CVE Vulnerability Catalog

The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.

Heap-based buffer overflow in the SendUidl function in the POP3 capability in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. A remote POP3 mail server could exploit this vulnerability to execute arbitrary code.

A vulnerability in an ActiveX control of Symantec Norton AntiVirus 2004 allows a remote attacker to cause a denial of service through excessive resource consumption and potentially execute arbitrary code.

Vulnerability in cPanel when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option. The missing --enable-discard-path option causes PHP to use the SCRIPT_FILENAME variable instead of PATH_TRANSLATED to locate and execute a script. This allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script.

Integer overflow in the SOAPParameter object constructor in Netscape version 7.0 and 7.1 and Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.

Unknown vulnerability in AppleFileServer for Mac OS X 10.3.4, related to the use of SSH and reporting errors, has unknown impact and attack vectors.

Vulnerability in Mozilla 1.6, Firebird 0.7, and Firefox 0.8 browsers allows an attacker to intercept cached passwords for SSL sites. The browsers do not verify that passwords are only sent over SSL encrypted sessions, enabling them to be sent in cleartext to a spoofed site.

The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password.

Multiple buffer overflows in krb5_aname_to_localname in MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.

SQL injection vulnerability in SquirrelMail before version 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, probably via abook_database.php. The impact is unknown but may include database integrity compromise.

Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14 may allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive.

Integer signedness error in the cpufreq proc handler (cpufreq_procctl) in Linux kernel 2.6 allows local users to gain privileges.

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.

Multiple buffer overflows in the RTSP client for MPlayer before version 1.0pre4 and xine lib before version 1-rc4 may lead to crashes and potentially allow remote attackers to execute arbitrary code.

SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter.

SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username or password parameters.

Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file with a long (1) BoundingBox, (2) comment, (3) Orientation, (4) PageOrder, or (5) Pages value.

A format string vulnerability in the QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifiers in the QUOTE command.

BlackICE PC Protection and Server Protection install configuration files (firewall.ini, blackice.ini, sigs.ini, protect.ini) with Everyone Full Control permissions. A local user can modify these files, e.g., by adding an oversized rule to firewall.ini, causing a denial of service (crash) or configuration change.

Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.