CVE Vulnerability Catalog

CVE-2003-1530 is a SQL injection vulnerability in privmsg.php in phpBB version 2.0.3 and earlier. It allows remote attackers to execute arbitrary SQL commands via the mark[] parameter.

The nsr_shutdown function in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.

SQL injection vulnerability in the IMAP daemon in dbmail 1.1 allows remote attackers to execute arbitrary SQL commands via the (1) login username, (2) mailbox name, and possibly other attack vectors.

eMule version 0.29c allows remote attackers to cause a denial of service (crash) via a long password, possibly due to a buffer overflow.

Real Networks RealOne Enterprise Desktop and RealOne Player versions 6.0.11.774, 2.0, and 6.0.11.818 through 6.0.11.853 allow remote attackers to execute arbitrary script in the local security zone by embedding script in a temp file before the temp file is executed by the default web browser.

Planet Technology WGSD-1020 and WSW-2401 Ethernet switches use a default 'superuser' account with the 'planet' password, allowing remote attackers to gain administrative access.

Unspecified vulnerability in the non-SSL web agent in various HP Management Agent products allows local users or remote attackers to gain privileges or cause a denial of service via unknown attack vectors.

MAILsweeper for SMTP versions 4.3.6 and 4.3.7 allows remote attackers to cause a denial of service (CPU consumption) via a PowerPoint attachment that is either (1) corrupt or (2) contains "embedded objects."

Buffer overflow in the IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a CREATE command with a long mailbox name.

Unspecified vulnerability in Phorum versions 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php.

Buffer overflow in Siemens 45 series mobile phones allows remote attackers to cause a denial of service via a Short Message Service (SMS) message with a long image name.

A memory leak in the Windows 2000 kernel allows remote attackers to cause a denial of service by hanging an SMB request via a NetBIOS continuation packet.

The web administration page for the Ericsson HM220dp ADSL modem does not require authentication, which could allow remote attackers to gain access from the LAN side.

Epic Games Unreal Engine versions 226f through 436 are vulnerable to an attack that can lead to denial of service through CPU consumption or crash, and potentially execute arbitrary code. Attackers can exploit a packet with a negative size value, which is treated as a large positive number during memory allocation.

The vulnerability in guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.

In OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and PAM keyboard-interactive authentication is used, there is no delay after a root login attempt with the correct password. This makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful.

Twilight Webserver version 1.3.3.0 allows remote attackers to cause an application crash via a GET request for a long URI, which is a different vulnerability than CVE-2004-2376.

RTS CryptoBuddy versions 1.0 and 1.2 use a weak encryption algorithm for the passphrase and generate predictable keys, making it easier for attackers to guess the passphrase.

Incorrect file handling in sort in HP-UX 10.01 through 10.20 and 11.00 through 11.11 may allow attackers to gain access or cause a denial of service.

Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F, related to 'malicious script'.