CVE Vulnerability Catalog

Unknown vulnerability in SandSurfer before version 1.7.0 allows remote attackers to gain access as a logged-in user.

Vulnerability in Windows Media Player 9 allows remote attackers to execute arbitrary code via a specially crafted PNG file with large width or height values, known as the 'PNG Processing Vulnerability'.

Vulnerability in Linux-VServer 1.24 allows local users with root privileges on a virtual server to gain access to the filesystem outside the virtual server via a modified chroot-again exploit using the chmod command.

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions through various methods, such as using the NavigateAndFind method or window.open to load a JavaScript URL.

Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow remote attackers to execute arbitrary code.

The calendar module for phpgroupware 0.9.14 does not enforce the 'save extension' feature for holiday files, allowing remote attackers to create and execute PHP files.

vbox3 version 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, allowing local users to gain elevated privileges.

Buffer overflow in Yahoo Instant Messenger 5.6.0.1351 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in the download feature.

Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick.

Cisco Personal Assistant versions 1.4(1) and 1.4(2) disables password authentication when 'Allow Only Cisco CallManager Users' is enabled, allowing remote attackers to gain access with a valid username.

The secldapclntd daemon in AIX 4.3, 5.1, and 5.2 uses an Internet socket for communication with the loadmodule, allowing remote attackers to directly connect to the daemon and conduct unauthorized activities.

Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations.

An unknown vulnerability in minimalist mailing list manager versions 2.4, 2.2, and possibly others, allows remote attackers to execute arbitrary commands.

The mod_auth_shadow module 1.4 and earlier does not properly enforce the expiration of a user account and password, which could allow remote authenticated users to bypass intended access restrictions.

Jitterbug version 1.6.2 does not properly sanitize inputs, allowing remote authenticated users to execute arbitrary commands.

The mod_digest_apple module for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by modifying the createTextRange or createRange method. Exploitation of these vulnerabilities may lead to unauthorized access to data.

The GUI functionality for an interactive session in Symantec LiveUpdate versions 1.70.x through 1.90.x, used in Norton Internet Security and SystemWorks and AntiVirus from 2001 to 2004, allows local users to gain SYSTEM privileges.

Internet Explorer versions 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's 'href' to the malicious Javascript, then calling execCommand('Refresh') to refresh the page.