CVE Vulnerability Catalog

Buffer overflow in Serv-U ftp before version 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.

Multiple buffer overflows in Overkill (0verkill) version 0.15pre3 may allow local users to execute arbitrary code in the client via a long HOME environment variable in the load_cfg and save_cfg functions. It may also allow remote attackers to execute arbitrary code via long strings to the send_message function and, in the server, via the parse_command_line function.

SQL injection vulnerability in login.asp in thePHOTOtool allows remote attackers to gain unauthorized access via the password field.

Buffer overflow in the UUDeview package, used in WinZip versions 6.2 through 8.1 SR-1, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.

An off-by-one buffer overflow in the _xlate_ascii_write() function in ProFTPD versions 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.

Multiple format string vulnerabilities in GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to the info, anubis_error, and ssl_error functions.

Multiple buffer overflows in RealOne Player, RealOne Player 2.0, RealOne Enterprise Desktop, and RealPlayer Enterprise allow remote attackers to execute arbitrary code via malformed (.RP, .RT, .RAM, .RPM, .SMIL) files.

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access. The attack can be executed through various parameters in PHP files, such as cat, id, and cat_manufacturer.

SQL injection vulnerability in browse_items.asp in WebCortex WebStores 2000 version 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the Search_Text parameter.

Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.

Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1) battle type and (2) map name fields.

A stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before version 4.5.538.001 and ZoneLabs Integrity client before version 4.0.146.046 and 4.5 before version 4.5.085 allows remote attackers to execute arbitrary code via a long RCPT TO argument.

The vulnerability in viewtopic.php of phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.

Integer overflow vulnerability in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition. A remote attacker can exploit improper length validation in compressed (zipped) folders to execute arbitrary code.

The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.

The vulnerability in Sophos Small Business Suite 1.00 on Windows involves improper handling of files whose names contain reserved MS-DOS device names such as LPT1, COM1, AUX, CON, or PRN. This allows malicious code to bypass detection when installed, copied, or executed.

The NNTP component in Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 contains a vulnerability that allows remote code execution via specially crafted XPAT patterns. The issue is due to improper length validation and heap-based buffer overflows (off-by-one and heap-based buffer overflow).

The vulnerability in the SMTP component of Windows XP 64-bit, Windows Server 2003, and the Exchange Routing Engine component of Exchange Server 2003 allows a remote attacker to execute arbitrary code by sending a malicious DNS response with improperly validated length values.

The RPC Runtime Library for Microsoft Windows NT 4.0 contains a vulnerability that allows a remote attacker to read active memory or cause a system crash via a malicious message, possibly related to improper length values.

Buffer overflow vulnerability in Windows Program Group Converter (grpconv.exe) allows remote attackers to execute arbitrary code via a specially crafted shell: URL with a long filename and .grp extension, which is not properly handled when the shell launches grpconv.exe.