CVE Vulnerability Catalog

An unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service (device reset) via a crafted request to the web management interface. The provenance of this information is unknown; details are obtained from third party reports.

Vulnerability in Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options handled by iftpmgr.exe.

The vulnerability in distcc 2.x, used in XCode 1.5 and others, allows remote attackers to execute arbitrary commands by sending compilation jobs, which are executed without authorization checks when the server is not configured to restrict access to the port.

SQL injection vulnerability in search.php in phpBB versions 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter.

An unknown overflow in the phpgw_config table in phpGroupWare before version 0.9.14.002. An attacker could exploit this vulnerability, but the exact attack vectors and impact are unknown.

The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install the AuthenticationService setuid and writable by other users, which allows local users to gain privileges by modifying the program.

Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted mount or sysfs system calls.

Buffer overflow in the HandleCPCCommand function of sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code.

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to the Telnet proxy service, a different vector than CVE-2004-2416.

Unspecified vulnerability in ASN.1 Compiler (asn1c) before version 0.9.7, occurring when processing "CHOICE" types with "indefinite length structures." Impact and attack vectors are unknown.

A vulnerability in the i-mall.cgi script of I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters in the p parameter.

Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the clientRcptTo array, and the Received and messageID variables, possibly involving HELO and hostname arguments.

An ActiveX control in McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages using the control's RegQueryValue() method.

The web-based Management Console in Blue Coat Security Gateway OS 3.0 through 3.1.3.13 and 3.2.1, when importing a private key, stores the key and its passphrase in plaintext in a log file, which allows attackers to steal digital certificates.

The Spy Sweeper Enterprise Client (SpySweeperTray.exe) in WebRoot Spy Sweeper before version 2.0 does not drop privileges when using the help functionality, allowing local users to gain privileges.

SQL injection vulnerability in index.cfm of CFWebstore 5.0 allows remote attackers to execute arbitrary SQL commands via category_id, product_id, or feature_id parameters.

Unrestricted file upload vulnerability in AspDotNetStorefront 3.3 allows remote authenticated administrators to upload arbitrary files with executable extensions via admin/images.aspx.

SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin versions 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the x_invoice_num parameter.

Unknown vulnerability in F-Secure Anti-Virus (FSAV) 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV.

An unknown vulnerability in Serviceguard and Cluster Object Manager on HP-UX and HP Linux allows remote attackers to gain unauthorized privileges via unknown attack vectors.