CVE Vulnerability Catalog

Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.

The PuTTY terminal emulator version 0.53 allows attackers to modify the window title via a certain character escape sequence, which could lead to injecting malicious commands into the user's command line.

The aterm terminal emulator 0.42 allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the command line in the user's terminal.

CVE-2003-0081 describes a format string vulnerability in packet-socks.c of the SOCKS dissector for Ethereal versions 0.8.7 through 0.9.9. This allows remote attackers to execute arbitrary code via SOCKS packets containing format string specifiers.

The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.

Clearswift MAILsweeper 4.x allows remote attackers to bypass attachment detection via an attachment that does not specify a MIME-Version header field, which is processed by some mail clients.

The web interface for SOHO Routefinder 550 firmware 4.63 and earlier, and possibly later versions, has a default 'admin' account with a blank password. This could allow attackers on the LAN side to conduct unauthorized activities.

Buffer overflows in protegrity.dll of Protegrity Secure.Data Extension Feature (SEF) before version 2.2.3.9 allow attackers with SQL access to execute arbitrary code via extended stored procedures.

The hanterm (hanterm-xf) terminal emulator version 2.0.5 and earlier, and possibly later versions, allows attackers to modify the window title via a certain character escape sequence. This could lead to the insertion of a malicious sequence back into the command line in the user's terminal.

Buffer overflow in the gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before version 6.5 allows remote attackers to execute arbitrary code via a long HTTP request URL.

Buffer overflow in Sendmail versions 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments processed by the crackaddr function in headers.c.

Buffer overflow in the MP3 broadcasting module of Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via a long filename.

Apple Darwin Streaming Administration Server version 4.1.2 and QuickTime Streaming Server version 4.1.1 allow remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method. This code is inserted into a log file and executed when the log is viewed using a browser.

parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.

Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.

Buffer overflow in the RPC preprocessor for Snort 1.8 and 1.9.x before 1.9.1 allows remote attackers to execute arbitrary code via fragmented RPC packets.

Apple File Protocol (AFP) in Mac OS X before 10.2.4 allows administrators to log in as other users by using the administrator password.

The xterm terminal emulator in XFree86 version 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence. This could lead to the insertion of a malicious sequence back into the command line in the user's terminal.

An unknown vulnerability in the CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user and possibly execute PHP code by bypassing the CGI force redirect settings.

Buffer overflow in Cisco IOS versions 11.2.x to 12.0.x allows remote attackers to cause a denial of service and possibly execute commands via a large number of OSPF neighbor announcements.