CVE Vulnerability Catalog

The IKEv1 implementation in Openswan 2 before 2.4.4 and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23 allows remote attackers to cause a denial of service via a crafted packet using 3DES with an invalid key length or unspecified inputs when Aggressive Mode is enabled and the PSK is known.

Unquoted Windows search path vulnerability in Kaspersky Anti-Virus 5.0 might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder.

A heap-based buffer overflow in the Kaspersky Anti-Virus Engine, used in Kaspersky Personal 5.0.227, Anti-Virus On-Demand Scanner for Linux 5.0.5, and F-Secure Anti-Virus for Linux 4.50, allows remote attackers to execute arbitrary code via a crafted CHM file.

Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.

An unquoted Windows search path vulnerability in Microsoft Antispyware 1.0.509 (Beta 1) might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder, involving the programs GIANTAntiSpywareMain.exe, gcASNotice.exe, gcasServ.exe, gcasSWUpdater.exe, or GIANTAntiSpywareUpdater.exe.

Lynx versions before 2.8.6dev.15 allow remote attackers to execute arbitrary system commands via lynxcgi:, lynxexec, and lynxprog links, which are not properly restricted in the default configuration in some environments.

Multiple directory traversal vulnerabilities in Tikiwiki before version 1.9.1 allow remote attackers to read arbitrary files and execute commands via the suck_url parameter to tiki-editpage.php or the language parameter to tiki-user_preferences.php.

Unquoted Windows search path vulnerability in RealPlayer allows local users to gain privileges via a malicious C:\program.exe file.

An unquoted Windows search path vulnerability in VMWare Workstation 5.0.0 build-13124 might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder.

A vulnerability in the gdk-pixbuf library of GTK+ before version 2.8.7 allows an attacker to cause an infinite loop via a crafted XPM image with a large number of colors, leading to a denial of service (DoS).

Stack-based buffer overflow in a shared library used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterprise Server 5.0 MP1 to MP5 and 5.1 up to MP3A allows remote attackers to execute arbitrary code via a crafted packet.

An integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values.

Vulnerability in iTunesHelper.exe in iTunes 4.7.1.30 and iTunes 5 for Windows due to an unquoted Windows search path. A local user can exploit a malicious C:\program.exe file to escalate privileges.

The CodeSupport.ocx ActiveX control, used by Sony to uninstall the First4Internet XCP DRM, has 'safe for scripting' enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode.

Multiple SQL injection vulnerabilities in the get_record function in datalib.php in Moodle 1.5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in category.php and info.php.

Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in logout.php and index.php.

The vulnerability in the PNP_GetDeviceList (upnp_getdevicelist) function in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows a remote attacker to cause a denial of service (DoS) through excessive memory consumption. The attack involves sending a DCE RPC request with a large output buffer size.

PHP file inclusion vulnerability in the osTicket module in Help Center Live before 2.0.3 allows remote attackers to access or include arbitrary files via the 'file' parameter, possibly due to a directory traversal vulnerability.

Vulnerability in IBM Informix Dynamic Database server on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account by supplying an invalid username.

IBM DB2 database server running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account without supplying a password.