CVE Vulnerability Catalog

Unknown vulnerability in Serendipity 0.8, when used with multiple authors, allows unprivileged authors to upload arbitrary media files.

Unknown vulnerability in Blue Coat Reporter before 7.1.2 allows remote unauthenticated attackers to add a license.

The vulnerability in PROMS version 0.11 is due to improper handling of certain combinations of rights, resulting in users being granted more privileges than intended.

Integer overflow vulnerability in Computer Associates Vet Antivirus library allows remote attackers to gain elevated privileges by sending a crafted compressed VBA directory with a project name length of -1, leading to a heap-based buffer overflow.

Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for viruses, which does not return an error code and prevents viruses from being detected.

An unknown vulnerability in ALWIL avast! antivirus version 4 (4.6.6230) and earlier, running on Windows NT 4.0, causes improper detection of certain viruses.

GDB before version 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running GDB.

SQL injection vulnerability in the Xanthia module for PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga[0] parameter in pnadmin.php.

Multiple SQL injection vulnerabilities in PROMS before version 0.11 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

Unknown vulnerability in MailScanner 4.41.3 and earlier, related to incomplete reporting of viruses in zip files, allows remote attackers to bypass virus detection.

SQL injection vulnerability in PortailPHP 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in the News, File, Liens, or Faq modules.

Unknown vulnerability in Groove Virtual Office before version 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 allows remote attackers to bypass restrictions on COM objects.

Vulnerability in D-Link routers allows authentication bypass when executing /cgi-bin/firmwarecfg. An attacker can gain unauthorized access if their IP address is already in /var/tmp/fw_ip or if they are the first requester, which creates the file with their IP address.

The vulnerability in episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.

SQL injection vulnerability in wp-trackback.php in WordPress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.

PHP remote file inclusion vulnerability in common.php in phpATM 1.21 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via a URL in the include_location parameter to index.php.

Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote attackers to cause a denial of service (crash).

SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via group_membership_query, simul_count_query, or simul_verify_query configuration entries.

Multiple SQL injection vulnerabilities in Help Center Live allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to index.php, (2) tid parameter to view.php, fid parameter to (3) download.php or (4) chat_download.php, (5) status parameter to icon.php, TICKET_tid parameter to (6) index.php or (7) view.php.

The vulnerability in ppxp is that the program does not drop root privileges before opening log files, allowing local users to execute arbitrary commands.