CVE Vulnerability Catalog

A buffer overflow in the POP3 server of 1st Class Mail Server 4.0 via an APOP USER command with a long second parameter (digest) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.

Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument.

Buffer overflow in SlimFTPd 3.15 and earlier allows local users to execute arbitrary code via a long command, such as CWD, STOR, MKD, and STAT.

A buffer overflow vulnerability in the logging component of CCProxy allows remote attackers to execute arbitrary code via a long HTTP GET request.

Vulnerability in JSSE 1.0.3 through 1.0.3_2 causes improper validation of the client or server certificate chain, allowing a remote attacker to falsely authenticate peers for SSL/TLS.

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.

Vulnerability in Online-bookmarks before version 0.4.6 allows remote attackers to bypass the authentication mechanism via direct requests to configuration files or PHP scripts such as config/*, bookmarks.php, footer.php, main.php, tree.php, or functions.php.

A stack-based buffer overflow in the site chmod command in Serv-U FTP Server before version 4.2 allows remote attackers to execute arbitrary code via a long filename.

A buffer overflow vulnerability in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.

Unknown vulnerability in Moodle before version 1.2 allows teachers to log in as administrators.

SQL injection vulnerability in NatterChat 1.12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in DUware DUforum versions 3.0 through 3.1. Allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, MSG_ID parameter in messageDetail.asp, or password parameter in the login form.

Multiple vulnerabilities were found in the H.323 protocol implementation in First Virtual Communications products (Click to Meet Express, Premier, Conference Server, and V-Gate). A remote attacker can exploit these flaws to cause a denial of service (DoS), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.

Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow remote attackers to execute arbitrary code via an SSH2 packet with a base argument larger than the mod argument, and malicious servers to cause a denial of service or possibly execute arbitrary code via a large bignum during authentication.

SQL injection vulnerability in bug.php in phpBugTracker 0.9.1 allows remote attackers to execute arbitrary SQL commands via the bug_id parameter (viewvotes operation) or the project parameter (add operation).

Vulnerability in Hired Team: Trial 2.0 and earlier and version 2.200 allows game players to kick other players off the server, including the administrator, without any restrictions.

The vulnerability in init.php of WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the user_inc parameter.

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the eid or cid parameters.

SQL injection vulnerability in post.php in Invision Power Board (IPB) versions 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.

PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_path parameter to reference a URL on a remote web server that contains the code.