CVE Vulnerability Catalog

The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.

Buffer overflow in the PopUp Plus 2.0.3.8 plugin for Miranda IM, with 'Use SmileyAdd Setting' enabled, allows remote attackers to execute arbitrary code.

A vulnerability in Maxthon 1.2.0 and 1.2.1 allows remote attackers to bypass the security ID and use restricted plugin API functions via a script that includes the max.src file into the source page.

The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.

Multiple buffer overflows in Lotus Domino Server 6.0.5 and 6.5.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via large amounts of data in certain time or date fields.

Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to less restrictive ACLs than intended by the administrator.

A vulnerability in Firefox before version 1.0.3 and Mozilla Suite before version 1.7.7 allows a remote attacker to execute arbitrary code via a javascript: URL that is executed when the user selects the 'Show javascript' option after a popup is blocked.

Multiple SQL injection vulnerabilities in VHCS 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via certain inputs from HTTP POST queries.

A vulnerability in loader.php of Ariadne CMS 2.4 that allegedly allows remote PHP code injection by modifying the ariadne parameter to point to a URL containing malicious code. The vendor disputes this, stating that loader.php first requires the ariadne.inc file which defines the $ariadne variable, preventing modification by an attacker. CVE personnel partially verified the dispute via source code inspection of Ariadne 2.4 as of July 5, 2005.

SQL injection vulnerability in the Knowledge Base module for phpBB in kb.php allows remote attackers to inject SQL queries via the cat parameter, potentially leading to sensitive information disclosure and arbitrary SQL command execution.

Vulnerability in Cisco IOS 12.2T, 12.3, and 12.3T involves improper processing of ISAKMP profile with XAUTH authentication after Phase 1 negotiation. A remote attacker can bypass XAUTH and proceed to Phase 2 negotiations.

The administration protocol in Kerio WinRoute Firewall 6.x up to 6.0.10, Personal Firewall 4.x up to 4.1.2, and MailServer up to 6.0.8 allows remote attackers to quickly obtain passwords that are 5 characters or less via brute force methods.

Buffer overflow in PMSoftware Simple Web Server 1.0 allows remote attackers to execute arbitrary code via a long GET request.

Vulnerability in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain, which is executed when the user visits that domain, aka 'Cross-site scripting through global scope pollution.'

Vulnerability in consoleConnect.jsp in Cyclades AlterPath Manager (APM) Console Server 1.2.1 allows remote attackers to connect to arbitrary consoles by modifying the consolename parameter.

The vulnerability in index.cgi of E-Cart 2004 version 1.1 and earlier allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters in the art and cat parameters.

The native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed, which causes the Javascript interpreter to continue execution at the wrong memory address, which may allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code by passing objects of the wrong type.

Mafia Blog .4 BETA does not properly protect the admin directory, which allows remote attackers to execute arbitrary PHP code by using writeinfo.php to inject the code into info.php.

Vulnerability in Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute malicious script, aka 'Firesearching 2.'

SQL injection vulnerability in the SYS.DBMS_CDC_IPUBLISH.CREATE_SCN_CHANGE_SET procedure in Oracle Database Server 10g allows remote attackers to execute arbitrary SQL commands via the CHANGE_SET_NAME parameter.