CVE Vulnerability Catalog

The Motorola Wireless Router WR850G running firmware 4.03 allows remote attackers to bypass authentication, log on as an administrator, and obtain sensitive information by repeatedly making HTTP requests to ver.asp until an administrator logs on.

SQL injection vulnerability in bug.php in phpBugTracker 0.9.1 allows remote attackers to execute arbitrary SQL commands via the bug_id parameter (viewvotes operation) or the project parameter (add operation).

Multiple unknown vulnerabilities have been discovered in Online Recruitment Agency 1.0. Their impact and attack vectors are unspecified.

The vulnerability in CUPS before version 1.1.21rc1 is that the Location directive in cupsd.conf is treated as case sensitive. This allows attackers to bypass intended ACLs by using a printer name containing uppercase or lowercase letters different from those specified in the directive.

Vulnerability in the exec_dir PHP patch (php-exec-dir) versions 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.

SQL injection vulnerability in index.cfm of CFWebstore 5.0 allows remote attackers to execute arbitrary SQL commands via category_id, product_id, or feature_id parameters.

SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.

A stack-based buffer overflow vulnerability in the FTP daemon of HP-UX 11.11i with the -v (debug) option enabled allows remote attackers to execute arbitrary code via a long command request.

SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.

Multiple buffer overflows in Gyach Enhanced (Gyach-E) before version 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by sending certain typing statuses or setting the chat room status bar to the current chat room name.

SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.

Multiple buffer overflows in Gyach Enhanced (Gyach-E) before version 1.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to avatar retrieval.

SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.

Multiple overflows in the io_edgeport driver for Linux kernel 2.4.x have unknown impact and unknown attack vectors.

Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.

SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to inject SQL code via the catcode parameter, potentially leading to unauthorized access and privilege escalation.

A buffer overflow vulnerability in blaxxun 3D 7.0 allows remote attackers to execute arbitrary code via a long URL property inside an object tag.

A buffer overflow vulnerability in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Internacional property followed by a long string.

SQL injection vulnerability in NukeCalendar 1.1.a used in PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in modules.php.

SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via the sif parameter in the Comments module or the timezoneoffset parameter in the Your_Account module.