CVE Vulnerability Catalog

SQL injection vulnerability in search.php in phpBB versions 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter.

Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path.

Vulnerability in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to spoof a legitimate URL in the status bar. The attack uses a BASE element pointing to a legitimate site, an empty href attribute in an anchor element, and a form with an action pointing to a malicious URL, enabling phishing attacks.

Multiple SQL injection vulnerabilities in Tunez before 1.20-pre2 allow remote attackers to execute arbitrary SQL queries.

SQL injection vulnerability in PunkBuster Screenshot Database (PB-DB) Alpha 6 allows remote attackers to execute arbitrary SQL commands via the username and password fields of the login form. However, the original report contains several significant inconsistencies that make it unclear whether the report is accurate.

Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. The vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.

Vulnerability in OpenBSD 3.3 and 3.4 on big-endian 64-bit platforms (e.g., SPARC64) causes incorrect parsing of Accept and Deny rules without netmasks. This may allow remote attackers to bypass access restrictions.

Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow remote attackers to execute arbitrary code via an SSH2 packet with a base argument larger than the mod argument, and malicious servers to cause a denial of service or possibly execute arbitrary code via a large bignum during authentication.

Cross-site scripting (XSS) vulnerability in icq.cgi in Board Power 2.04PF allows remote attackers to inject arbitrary web script or HTML via the action parameter.

The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install the AuthenticationService setuid and writable by other users, which allows local users to gain privileges by modifying the program.

The vulnerability in the filediff tool in CVStrac allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters into the rcsinfo parameter.

A vulnerability in Microsoft Windows 2000, XP, and possibly 2003 allows local users with SeDebugPrivilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments. Note: this issue has been disputed, since Administrator privileges are typically required to exploit this issue, thus privilege boundaries are not crossed.

Vulnerability in Kerio Personal Firewall 2.1.5 allows local users to execute arbitrary code with SYSTEM privileges via the Load button in the Firewall Configuration Files option, which does not drop privileges before opening the file loading dialog box.

Cisco Secure Access Control Server (ACS) 3.2(3) and earlier spawns a separate unauthenticated TCP connection on a random port when a user authenticates to the ACS GUI, which allows remote attackers to bypass authentication by connecting to that port from the same IP address.

SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) versions 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the 'table' and 'field' parameters in LinkClick.aspx.

The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.

Format string vulnerability in the log function in SUS 2.0.2 and other versions before 2.0.6 allows local users to execute arbitrary code via format string specifiers in a command line argument that is passed directly to syslog.

Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -p command line argument. NOTE: it is not clear whether there are any standard configurations in which snmpd is installed setuid or setgid. If not, then this issue should not be included in CVE.

Integer overflow in Trillian 0.74 and earlier, and Trillian Pro 2.01 and earlier, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.

Omnicron OmniHTTPd version 3.0a and earlier contains a buffer overflow vulnerability in the handling of the Range header in HTTP GET requests. A remote attacker can exploit this to execute arbitrary code on the server.