CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability exists in the mail_valid_net_parse_work function in mail.c of Washington's IMAP Server (UW-IMAP) before imap-2004g. A remote attacker can exploit a mailbox name containing a single double-quote character without a closing quote, causing indefinite copying of bytes into a buffer.
A buffer overflow vulnerability in Computer Associates (CA) iGateway versions 3.0 and 4.0 before 4.0.050623, when running in debug mode, allows remote attackers to execute arbitrary code via crafted HTTP GET requests.
In XMail before version 1.22, a stack-based buffer overflow in the sendmail function allows a remote attacker to execute arbitrary code by providing a long -t command line option.
The mod_auth_shadow module versions 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.
A vulnerability in the Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code due to an unchecked buffer when processing certain crafted network messages.
A buffer overflow vulnerability in Collaboration Data Objects (CDO) in Microsoft Windows and Microsoft Exchange Server allows a remote attacker to execute arbitrary code by sending an email message with a long header name, such as the "Content-Type" string.
Format string vulnerability in the bpjava-msvc daemon (Java user interface service) in VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP, and NetBackup Enterprise/Server/Client 5.0, 5.1, and 6.0. A remote attacker can exploit this flaw to execute arbitrary code by sending a specially crafted COMMAND_LOGON_TO_MSERVER command.
A vulnerability in the runpriv tool in SGI IRIX allows local users to bypass intended restrictions and execute arbitrary commands via shell metacharacters in a command line for a privileged binary in /usr/sysadm/privbin.
A vulnerability in the COM+ service in Microsoft Windows due to improper creation and use of memory structures allows local or remote attackers to execute arbitrary code.
Vulnerability in Ruby (versions 1.6.x to 1.6.8, 1.8.x to 1.8.2, and 1.9.0 development up to 2005-09-01) allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin).
The vulnerability in Mason before version 1.0.0 is that after configuring a firewall using this tool, the init script is not installed. As a result, the firewall is not activated after a system reboot.
The SECEDIT command on Microsoft Windows 2000 before Update Rollup 1 for SP4, when using a security template to set Access Control Lists (ACLs) on folders, does not apply ACLs on folders that are listed after a long folder entry, which could result in less secure permissions than specified by the template.
Multiple SQL injection vulnerabilities in PHP-Fusion before version 6.00.110 allow remote attackers to execute arbitrary SQL commands via the activate parameter in register.php and the cat_id parameter in faq.php.
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the pm_email_notify and pm_save_sent parameters. This is a different vulnerability than CVE-2005-3157 and CVE-2005-3159.
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.
SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msg_view parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158.
Multiple SQL injection vulnerabilities were found in the photogallery.php script in PHP-Fusion. A remote attacker can manipulate the 'album' and 'photo' parameters to execute arbitrary SQL commands on the database.
A vulnerability in Microsoft Windows 2000 before Update Rollup 1 for SP4 allows a local administrator to unlock a computer even if it has been locked by a domain administrator, enabling the local administrator to access the session as the domain administrator.
A vulnerability in Microsoft Windows 2000 before Update Rollup 1 for SP4 causes the IP address of a Terminal Services client not to be recorded in the security log after a successful connection. This makes it easier for attackers to evade detection.
A buffer overflow vulnerability in the W3C logging of MailEnable Enterprise 1.1 and Professional 1.6 allows remote attackers to execute arbitrary code.