CVE Vulnerability Catalog

ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid characters that are not properly extracted.

phpMyAdmin versions 2.5.1 through 2.5.7 contain a vulnerability that allows remote attackers to modify configuration settings by manipulating $cfg['Servers'] variables, potentially leading to unauthorized access to MySQL servers.

Serv-U FTP server before version 5.1.0.0 has a default account and password for local administration. A local user can use this account to create a new user, log in as that user, and then execute arbitrary commands using the SITE EXEC command.

Unknown vulnerability in IlohaMail before version 0.8.14-rc1 has unknown impact and attack vectors.

The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number of POST requests to /Search.

The exit_thread function in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows other processes to access the per-TSS pointers, access restricted memory locations, and possibly gain privileges.

Buffer overflow vulnerability in the IsValidFile function of the ADM ActiveX control in Altnet Download Manager 4.0.0.4 and earlier, used in Kazaa Media Desktop 1.3–2.6.4 and Grokkster 1.3–2.6, allows remote attackers to execute arbitrary code via a long bstrFilepath parameter.

Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the HandleCPCCommand function.

Stack-based buffer overflow in Trillian 0.71 through 0.74f and Trillian Pro 1.0 through 2.01 allows remote attackers to execute arbitrary code via a Yahoo Messenger packet with a long key name.

The Telnet listener for Novell iChain Server before version 2.2 Field Patch 3b 2.2.116 does not have a password by default, which allows remote attackers to gain access.

A vulnerability in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper objects and a shortcut (link) to execute the target script.

SQL injection vulnerability in Ansel 2.1 and earlier allows remote attackers to modify SQL statements via the image parameter.

Unknown vulnerability in the 'admin of paypal email addresses' in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors.

Unknown vulnerability in Moodle before version 1.3.3, related to language settings, has unknown impact and attack vectors.

SQL injection vulnerability in tttadmin/settings.php of Turbo Traffic Trader PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the ttt_admin parameter.

SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

SQL injection vulnerability in pmwh.php of PHPMyWebHosting version 0.3.4 and earlier. A remote attacker can modify SQL queries via the 'password' parameter.

Unknown vulnerability in Adminedit.pl in YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.

Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php.

The vulnerability in UUDeview 0.5.20 and earlier is due to insecure handling of temporary files during decoding. The attack vectors and impact are unknown.