CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in eFiction versions 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via the 'let' parameter in a viewlist action to titles.php and via the 'username' parameter.

Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the 'let' parameter in authors.php and 'sid' parameter in viewstory.php.

Multiple SQL injection vulnerabilities in ASP-DEV ASP Resources Forum allow remote attackers to execute arbitrary SQL commands via the (1) forum_id parameter to forum.asp, (2) unspecified parameters to register.asp, and (3) the 'Search For' field in search.asp.

A vulnerability in eFiction 1.0, 1.1, and 2.0 in unspecified environments may allow remote attackers to perform unauthorized operations by directly accessing install.php or upgrade.php. It is unclear whether this is a flaw in eFiction itself or the result of incorrect system administration, such as not removing utility scripts after use.

In eFiction 1.1, the 'Upload new image' command in 'Manage Images' allows remote attackers to upload a file with a .php extension containing a GIF header, bypassing image validation and executing arbitrary PHP code.

SQL injection vulnerability in Memberlist.php in Simple Machines Forum (SMF) 1.1 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter. Note: this issue has been disputed by the vendor and third parties, stating that only one character can be modified, which does not lead to SQL injection but only to an invalid SQL syntax error.

SQL injection vulnerability in view.php of PHP-addressbook 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Unspecified vulnerability in Kerio WinRoute Firewall before version 6.1.3 allows remote attackers to authenticate to the service using an account that has been disabled.

The vulnerability in Soti Pocket Controller-Professional 5.0 allows a remote attacker to turn off, reboot, or hard reset a PDA by sending a series of initialization, command, and reset packets to port 5492.

The vulnerability in registration.PHP in ATutor 1.5.1 pl2 allows a remote attacker to execute arbitrary SQL commands by providing an email address ending with a NULL character, which bypasses the PHP regular expression check. However, this may be a bug in PHP code rather than in ATutor itself.

Unspecified vulnerability in Mambo 4.5 (1.0.0) through 4.5 (1.0.9) with magic_quotes_gpc disabled allows remote attackers to read arbitrary files and possibly cause a denial of service via a query string that ends with a NULL character.

Mailman versions 2.1.4 through 2.1.6 contain a denial of service vulnerability where a message with malformed date data causes a buffer overflow and server crash.

Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory and filename.

Vulnerability in Courier Mail Server 0.37.3–0.52.1 in the authpam.c file of the courier-authdaemon component. When pam_tally is used, the pam_acct_mgmt function is not called to verify that access should be granted. This allows attackers to authenticate to the server using accounts that have been disabled.

Vulnerability in Lyris ListManager versions 5.0 through 8.9a allows remote attackers to add ORDER BY columns to SQL queries using unusual whitespace characters such as newlines and 0xFF (ASCII 255), which are interpreted as whitespace.

A stack-based buffer overflow in the dissect_ospf_v3_address_prefix function of the OSPF protocol dissector in Ethereal 0.10.12 and possibly other versions allows remote attackers to execute arbitrary code via crafted packets.

SQL injection vulnerability in Lyris ListManager versions 5.0 through 8.9a allows remote attackers to execute arbitrary SQL commands by sending SQL code after a numeric argument in the /read/attachment URL.

The web interface of Lyris ListManager 5.0 through 8.8b allows remote attackers to execute arbitrary list administration commands by injecting LFCR (%0A%0D) sequences in the pw parameter, exploiting a line wrap feature during new user subscription.

Multiple SQL injection vulnerabilities in ThWboard before version 3 Beta 2.84 allow remote attackers to execute arbitrary SQL commands via the year parameter in calendar.php, the user parameter array in v_profile.php, and the userid parameter in misc.php.

SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field.