CVE Vulnerability Catalog

Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.

Vulnerability in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL.

Vulnerability in Mozilla Suite before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allows remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.

Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.

Multiple buffer overflows in LVM for AIX 5.1 and 5.2 allow local users to gain privileges via the putlvcb or getlvcb commands.

In Microsoft Windows 2000 running in a domain whose Fully Qualified Domain Name (FQDN) is exactly 8 characters long, users with expired passwords can log on to the domain.

Vulnerability in Safari web browser on Mac OS X 10.3.4 and 10.2.8. The 'Show in Finder' button may execute downloaded applications, allowing remote attackers to execute arbitrary code.

Real Networks RealPlayer 10 contains a buffer overflow vulnerability that can be exploited by a remote attacker to execute arbitrary code via a URL containing a large number of period characters.

The WebBrowser ActiveX control or the MSHTML rendering engine in Internet Explorer 6 allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute JavaScript, as demonstrated via delayed HTTP redirects with a Location header containing a "URL:" prefix before a "ms-its" protocol URI, or by modifying the window's location attribute.

LVM for AIX 5.1 and 5.2 allows local users to overwrite arbitrary files via a symlink attack.

Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite versions 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.

A buffer overflow vulnerability in the ntlm_check_auth (NTLM authentication) function of Squid Web Proxy Cache versions 2.5.x and 3.x, compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).

A vulnerability in LaunchServices on Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications, which could allow attackers to execute arbitrary code without warning the user.

Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report.

The PHP package in Slackware 8.1, 9.0, and 9.1, when linked against a static library, includes /tmp in the search path, which allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path.

The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as proftpdvhosts or addalink.cgi. This is a different vulnerability than CVE-2004-0490.

Multiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool.

Heap-based buffer overflow in proxy_util.c of mod_proxy in Apache 1.3.25 to 1.3.31. A remote attacker can send an HTTP Content-Length header with a negative value, causing large data copying and leading to process crash or potential arbitrary code execution.

Vulnerability in page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.

Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER, (2) OFFER, (3) REQUEST, (4) ACK, or (5) NAK messages, which can generate a long string when writing to a log file.