CVE Vulnerability Catalog

SQL injection vulnerability in module/down.inc.php in jportal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the search field to download.php.

SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitrary SQL commands via the phrase field.

Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.

Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.

Vulnerability in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with 'zero-width non-joiner' characters.

A stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.

The Compuware DriverStudio Remote Control service (DSRsvc.exe) versions 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.

A buffer overflow vulnerability in vxTftpSrv 1.7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TFTP request with a long filename argument.

A buffer overflow vulnerability in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code by sending a long USER name.

The vulnerability in the miniserv.pl script in Webmin before version 1.230 and Usermin before version 1.160, when 'full PAM conversations' is enabled, allows a remote attacker to bypass authentication by spoofing session IDs using certain metacharacters (line feed or carriage return).

SQL injection vulnerability in AddItem.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idOption_Dropdown_2 parameter.

SQL injection vulnerability in infopage.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idPage parameter.

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in different scripts.

Multiple SQL injection vulnerabilities in vBulletin before version 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.

Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in scripts like announcement.php, thread.php, user.php, and others.

A stack-based buffer overflow vulnerability exists in AhnLab V3Pro 2004, V3 VirusBlock 2005, and V3Net for Windows Server 6.0 (all build 6.0.0.383). A remote attacker can exploit a long filename in an ACE archive to execute arbitrary code.

Multiple unspecified vulnerabilities have been discovered in the WYSIWYG editor in PHP-Nuke before version 7.9 Final. Their impact and attack vectors are unknown.

Vulnerability in Tofu 0.2 allows remote attackers to execute arbitrary Python code via crafted pickled objects, which Tofu unpickles and executes.

A vulnerability in Helpdesk Software Hesk allows remote attackers to bypass authentication for admin.php and admin_main.php by modifying the PHPSESSID session ID parameter or cookie.

SQL injection vulnerability in index.php in NooTopList 1.0.0 release 17. Remote attackers can execute arbitrary SQL commands via the 'o' or 'sort' parameters.