CVE Vulnerability Catalog

Multiple unknown vulnerabilities have been discovered in Online Recruitment Agency 1.0. Their impact and attack vectors are unspecified.

SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.

SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.

Multiple overflows in the io_edgeport driver for Linux kernel 2.4.x have unknown impact and unknown attack vectors.

Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.

Unknown vulnerability in ignitionServer 0.1.2 through 0.3.1, with the linking service enabled, allows remote attackers to bypass authentication.

Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Editing Component (DEC) and Javascript that calls showModalDialog.

An unknown vulnerability in Hitachi Job Management Partner (JP1) JP1/File Transmission Server/FTP versions 6 and 7 on HP-UX in trusted mode allows attackers to bypass authentication and gain administrator rights.

The vulnerability in login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.

The DSS verification code in Dropbear SSH Server before version 0.43 frees uninitialized variables, which might allow remote attackers to gain access.

The print-from-email feature in Canon ImageRUNNER 5000i and C3200 allows remote attackers to print arbitrary text without authentication by sending a text/plain email to TCP port 25, when IP address range filtering is not used.

Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the 'product' parameter in showproduct.php or the 'cat' parameter in showcat.php.

Multiple buffer overflows in LaTeX2rtf 1.9.15 and possibly other versions allow remote attackers to execute arbitrary code via the expandmacro function, and possibly Environments and TranslateCommand.

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the eid or cid parameters.

SQL injection vulnerability in post.php in Invision Power Board (IPB) versions 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.

A format string vulnerability in smtp.c in smtp.proxy version 1.1.3 and earlier allows remote attackers to execute arbitrary code by injecting format string specifiers into the client hostname or message-id, which are then processed in a syslog message.

PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_path parameter to reference a URL on a remote web server that contains the code.

SQL injection vulnerability in the ibProArcade module for Invision Power Board (IPB) versions 1.x and 2.x. Remote attackers can execute arbitrary SQL commands via the 'cat' parameter in index.php.

SQL injection vulnerability in index.php in miniBB 1.7f and earlier allows remote attackers to execute arbitrary SQL commands via the 'user' parameter in a 'userinfo' action.

A buffer overflow in ADA Image Server (ImgSvr) 0.4 allows remote attackers to cause a denial of service (web server crash) or execute arbitrary code via a long GET request.