Issue Manager before version 2.1 allows remote authenticated users to escalate privileges to administrator by modifying the p_User_user_id and User_user_id parameters in UserProfile.aspx, then changing the password field.

A stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command ending with a '}' character, demonstrated using long LIST, LSUB, SEARCH TEXT, STATUS INBOX, AUTHENTICATE, FETCH, SELECT, and COPY commands.