CVE Vulnerability Catalog

SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to inject SQL code via the gid parameter, potentially leading to privilege escalation or unauthorized database operations.

PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary PHP code by modifying the basepath parameter to reference a URL on a remote web server that contains fileFunctions.php.

The login page of cPanel 9.1.0 (and possibly other versions) allows a remote attacker to execute arbitrary code by injecting shell metacharacters in the 'user' parameter.

The 'Allow cPanel users to reset their password via email' feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

Multiple format string vulnerabilities in the HTTP Application Intelligence component in Check Point Firewall-1 NG-AI R55 and R54, and Check Point Firewall-1 HTTP Security Server, allow remote attackers to execute arbitrary code via crafted HTTP requests.

CVE-2004-0128 describes a vulnerability in the GEDCOM configuration script for phpGedView version 2.65.1 and earlier, allowing remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to point to a URL containing a malicious theme.php script.

A stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges.

Multiple buffer overflows in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.

The MSS (maximum segment size) functionality in netinet allows remote attackers to cause a denial of service through resource exhaustion. This can be achieved by a low MTU, leading to a large number of small packets being generated, or by sending many packets with a small TCP payload.

Multiple unknown vulnerabilities in XFree86 versions 4.1.0 to 4.3.0, related to improper handling of font files.

The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets. This allows attackers to cause a denial of service and possibly execute arbitrary code.

Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81 allow remote attackers to cause a denial of service and possibly execute arbitrary code.

Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages.

Multiple buffer overflows in Orville Write (orville-write) 2.53 and earlier allow local users to gain privileges.

The do_mremap function in Linux versions 2.2 to 2.6.2 does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, allowing local users to gain root privileges.

Multiple integer overflows in the Microsoft ASN.1 library (MSASN1.DLL) can lead to arbitrary code execution by remote attackers. The issue affects Windows NT 4.0, 2000, and XP, where vulnerabilities exist in LSASS.EXE, CRYPT32.DLL, and other components.

Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server. Examples include using the GLOBALS[rootdp] parameter in db.php and the GLOBALS[language_home] parameter in archivednews.php with a malicious version of lang_admin.php.

Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.

Buffer overflow in the Extract Info Field Function for MSN and YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.

A stack-based buffer overflow in Check Point VPN-1 Server 4.1 through 4.1 SP6 and Check Point SecuRemote/SecureClient 4.1 through 4.1 build 4200 allows remote attackers to execute arbitrary code via an ISAKMP packet with a large Certificate Request packet.