CVE Vulnerability Catalog

Vulnerability in JSSE 1.0.3 through 1.0.3_2 causes improper validation of the client or server certificate chain, allowing a remote attacker to falsely authenticate peers for SSL/TLS.

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.

Vulnerability in Online-bookmarks before version 0.4.6 allows remote attackers to bypass the authentication mechanism via direct requests to configuration files or PHP scripts such as config/*, bookmarks.php, footer.php, main.php, tree.php, or functions.php.

A stack-based buffer overflow in the site chmod command in Serv-U FTP Server before version 4.2 allows remote attackers to execute arbitrary code via a long filename.

A buffer overflow vulnerability in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.

Unknown vulnerability in Moodle before version 1.2 allows teachers to log in as administrators.

SQL injection vulnerability in NatterChat 1.12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in DUware DUforum versions 3.0 through 3.1. Allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, MSG_ID parameter in messageDetail.asp, or password parameter in the login form.

Unknown vulnerability in IBM Parallel Environment (PE) 3.2 and 4.1 allows attackers to execute arbitrary commands as root via unknown vectors in the sample code.

A buffer overflow vulnerability exists in the vsybase.c library of vpopmail version 5.4.2 and earlier. This could allow an attacker to cause a denial of service or execute arbitrary code.

Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) POP3 USER command or (2) SMTP request.

Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field.

SQL injection vulnerability in index.php of CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

Stack-based buffer overflow in xvbmp.c in XV allows remote attackers to execute arbitrary code via a crafted image file.

Multiple unknown vulnerabilities in IBM Lotus Notes 6.5.x before 6.5.4 and 6.0.x before 6.0.5, related to Java applets, have unknown impact and attack vectors, identified as (1) KSPR5YS6GR and (2) KSPR62F4D3.

SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication via the login or password fields. This issue was later reported to also affect firmware 4.0.34.

SQL injection vulnerability in DMXReady Site Chassis Manager allows remote attackers to execute arbitrary SQL commands via unknown vectors.

The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitrary scripts.

Unknown vulnerability in the 'access code' in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.

SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to inject SQL code via the catcode parameter, potentially leading to unauthorized access and privilege escalation.