CVE Vulnerability Catalog

Multiple format string vulnerabilities in the logger function in netzio.c for Tanne 0.6.17 allow remote attackers to execute arbitrary code via format string specifiers in syslog.

BisonFTP Server 4 release 2 has a directory traversal vulnerability that allows remote attackers to list directories and files above the root directory.

In Mambo 4.0.12, the index2.php file allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie.

Buffer overflow in Avant Browser 8.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.

A stack-based buffer overflow in the reply_nttrans function in Samba 2.2.7a and earlier allows remote attackers to execute arbitrary code via a crafted request.

In wu-ftpd 2.6.2, there is an issue with not closing failed connections when running on operating systems that allow only one non-connected socket bound to the same local address. This can lead to denial of service.

Buffer overflow in the setupterm function of the lanadmin and landiag programs in HP-UX 10.0 through 10.34 allows local users to execute arbitrary code via a long TERM environment variable.

Multiple 'command injection' vulnerabilities in Phorum versions 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program.

Buffer overflow in rwrite for HP-UX 11.0 could allow local users to execute arbitrary code via a long argument.

SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module.

Multiple buffer overflows in H-Sphere WebShell 2.3 allow remote attackers to execute arbitrary code via (1) a long URL content type in CGI::readFile, (2) a long path in diskusage, and (3) a long fname in flist.

Buffer overflow in CuteFTP versions 4.2 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.

Multiple SQL injection vulnerabilities in a.shopKart 2.0.3 in addcustomer.asp, addprod.asp, and process.asp allow remote attackers to execute arbitrary SQL and obtain sensitive information via the zip, state, country, phone, and fax parameters.

Cisco IOS versions 12.0 through 12.2, when IP routing is disabled, accepts false ICMP redirect messages, allowing remote attackers to cause a denial of service by modifying network routing.

Unspecified vulnerability in the Cache' Server Page (CSP) implementation in InterSystems Cache' versions 4.0.3 through 5.0.5 allows remote attackers to gain complete control of a server.

SQL injection vulnerability in Profile.php in ttCMS 2.2 and ttForum allows remote attackers to execute arbitrary SQL commands via the member name.

Multiple buffer overflows in the launch_bcrelay function in pptpctrl.c in PoPToP versions 1.1.4-b1 through 1.1.4-b3 allow local users to execute arbitrary code.

CVE-2003-1314 in EternalMart Guestbook (EMGB) 1.1 has a vulnerability in admin/auth.php that allows remote attackers to execute arbitrary PHP code via manipulation of the emgb_admin_path parameter.

The activate.php file in versatileBulletinBoard (vBB) versions 0.9.5 and 0.9.6 allows remote attackers to gain unauthorized administrative access via a URL request with the uid parameter set to the webmaster uid.

Trend Micro ScanMail for Exchange (SMEX) versions before 3.81 and 6.1 may install a back door account in smg_Smxcfg30.exe, allowing remote attackers to access the web management interface via the vcc parameter.