CVE Vulnerability Catalog

The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp.

Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges.

Unknown vulnerability in the 32bit emulation code in Linux 2.4 on AMD64 systems allows local users to gain privileges.

Multiple heap-based buffer overflows in the imlib BMP image handler allow remote attackers to execute arbitrary code via a crafted BMP file.

An unknown vulnerability in Apache 2.0.51 prevents the merging of the Satisfy directive, which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.

A buffer overflow vulnerability in the uustat utility in Sun Solaris 8 and 9 allows local users to execute arbitrary code by providing a long -S command line argument.

Unknown vulnerability in IBM Parallel Environment (PE) 3.2 and 4.1 allows attackers to execute arbitrary commands as root via unknown vectors in the sample code.

A buffer overflow vulnerability exists in the vsybase.c library of vpopmail version 5.4.2 and earlier. This could allow an attacker to cause a denial of service or execute arbitrary code.

Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary SQL commands via the FID parameter in board.php, sortorder/perpage/id parameters in member.php, forums parameter in search.php, and PID/FID parameters in post.php.

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.

A heap-based buffer overflow in the Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.

Heap-based buffer overflow in in_mod.dll in Nullsoft Winamp 2.91 through 5.02 allows remote attackers to execute arbitrary code via a Fasttracker 2 (.xm) mod media file.

Unknown vulnerability in F-Secure Anti-Virus (FSAV) 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV.

SQL injection vulnerability in index.cfm of CFWebstore 5.0 allows remote attackers to execute arbitrary SQL commands via category_id, product_id, or feature_id parameters.

Vulnerability in Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options handled by iftpmgr.exe.

Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the ALLO handler, or may allow remote FTP administrators to execute arbitrary code by causing a long hostname or username to be inserted into a reply to a STAT command while a file is being transferred.

Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) POP3 USER command or (2) SMTP request.

SQL injection vulnerability in DUware DUforum versions 3.0 through 3.1. Allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, MSG_ID parameter in messageDetail.asp, or password parameter in the login form.

SQL injection vulnerability in the compose message form in HELM 3.1.19 and earlier. An attacker can remotely execute arbitrary SQL commands via the messageToUserAccNum parameter.

Stack-based buffer overflow in xvbmp.c in XV allows remote attackers to execute arbitrary code via a crafted image file.