CVE Vulnerability Catalog

WebEOC before version 6.0.2 does not properly check user authorization, allowing remote attackers to gain privileges via a direct request to a resource.

WebEOC before version 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords.

Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain valid TCP or UDP request.

Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename argument of a PUT command.

Vulnerability in Firefox before version 1.0.5 allows remote attackers to steal information and potentially execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.

Multiple unknown vulnerabilities have been discovered in Jinzora 2.0.1, with unknown impact and attack vectors, possibly involving a PHP file inclusion vulnerability.

Buffer overflow vulnerability in the Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary code via a long filename in an OBEX file share.

Vulnerability in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 involves improper verification of DOM node name types within the context of their namespaces. This allows a remote attacker to modify tag properties, potentially leading to arbitrary script or code execution, as demonstrated using an XHTML document with IMG tags with custom properties.

Vulnerability in Firefox before version 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the sidebar using the _search target, then injecting script into other pages via a data: URL.

Vulnerability in Firefox, Thunderbird, Mozilla, Netscape, and K-Meleon browsers allows XBL scripts to run even when JavaScript is disabled. A remote attacker can exploit this flaw to bypass script protection.

The vulnerability in Firefox before version 1.0.5 and Mozilla before version 1.7.9 is due to improper cloning of base objects. A remote attacker can exploit the prototype chain to access a privileged object and execute arbitrary code.

The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.

The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including USANet Shopping Mall Software, Domain Name Auction Software, Standard Classified Ads Software, and MakeBid Reverse Auction, allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.

The saveProfile function in PhpSlash 0.8.0 allows remote attackers to modify arbitrary profiles and gain privileges by modifying the author_id parameter.

PHP remote file inclusion vulnerability in secure.php in PHPSecurePages (phpSP) 0.28beta and earlier allows remote attackers to execute arbitrary code via the cfgProgDir parameter.

PHP remote file inclusion vulnerability in photolist.inc.php in Squito Gallery 1.33 allows remote attackers to execute arbitrary code via the photoroot parameter.

SQL injection vulnerability in PhpAuction 2.5 allows remote attackers to modify SQL queries via the 'category' parameter in adsearch.php.

PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTION_RM_ID cookie to the user ID.

Unknown vulnerability in the arshell tool in the Array Service (arrayd) for SGI ProPack 3 with SP 5 and 6, and SGI ProPack 4, allows local users to execute arbitrary shells as root on other hosts in the cluster or array.

A stack-based buffer overflow in Microsoft Word 2000 and Word 2002, and Microsoft Works Suites 2000 through 2004, might allow remote attackers to execute arbitrary code via a .doc file with long font information.