CVE Vulnerability Catalog

The vulnerability in PHP-Nuke 7.3 and related systems (Nuke Cops betaNC, OSCNukeLite 3.1, OSC2Nuke 7x) results from improper use of the eregi() function with $_SERVER['PHP_SELF'] to identify the calling script. This allows a remote attacker to directly access scripts, obtain path information via a PHP error message, and potentially gain access, for example through an HTTP request containing the string "admin.php".

The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, allowing local users to execute arbitrary code via a 'Shatter' style attack using a Windows message.

Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code.

Buffer overflow in Microsoft Jet Database Engine 4.0 allows remote attackers to execute arbitrary code via a specially-crafted database query.

There is a stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of Microsoft Windows, allowing remote attackers to execute arbitrary code.

CVE-2004-0385 involves a heap-based buffer overflow in the Web Cache listener of Oracle 9i Application Server, allowing remote attackers to execute arbitrary code via a long HTTP request method header.

Cisco Wireless LAN Solution Engine (WLSE) versions 2.0 through 2.5 and Hosting Solution Engine (HSE) versions 1.7 through 1.7.3 have a hardcoded username and password. This allows remote attackers to add new users, modify existing users, and change configuration.

A double free vulnerability in the ASN.1 library used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

A stack-based buffer overflow in the Socks-5 proxy code for XChat versions 1.8.0 to 2.0.8 allows remote attackers to execute arbitrary code when socks5 traversal is enabled.

Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, used in various versions of Windows, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.

Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via (1) content parameter to content.php, (2) content_id parameter to content.php, or (3) list parameter to news.php.

A remote file inclusion vulnerability in secure_img_render.php of e107 0.615 allows attackers to execute arbitrary PHP code by modifying the 'p' parameter to reference a URL on a remote server containing malicious code.

SQL injection vulnerability in the art_print function in print.inc.php in unknown versions of jPortal before 2.3.1 allows remote attackers to inject arbitrary SQL commands via the id parameter.

The vulnerability in Netgear RP114 allows a remote attacker to bypass keyword-based URL filtering by requesting a long URL, for example containing a large number of %20 (hex-encoded space) sequences.

In DeleGate version 8.9.2 and earlier, the ssl_prcert function in the SSLway filter (sslway.c) contains a buffer overflow. A remote attacker can exploit a certificate with a long subject or issuer name field to execute arbitrary code.

In SUSE LINUX 9.1 Personal edition Live CD, the root account is configured without a password, allowing remote attackers to gain privileges via SSH.

The Downloads module in Php-Nuke 6.x through 7.2 contains an SQL injection vulnerability. A remote attacker can execute arbitrary SQL queries via the orderby or sid parameters in modules.php.

The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code. This is demonstrated using a script in a compiled help (CHM) file that references InfoTech Storage (ITS) protocol handlers.

Unknown vulnerability in ecartis before version 1.0.0 does not properly validate user input, allowing attackers to obtain mailing list passwords.

Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.