CVE Vulnerability Catalog

A vulnerability in Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via text strings that are not null terminated, which triggers a null dereference.

Multiple SQL injection vulnerabilities in DCP-Portal 6.1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the lcat, doc, or uid parameters to index.php, or (2) the mid or bid parameters to forums.php.

A vulnerability in the Linux kernel 2.6 before version 2.6.11 allows a local user to gain elevated privileges by injecting mouse or keyboard events into other user sessions. The issue is due to missing access restrictions on the N_MOUSE line discipline for a TTY.

Vulnerability in AS/400 Telnet 5250 terminal emulation clients (IBM Client Access, Bosanova, PowerTerm, Mochasoft, and others) allows malicious AS/400 servers to execute arbitrary commands on the client workstation. The attack uses a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC Command), e.g., to create a backdoor account via REXEC.

SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter.

PHP remote file inclusion vulnerability in shoutact.php for TKai's Shoutbox allows remote attackers to execute arbitrary PHP code via the query parameter.

Multiple buffer overflows in Cain & Abel before version 2.67 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via (1) an IKE packet with a large ID field that is not properly handled by the PSK sniffer filter, (2) the HTTP sniffer filter, or the (3) POP3, (4) SMTP, (5) IMAP, (6) NNTP, or (7) TDS sniffer filters.

SQL injection vulnerability in NotifyLink before version 3.0 allows remote attackers to execute arbitrary SQL commands via the URL.

Lightspeed DeluxeFTP 6.01 stores usernames and passwords in plaintext in sites.xml, which is world-readable, allowing local users to gain privileges.

A buffer overflow vulnerability in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, also known as the 'URL Parsing Memory Corruption Vulnerability.'

A buffer overflow vulnerability in the decode_post function in ELOG before version 2.5.7 allows remote attackers to execute arbitrary code via attachments with long file names.

SQL injection vulnerability in index.php for zOOm Media Gallery 2.1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

The vulnerability in Mac OS X 10.3.9 and earlier allows users to install, create, and execute scripts with setuid/setgid bits set, contrary to the intended design. This may allow attackers to conduct unauthorized activities with escalated privileges via vulnerable scripts.

Multiple buffer overflows in RUMBA 7.3 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted values in a profile file, as demonstrated using a long SysName field.

CoolForum 0.8.1 beta and earlier allows remote attackers to manipulate SQL commands via certain requests to alert.php or viewip.php, possibly due to a SQL injection vulnerability.

Buffer overflow in command.C in rxvt-unicode before version 5.3 allows remote attackers to execute arbitrary code via a crafted file containing long escape sequences.

Belkin 54G (F5D7130) wireless router allows remote attackers to access restricted resources by sniffing URIs from UPNP datagrams, then accessing those URIs, which do not require authentication.

The reportpost action in misc.php of PhotoPost PHP 5.0 RC3 does not limit the logging data sent to the administrator, allowing remote attackers to send large amounts of email to the administrator.

Buffer overflow in luxman before version 0.41, when used with certain insecure svgalib libraries, allows local users to execute arbitrary code via a long -f command line argument.

Buffer overflow vulnerability in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM command.