CVE Vulnerability Catalog

Heap-based buffer overflow in the bitmap processing routine of Microsoft Windows Media Player. A crafted BMP file with size 0 but containing extra data allows remote attackers to execute arbitrary code.

A vulnerability in the ShellAbout API call of the Korean Input Method Editor (IME) in Windows XP SP1/SP2, Windows Server 2003 up to SP1, and Office 2003 allows a local user to gain privileges by launching the "shell about dialog box" and clicking the End-User License Agreement link, which executes Notepad with the privileges of the program displaying the about box.

A buffer overflow vulnerability in the plug-in for Microsoft Windows Media Player 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.

A vulnerability in Microsoft Windows XP SP1/SP2 and Server 2003 up to SP1 allows a remote attacker to cause a system hang by sending an IGMP packet with an invalid IP option. This is known as the IGMP v3 DoS vulnerability.

A vulnerability in telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.

Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before version 1.0.06. Impact and attack vectors are unknown.

Multiple SQL injection vulnerabilities exist in Magic Calendar Lite 1.02 in cms/index.php via the $total_login and $total_password parameters when magic_quotes_gpc is disabled. Remote attackers can execute arbitrary SQL commands.

Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the Forum and pages parameters. The vendor disputes this, stating the forum does not use an SQL database, and researchers suggest the issue may be a VBScript parsing error.

A buffer overflow vulnerability in Sony Ericsson K600i, V600i, W800i, and T68i cell phones allows a remote attacker to cause a denial of service (reboot or shutdown) via a wireless Bluetooth connection. The attack uses a malformed L2CAP packet where the length field is less than the actual packet length.

SQL injection vulnerability in index.php of PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in message.php within the espace_membre module. The provenance of this information is unknown; details are obtained solely from third party sources.

Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3. Remote attackers can cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer created by the pam_get_item function.

Multiple SQL injection vulnerabilities were found in Hinton Design phpht Topsites 1.3. An attacker can remotely execute arbitrary SQL commands by manipulating the username parameter.

In check.php of Hinton Design phpht Topsites 1.3, passwords are not validated when using cookies, allowing remote attackers to bypass authentication via unspecified cookies.

The squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing forward slashes, which might produce inefficient regular expressions.

A buffer overflow vulnerability exists in elogd.c in elog before version 2.5.7 r1558-4. Attackers can execute arbitrary code via unspecified variables when writing to the log file.

Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service (application crash) and possibly execute code via long revision attributes.

Unspecified vulnerability in query_store.php and manage_proj_create.php in Mantis before 1.0.0. Attack details and impact are unknown, information obtained solely from third parties.

SQL injection vulnerability in index.php of vwdev allows remote attackers to execute arbitrary SQL commands via the UID parameter in the definition page.

The Tiny ASN.1 Library (libtasn1) before version 0.2.18, used by GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and GNU Shishi, contains a vulnerability that crashes the DER decoder and potentially allows arbitrary code execution via out-of-bounds access caused by invalid input.

The myquiz.pl script in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly sanitized in the PATH_INFO environment variable.