CVE Vulnerability Catalog

The Compuware DriverStudio Remote Control service (DSRsvc.exe) versions 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.

SQL injection vulnerability in infopage.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idPage parameter.

A stack-based buffer overflow vulnerability exists in AhnLab V3Pro 2004, V3 VirusBlock 2005, and V3Net for Windows Server 6.0 (all build 6.0.0.383). A remote attacker can exploit a long filename in an ACE archive to execute arbitrary code.

Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in scripts like announcement.php, thread.php, user.php, and others.

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in different scripts.

Multiple SQL injection vulnerabilities in vBulletin before version 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.

Multiple unspecified vulnerabilities have been discovered in the WYSIWYG editor in PHP-Nuke before version 7.9 Final. Their impact and attack vectors are unknown.

Vulnerability in Tofu 0.2 allows remote attackers to execute arbitrary Python code via crafted pickled objects, which Tofu unpickles and executes.

Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities.

SQL injection vulnerability in Interakt MX Shop 3.2.0 allows remote attackers to execute arbitrary SQL commands via the idp, id_ctg, or id_prd parameters to the pages module in index.php.

SQL injection vulnerability in index.php in NooTopList 1.0.0 release 17. Remote attackers can execute arbitrary SQL commands via the 'o' or 'sort' parameters.

A direct static code injection vulnerability in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.

Multiple buffer overflows in OpenTTD before 0.4.0.1 allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

A vulnerability in Helpdesk Software Hesk allows remote attackers to bypass authentication for admin.php and admin_main.php by modifying the PHPSESSID session ID parameter or cookie.

In SGI IRIX 6.5.25, 6.5.26, and 6.5.27, the rpc.mountd service incorrectly grants access to anonymous clients whose hostname cannot be determined. This issue occurs in a security mechanism, but there is no apparent attacker role and it probably does not satisfy the CVE definition of a vulnerability.

Vulnerability in masqmail before version 0.2.18 allows remote attackers to execute arbitrary commands via crafted email addresses that are not properly sanitized when creating a failed delivery message.

A buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before version 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.

Firefox 1.0.6 and Mozilla 1.7.10 contain a vulnerability that allows arbitrary command execution via a URL with shell metacharacters passed to the browser on the command line, which is sent unfiltered to bash.

Multiple heap-based and stack-based buffer overflows in certain DCOM server components in VERITAS Storage Exec 5.3 before Hotfix 9 and StorageCentral 5.2 before Hot Fix 2 allow remote attackers to execute arbitrary code via certain ActiveX controls.

PHP Advanced Transfer Manager 1.30 has a default password for the administrator user, which allows remote attackers to upload and execute arbitrary PHP files.