CVE Vulnerability Catalog

Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username provided during login.

A vulnerability in xdm allows arbitrary attackers to connect to the X server if the authComplain variable is set to false and the xdm auth directory does not exist.

Multiple buffer overflows in apcupsd before version 3.8.6 and in 3.10.x before 3.10.5 may allow attackers to cause a denial of service or execute arbitrary code, related to the usage of the vsprintf function.

CVE-2002-0842 describes a format string vulnerability in certain modifications to mod_dav used for logging 502 Bad Gateway messages. Remote attackers can exploit this vulnerability to execute arbitrary code via a specially crafted URI.

Multiple buffer overflows in Oracle 9i Database and earlier versions allow remote attackers to execute arbitrary code. The attack can be carried out through long arguments in the TO_TIMESTAMP_TZ, TZ_OFFSET, or BFILENAME functions.

The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the command line in the user's terminal.

The menuBar feature in aterm 0.42 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu.

The CVE-2002-1472 vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable pointing to a malicious module.

The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence, which could lead to injecting malicious commands into the user's command line.

miniserv.pl in Webmin before 1.070 and Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, allowing remote attackers to spoof a session ID and gain root privileges.

TruBlueEnvironment for MacOS 10.2.3 and earlier allows local users to overwrite or create arbitrary files and gain root privileges by setting a certain environment variable that is used to write debugging information.

Buffer overflow in the libIM library (libIM.a) for National Language Support (NLS) on AIX 4.3 through 5.2 allows local users to gain privileges via several possible attack vectors, including a long -im argument to aixterm.

The dtterm terminal emulator allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the user's command line.

The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the user's command line.

Unknown vulnerability in apcupsd before version 3.8.6 and in 3.10.x before 3.10.5 allows remote attackers to gain root privileges, possibly via format strings in a request to a slave server.

The FTP client for Solaris 2.6, 7, and 8 with the debug (-d) flag enabled displays the user password on the screen during login.

The PostgreSQL auth module for courier version 0.40 and earlier has an SQL injection vulnerability that allows remote attackers to execute SQL code via the user name.

The Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.

Buffer overflow in Eset Software NOD32 for UNIX before version 1.013 allows local users to execute arbitrary code via a long path name.

The uml_net tool in the kernel-utils package for Red Hat Linux 8.0 has incorrect setuid root privileges, allowing local users to modify network interfaces, such as changing ARP entries or placing interfaces into promiscuous mode.