CVE Vulnerability Catalog

Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root.

Vulnerability in BEA WebLogic Server and WebLogic Express versions 7.0 through 7.0 Service Pack 4 and 8.1 through 8.1 Service Pack 2 allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.

Off-by-one error in the POP3_readmsg function in popclient 3.0b6 allows remote attackers to cause a denial of service (application crash) via an e-mail message with a certain line length, which leads to a buffer overflow.

Vulnerability in PHP on Win32 platforms before version 4.3.7 allows attackers to execute arbitrary code, overwrite files, and access internal environment variables remotely or locally. The issue stems from improper filtering of shell metacharacters such as '%', '|', and '>' in the escapeshellcmd and escapeshellarg functions.

Heap-based buffer overflow in the HtmlHelp program (hh.exe) allows remote attackers to execute arbitrary commands via a .CHM file with a large length field.

Vulnerability in Lotus Domino 6.5.0 and 6.5.1 with IMAP enabled allows remote authenticated users to change their own quota using the IMAP setquota command.

A format string vulnerability in the printlog function in log2mail before version 0.2.5.2 allows local users or remote attackers to execute arbitrary code via format string specifiers in a logfile monitored by log2mail.

Utility Manager in Windows 2000 launches winhlp32.exe with raised privileges, allowing local users to gain system privileges via a 'Shatter' style attack. This attack sends a Windows message to cause Utility Manager to launch winhlp32, bypassing the GUI.

The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in environments that do not provide the vsnprintf function, uses C include files that define vsnprintf to use the less safe vsprintf function, which can lead to buffer overflow vulnerabilities that enable a denial of service (server crash) and possibly execute arbitrary code.

Buffer overflow vulnerability in the DCE daemon (DCED) for the DCE endpoint mapper (epmap) on HP-UX 11. A remote attacker can send a request with a small fragment length and a large amount of data, leading to arbitrary code execution.

The vulnerability in the acpRunner ActiveX control version 1.2.5.0 allows a remote attacker to execute arbitrary code via the DownLoadURL, SaveFilePath, and Download methods. The attack can be carried out through a crafted web page.

An unknown vulnerability in Linux before version 2.4.26 for IA64 allows local users to cause a denial of service, with unknown impact.

Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) 'c' compress option or (2) 'd' decompress option.

A format string vulnerability in the SSL_set_verify function in telnetd.c of the SSLtelnet daemon (SSLtelnetd) version 0.13 allows remote attackers to execute arbitrary code.

Buffer overflow in the chpasswd command in the Change_passwd plugin before version 4.0, as used in SquirrelMail, allows local users to gain root privileges via a long user name.

Buffer overflow vulnerability in the wvHandleDateTimePicture function of the wv library (wvWare) versions 0.7.4 through 0.7.6 and 1.0.0. An attacker can remotely execute arbitrary code by sending a document with a long DateTime field.

Vulnerability in Safari web browser on Mac OS X 10.3.4 and 10.2.8. The 'Show in Finder' button may execute downloaded applications, allowing remote attackers to execute arbitrary code.

Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.

libsvn_ra_svn in Subversion 1.0.4 trusts the length field of svn protocol URLs, allowing remote attackers to cause a denial of service through a heap-based buffer overflow.

CVE-2004-0416 describes a double free vulnerability for the error_prog_name string in CVS versions 1.12.x through 1.12.8 and 1.11.x through 1.11.16. This may allow remote attackers to execute arbitrary code.