CVE Vulnerability Catalog

PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an 'ftp://' URL in the alpath parameter, which bypasses the incomplete blacklist that only checks for 'http' and 'https' URLs.

A heap-based buffer overflow in the Sophos Antivirus Library allows remote attackers to execute arbitrary code via a crafted Visio file with a modified sub record length.

PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the custom_welcome_page parameter.

A format string vulnerability in simpleproxy before version 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string specifiers in a reply.

A vulnerability in the Red Hat Enterprise Linux 3 kernel, in the init_dev function in tty_io.c, results from improper clearing of controlling ttys in multi-threaded applications. A local user can exploit this flaw to cause a system crash (denial of service) and potentially gain tty access through attacks that trigger a pointer to a freed structure.

Vulnerability in phpldapadmin before version 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set.

Vulnerability in lockmail in maildrop before version 1.5.3. The program does not drop privileges before executing commands, allowing local users to gain privileges via command line arguments.

A vulnerability in Symantec AntiVirus 9 Corporate Edition allows local users to gain privileges via the 'Scan for viruses' option, which launches a help window with raised privileges. This is a reintroduction of a vulnerability originally identified and addressed in CVE-2002-1540.

SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the username value in the pafiledbcookie cookie.

Stack-based buffer overflow in the ACE archive decompression library (vrAZace.dll) in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall, when compressed file scanning is enabled, allows remote attackers to execute arbitrary code via an ACE archive that contains a file with a long filename.

The vulnerability in upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code.

The HTTP proxy in Astaro Security Linux 6.0 does not properly filter HTTP CONNECT requests to localhost, which allows remote attackers to bypass firewall rules and connect to local services.

PHP remote file inclusion vulnerability in WebCalendar before version 1.0.1. An attacker can remotely execute arbitrary PHP code when opening settings.php, possibly via send_reminders.php or other scripts.

The event_pin_code_request function in the btsrv daemon (btsrv.c) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name.

A buffer overflow vulnerability in ad_pcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via crafted PCM audio data, as demonstrated using a video file with an audio header containing a large value in a stream format (strf) chunk.

SQL injection vulnerability in search.php of MyBulletinBoard (MyBB) versions 1.00 Release Candidate 1 through 4. A remote attacker can execute arbitrary SQL commands via the uid parameter.

A buffer overflow vulnerability in WinAce 2.6.0.5 and possibly earlier versions allows remote attackers to execute arbitrary code via a temporary (.tmp) file containing an entry with a long file name.

The vulnerability in includes/common.php in RunCMS 1.2 and earlier uses the extract function with EXTR_OVERWRITE on HTTP POST variables, allowing remote attackers to overwrite arbitrary variables, potentially leading to arbitrary code execution.

SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via a direct request to admin/PhpMyExplorer/editerfichier.php, then editing the desired file to contain the PHP code, as demonstrated using header.php in the fichier parameter. NOTE: it is possible that this vulnerability stems from PhpMyExplorer, which is a separate package.

Multiple SQL injection vulnerabilities in RunCMS 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the addquery and subquery parameters in the newbb plus module, the forum parameter in newtopic.php, edit.php, and reply.php of the newbb plus module, and the msg_id parameter in print.php of the messages module.