CVE Vulnerability Catalog

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.

Buffer overflow vulnerability in the KSDWRTB function of the dbms_system package in Oracle Database 9i and 8i. A remote authorized user can exploit a long second argument to execute arbitrary code on the database server.

SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action.

The vulnerability in CFPlugIn in the Core Foundation framework in Mac OS X allows user-supplied libraries to be loaded, which could allow local users to gain privileges.

A heap-based buffer overflow in the Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.

Stack-based buffer overflow in xvbmp.c in XV allows remote attackers to execute arbitrary code via a crafted image file.

Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) POP3 USER command or (2) SMTP request.

Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field.

SQL injection vulnerability in index.php of CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

Serv-U FTP server before version 5.1.0.0 has a default account and password for local administration. A local user can use this account to create a new user, log in as that user, and then execute arbitrary commands using the SITE EXEC command.

The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number of POST requests to /Search.

ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid characters that are not properly extracted.

The vulnerability in edituser.php3 in PHPMyChat 0.14.5 allows remote attackers to bypass authentication and gain administrative privileges by setting the do_not_login parameter to false.

Buffer overflow vulnerability in the IsValidFile function of the ADM ActiveX control in Altnet Download Manager 4.0.0.4 and earlier, used in Kazaa Media Desktop 1.3–2.6.4 and Grokkster 1.3–2.6, allows remote attackers to execute arbitrary code via a long bstrFilepath parameter.

A vulnerability in LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a server crash and client CPU consumption by sending a username starting with a percent sign (%) followed by a null character.

The exit_thread function in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows other processes to access the per-TSS pointers, access restricted memory locations, and possibly gain privileges.

A vulnerability in Check Point Firewall-1 versions 4.1 through NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an IKE packet with a specific Vendor ID payload, causing the firewall to respond with version and other details.

phpMyAdmin versions 2.5.1 through 2.5.7 contain a vulnerability that allows remote attackers to modify configuration settings by manipulating $cfg['Servers'] variables, potentially leading to unauthorized access to MySQL servers.

A vulnerability in NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the 'autorized=admin; root=admin' value.

Unknown vulnerability in IlohaMail before version 0.8.14-rc1 has unknown impact and attack vectors.