CVE Vulnerability Catalog

A vulnerability in LaunchServices on Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications, which could allow attackers to execute arbitrary code without warning the user.

A buffer overflow vulnerability in the ntlm_check_auth (NTLM authentication) function of Squid Web Proxy Cache versions 2.5.x and 3.x, compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).

Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite versions 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.

LVM for AIX 5.1 and 5.2 allows local users to overwrite arbitrary files via a symlink attack.

The WebBrowser ActiveX control or the MSHTML rendering engine in Internet Explorer 6 allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute JavaScript, as demonstrated via delayed HTTP redirects with a Location header containing a "URL:" prefix before a "ms-its" protocol URI, or by modifying the window's location attribute.

The jail system call in FreeBSD 4.x before 4.10-RELEASE does not verify that an attempt to manipulate routing tables originated from a non-jailed process, which could allow local users to modify the routing table.

CVS versions from 1.11.x to 1.11.16 and from 1.12.x to 1.12.8 improperly handle empty data lines, which may allow remote attackers to perform an out-of-bounds write. This can lead to arbitrary code execution or modification of critical program data.

CVS versions 1.12.x through 1.12.8 and 1.11.x through 1.11.16 do not properly handle malformed 'Entry' lines. This may lead to a NULL terminator not being used, resulting in a denial of service (crash), modification of critical program data, or arbitrary code execution.

A vulnerability in the 'memory dump' command in the VICE emulator versions 1.6 to 1.14 allows local users to cause a denial of service (emulator crash) and potentially execute arbitrary code via format string specifiers in an output string.

A stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0 allows local or remote attackers to execute arbitrary code via a .job file containing long parameters.

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10 allows remote attackers to read and delete arbitrary files via '..' sequences in the dynamicimag argument to crystalimagehandler.aspx.

The syssgi SGI_IOPROBE system call in IRIX 6.5.20 through 6.5.24 allows local users to gain privileges by reading and writing to kernel memory.

Buffer overflow vulnerability in the wvHandleDateTimePicture function of the wv library (wvWare) versions 0.7.4 through 0.7.6 and 1.0.0. An attacker can remotely execute arbitrary code by sending a document with a long DateTime field.

Vulnerability in comersus_gatewayPayPal.asp in Comersus Cart 5.09 (and earlier versions before 5.098) allows remote attackers to change item prices by directly modifying them in the URL.

The Thomson SpeedTouch 510 ADSL Router with firmware GV8BAA3.270, and possibly earlier versions, generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections.

Vulnerability in ISQL*Plus component of Oracle 10g Application Server allows remote attackers to execute arbitrary files by providing an absolute pathname in the file parameter of the load.uix script.

Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedure.

Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters.