CVE Vulnerability Catalog

An unknown vulnerability in the remshd daemon on HP-UX B.11.00, B.11.11, and B.11.23 running in Trusted Mode allows remote attackers to gain unauthorized system access via unknown attack vectors.

Macromedia Flash plugin (Flash.ocx 7.0.19.0 and earlier for Windows, libflashplayer.so before 7.0.25.0 for Unix) is vulnerable to a crash and potential arbitrary code execution via a crafted SWF file. The issue occurs when calling ActionDefineFunction in ActionScript, leading to improper memory access.

SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields in adminlogin.asp.

SQL injection vulnerability in admin.php in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privileges via the username field.

SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.

A vulnerability in Zone Labs (ZoneAlarm) software allows remote attackers to bypass the 'Advanced Program Control and OS Firewall filters' setting using URLs in HTML Modal Dialogs (window.location.href) embedded in JavaScript tags.

The envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.

A format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.

A buffer overflow vulnerability in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name and then executing the XPWD command.

SQL injection vulnerability in resetcore.php in e107 versions 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the a_name parameter or user field of the login page.

Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the INCLUDE_PATH, SQUIZLIB_PATH, and PEAR_PATH parameters in several script files.

Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via banner.php or the id parameter in print.php, comment.php, and news.php.

SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_searches parameter.

SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.

The vulnerability in the chfn tool in pwdutils version 3.0.4 and earlier on SuSE Linux (and possibly other operating systems) does not properly validate arguments for the GECOS field, allowing local users to gain privileges.

A vulnerability in ClamAV versions 0.80 through 0.87, in the FSG unpacker function (fsg.c), allows a remote attacker to cause memory corruption and execute arbitrary code via a crafted FSG 1.33 file.

A buffer overflow vulnerability in the swcons utility in IBM AIX 5.2, when debug malloc is enabled, allows remote attackers to cause a core dump and potentially execute arbitrary code.

Vulnerability in Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.

In Asus Video Security 3.5.0.0 and earlier, when using authorization, a buffer overflow occurs. A remote attacker can exploit a long username/password string to execute arbitrary code.

The libungif library before version 4.1.0 contains a memory corruption vulnerability via a crafted GIF file, which can lead to arbitrary code execution. The issue is caused by an out-of-bounds write.