CVE Vulnerability Catalog

Buffer overflow vulnerability in Golden FTP Server Pro (goldenftpd) 2.x allows remote attackers to execute arbitrary code via a long RNTO command.

The vulnerability in Enscript 1.6.3 is due to the lack of filename sanitization, allowing remote attackers or local users to execute arbitrary commands via crafted filenames.

Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.

Multiple buffer overflows in YaMT before version 0.5_2 allow attackers to execute arbitrary code via the rename or sort options.

SQL injection vulnerability in Oracle Database 9i and 10g allows remote attackers to execute arbitrary SQL commands and gain privileges.

AWStats 6.1 and versions before 6.3 allow remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to awstats.pl.

In PHP Gift Registry (phpGiftReg) 1.4.0 and possibly earlier versions before 1.5.0b1, multiple SQL injection vulnerabilities exist in index.php. Remote attackers can execute arbitrary SQL commands via the messageid, shopper, shopfor, or itemid parameters.

A vulnerability in the NETGEAR FVS318 router running firmware version 2.4, and possibly other versions, allows remote attackers to bypass filters by using hex-encoded URLs, for example by encoding a file extension.

Vulnerability in the inpview tool in SGI IRIX allows local users to execute arbitrary commands via the SUN_TTSESSION_CMD environment variable, which is executed by inpview without dropping privileges.

Stack-based buffer overflow in the websql CGI program in MySQL MaxDB 7.5.00 allows remote attackers to execute arbitrary code via a long password parameter.

PHP remote file inclusion vulnerability in SGallery 1.01 allows attackers to execute arbitrary PHP code by modifying the DOCUMENT_ROOT parameter to reference a URL on a remote server containing config.php or sql_layer.php.

Buffer overflow in mpg123 before 0.59s-r9 allows remote attackers to execute arbitrary code via frame headers in MP2 or MP3 files.

The Indexing Service in Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.

In Veritas Backup Exec versions 8.x before 8.60.3878 Hotfix 68 and 9.x before 9.1.4691 Hotfix 40, the Agent Browser component contains a stack-based buffer overflow. A remote attacker can exploit this vulnerability by sending a registration request with a long hostname, allowing arbitrary code execution.

Woltlab Burning Book 1.0 Gold, 1.1.1e, and possibly other versions contain an SQL injection vulnerability in addentry.php. Remote attackers can execute arbitrary SQL commands via the user-agent parameter.

An integer overflow in the real_setup_and_get_header function in real.c for Unix MPlayer 1.0pre5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a Real RTSP streaming media file with a -1 content-length field, which leads to a heap-based buffer overflow.

In MPlayer 1.0pre5 for Unix, a heap-based buffer overflow vulnerability was discovered in the demux_open_bmp function in demux_bmp.c. An attacker can remotely execute arbitrary code by sending a specially crafted BMP file with a large biClrUsed field.

The id3tag_sort function in id3tag.c in YAMT 0.5 allows remote attackers to execute arbitrary commands via an MP3 file with double quotes in the Artist tag.

Buffer overflow in the open_aiff_file function in demux_aiff.c for xine-lib (libxine) 1-rc7 allows remote attackers to execute arbitrary code via a crafted AIFF file.

Buffer overflow in the get_attr function in html.c for vilistextum 2.6.6 allows remote attackers to execute arbitrary code via a crafted web page.