CVE Vulnerability Catalog

Stack-based buffer overflow in the IMAP daemon (IMAPD32.EXE) in IMail 8.13 and earlier versions before IMail Server 8.2 Hotfix 2 allows remote authenticated users to execute arbitrary code via a STATUS command with a long mailbox name.

Unknown vulnerability in MailScanner 4.41.3 and earlier, related to incomplete reporting of viruses in zip files, allows remote attackers to bypass virus detection.

GDB before version 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running GDB.

Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (1) name or (2) module parameter.

The vulnerability in PROMS version 0.11 is due to improper handling of certain combinations of rights, resulting in users being granted more privileges than intended.

Unknown vulnerability in Blue Coat Reporter before 7.1.2 allows remote unauthenticated attackers to add a license.

Unknown vulnerability in Serendipity 0.8, when used with multiple authors, allows unprivileged authors to upload arbitrary media files.

Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for viruses, which does not return an error code and prevents viruses from being detected.

Format string vulnerability in the logPrintBadfile function in delbadfiles.c in Iron Bars SHell (ibsh) before 0.3d allows users to access files outside the home directory and possibly execute arbitrary code via certain inputs that are not properly handled in a syslog call.

Vulnerability in the fixproc tool of Net-snmp versions 5.x before 5.2.1-r1 causes insecure creation of temporary files. A local user can modify the contents of these files to execute arbitrary commands or overwrite arbitrary files via a symlink attack.

SQL injection vulnerability in the Xanthia module for PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga[0] parameter in pnadmin.php.

An unknown vulnerability in ALWIL avast! antivirus version 4 (4.6.6230) and earlier, running on Windows NT 4.0, causes improper detection of certain viruses.

A format string vulnerability in Warrior Kings: Battles 1.23 and earlier and Warrior Kings 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname.

Multiple unknown vulnerabilities in PROMS 0.11 allow non-authorized users to view or modify the project member list or modify the todos list.

SQL injection vulnerability in PortailPHP 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in the News, File, Liens, or Faq modules.

Multiple SQL injection vulnerabilities in PROMS before version 0.11 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

Integer overflow vulnerability in Computer Associates Vet Antivirus library allows remote attackers to gain elevated privileges by sending a crafted compressed VBA directory with a project name length of -1, leading to a heap-based buffer overflow.

The vulnerability in BEA WebLogic Server and WebLogic Express versions 8.1 through Service Pack 3 and 7.0 through Service Pack 5 involves improper handling of exceptions thrown by a security provider. This may result in using an incorrect identity for the thread or failing to audit security exceptions.

A format string vulnerability in gxine versions 0.3 through 0.4.4 allows remote attackers to execute arbitrary code via a crafted RAM file where the URL hostname contains format string specifiers.

Unknown vulnerability in Groove Virtual Office before version 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 allows remote attackers to bypass restrictions on COM objects.