CVE Vulnerability Catalog

SQL injection vulnerability in search.php in phpBB versions 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter.

The password generation in Mailman before version 2.1.5 generates only 5 million unique passwords, making it easier for remote attackers to guess passwords via a brute force attack.

SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the username and password parameters.

Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path.

WHM AutoPilot 2.4.6.5 and earlier contain multiple PHP remote file inclusion vulnerabilities in step_one.php, step_one_tables.php, and step_two_tables.php. These flaws allow an attacker to execute arbitrary PHP code by modifying the server_inc parameter to reference a URL on a remote server containing malicious code.

SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter in the recentTopics and welcome functions.

Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Editing Component (DEC) and Javascript that calls showModalDialog.

Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -p command line argument. NOTE: it is not clear whether there are any standard configurations in which snmpd is installed setuid or setgid. If not, then this issue should not be included in CVE.

Vulnerability in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to spoof a legitimate URL in the status bar. The attack uses a BASE element pointing to a legitimate site, an empty href attribute in an anchor element, and a form with an action pointing to a malicious URL, enabling phishing attacks.

Omnicron OmniHTTPd version 3.0a and earlier contains a buffer overflow vulnerability in the handling of the Range header in HTTP GET requests. A remote attacker can exploit this to execute arbitrary code on the server.

Multiple SQL injection vulnerabilities in Tunez before 1.20-pre2 allow remote attackers to execute arbitrary SQL queries.

Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows.

SQL injection vulnerability in PunkBuster Screenshot Database (PB-DB) Alpha 6 allows remote attackers to execute arbitrary SQL commands via the username and password fields of the login form. However, the original report contains several significant inconsistencies that make it unclear whether the report is accurate.

Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. The vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.

Vulnerability in OpenBSD 3.3 and 3.4 on big-endian 64-bit platforms (e.g., SPARC64) causes incorrect parsing of Accept and Deny rules without netmasks. This may allow remote attackers to bypass access restrictions.

PHP remote file inclusion vulnerability in index.php of Php-Nuke versions 6.x through 7.3. A remote attacker can modify the modpath parameter to point to a URL on a remote server containing malicious PHP code, allowing arbitrary code execution on the server.

Multiple stack-based and heap-based buffer overflows in EnderUNIX spamGuard before version 1.7-BETA were found. Vulnerabilities exist in the qmail_parseline and sendmail_parseline functions in parser.c, loadconfig and removespaces functions in loadconfig.c, and possibly unspecified functions in functions.c, allowing remote attackers to execute arbitrary code.

Vulnerability in hfaxd in HylaFAX before version 4.2.1, when installed with a weak hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted username or hostname that satisfies a regular expression matched against a hosts.hfaxd entry without a password.

Multiple SQL injection vulnerabilities in VP-ASP Shopping Cart versions 4.0 through 5.0 allow remote attackers to execute arbitrary SQL commands via the catalogid parameter in shopreviewlist.asp and shopreviewadd.asp.

The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install the AuthenticationService setuid and writable by other users, which allows local users to gain privileges by modifying the program.