CVE Vulnerability Catalog

SQL injection vulnerability in login.php in myBloggie 2.1.3-beta and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.

Multiple unknown vulnerabilities have been discovered in MAXdev MD-Pro version 1.0.72 and earlier, affecting modules: Download, Search, Web links, Blocks, Messages, News, Comments, Settings, Stats, and subjects. The impact and attack vectors are unspecified.

Multiple eval injection vulnerabilities in PlainBlack Software WebGUI before version 6.7.3 allow remote attackers to execute arbitrary Perl code via Help.pm, International.pm, or WebGUI.pm.

DownFile 1.3 allows remote attackers to gain administrator privileges via a direct request to update.php, del.php, and add_form.php.

man2web allows remote attackers to execute arbitrary commands via -P arguments.

Frox 0.7.18, when running setuid root, does not properly drop privileges when reading a configuration file, which allows local users to read portions of arbitrary files via the -f command line option.

Multiple stack-based buffer overflows in urban before version 1.5.3 allow local users to gain privileges via a long HOME environment variable to config.cc, game.cc, highscor.cc, or meny.cc.

Frox versions 0.7.16 and 0.7.17 improperly parse certain Deny ACLs, which might allow attackers to bypass intended restrictions and access blocked hosts.

Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

The vulnerability in kcheckpass in KDE 3.2.0 through 3.4.2 allows local users to gain root access via a symlink attack on lock files.

Vulnerability in mod_ssl before version 2.8.24, when 'SSLVerifyClient optional' is set in the global virtual host configuration, does not properly enforce 'SSLVerifyClient require' in a per-location context, allowing remote attackers to bypass intended access restrictions.

In the ext2 and ext3 file system code of Linux kernel 2.6, the xattr.c file incorrectly compares the name_index fields when sharing xattr blocks, which may prevent default ACLs from being applied.

The vulnerability in WRQ Reflection for Secure IT Windows Server 6.0 (formerly F-Secure SSH server) is that the server processes access and deny lists in a case-sensitive manner, while previous versions were case-insensitive. This may allow remote attackers to bypass restrictions and log in to accounts that should be denied.

phpWebNotes 2.0.0 contains a vulnerability allowing remote code execution via PHP file inclusion. The extract function in php_api.php allows an attacker to modify the $t_path_core variable, leading to the inclusion of an arbitrary PHP file from an external source.

Vulnerability in WRQ Reflection for Secure IT Windows Server 6.0 (formerly F-Secure SSH server) improperly handles renaming of Administrator or Guest accounts after SSH key authentication has been configured, allowing remote attackers to log in using the original account names.

SQL injection vulnerability in the login function for the administration login panel in cosmoshop 8.10.78 allows remote attackers to execute arbitrary SQL commands and bypass authentication via unspecified vectors.

Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long "+VIEWS:" reply (VIfromLine function) and (2) certain arguments when launching third party programs (FIOgetargv function).

SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid parameter.

Multiple SQL injection vulnerabilities in Land Down Under (LDU) 801 and earlier allow remote attackers to execute arbitrary SQL commands via the c parameter to (1) events.php, (2) index.php, or (3) list.php.

Buffer overflow vulnerability in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file.