CVE Vulnerability Catalog

The vulnerability in Mason before version 1.0.0 is that after configuring a firewall using this tool, the init script is not installed. As a result, the firewall is not activated after a system reboot.

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.

The SECEDIT command on Microsoft Windows 2000 before Update Rollup 1 for SP4, when using a security template to set Access Control Lists (ACLs) on folders, does not apply ACLs on folders that are listed after a long folder entry, which could result in less secure permissions than specified by the template.

Multiple SQL injection vulnerabilities in PHP-Fusion before version 6.00.110 allow remote attackers to execute arbitrary SQL commands via the activate parameter in register.php and the cat_id parameter in faq.php.

Multiple SQL injection vulnerabilities were found in the photogallery.php script in PHP-Fusion. A remote attacker can manipulate the 'album' and 'photo' parameters to execute arbitrary SQL commands on the database.

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the pm_email_notify and pm_save_sent parameters. This is a different vulnerability than CVE-2005-3157 and CVE-2005-3159.

SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msg_view parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158.

A vulnerability in Microsoft Windows 2000 before Update Rollup 1 for SP4 allows a local administrator to unlock a computer even if it has been locked by a domain administrator, enabling the local administrator to access the session as the domain administrator.

A vulnerability in Microsoft Windows 2000 before Update Rollup 1 for SP4 causes the IP address of a Terminal Services client not to be recorded in the security log after a successful connection. This makes it easier for attackers to evade detection.

A buffer overflow vulnerability in the W3C logging of MailEnable Enterprise 1.1 and Professional 1.6 allows remote attackers to execute arbitrary code.

Format string vulnerability in the logging functionality in BitDefender AntiVirus 7.2 through 9 allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in file or directory name.

Format string vulnerability in the Log_Flush function in Weex 2.6.1.5, 2.6.1, and possibly other versions allows remote FTP servers to execute arbitrary code via format strings in filenames.

The vulnerability in login.php of myBloggie 2.1.3 beta and earlier allows an attacker to bypass a whitelist check using a null character in the username parameter, enabling SQL injection. Although the whitelist check succeeds, the null character injects SQL into the query.

Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument.

Heap-based buffer overflow in Kaspersky Antivirus 5.0 and Kaspersky Personal Security Suite 1.1 allows remote attackers to execute arbitrary code via a CAB file with large records after the header.

The vulnerability in Procom NetFORCE 800 version 4.02 M10 Build 20 (and possibly other versions) causes the NIS password map (passwd.nis) to be sent as a file attachment in diagnostic email messages, allowing remote attackers to obtain cleartext NIS password hashes.

Buffer overflow vulnerability in the get_string_ahref function of ProZilla 1.3.7.4 and possibly earlier versions, with the -ftpsearch option enabled. A remote server can execute arbitrary code by sending a crafted string in the HREF field of an <A> tag in a search response.

Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values, which lead to a heap-based buffer overflow.

SQL injection vulnerability in lucidCMS 1.0.11 allows remote attackers to execute arbitrary SQL commands via the login field.

Vulnerability in Citrix Metaframe Presentation Server 3.0 and 4.0 allows remote attackers to bypass policy restrictions by downloading the launch.ica file and changing the client device name (ClientName).