CVE Vulnerability Catalog

Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts.

Windows 2000 Terminal Services do not properly lock themselves after disconnection when left idle until the screen saver activates. This could allow attackers to gain administrator privileges.

csChatRBox.cgi in CGIScript.net csChat-R-Box allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.

Directory traversal vulnerability in WorldClient.cgi in WorldClient for Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to delete arbitrary files via a '..' (dot dot) in the Attachments parameter.

Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the 'Log on locally' privilege.

Symantec Norton AntiVirus 2002 allows remote attackers to send viruses that bypass e-mail scanning via a NULL character in the MIME header before the virus.

Symantec Norton AntiVirus (NAV) 2002 allows remote attackers to bypass the initial virus scan and cause NAV to prematurely stop scanning by using a non-RFC compliant MIME header.

PHProjekt versions 2.0 through 3.1 relies on the $PHP_SELF variable for authentication, allowing remote attackers to bypass authentication for scripts via a request to a .php file containing 'sms' in the URL.

The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails.

Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, allowing remote attackers to gain unauthorized access.

Buffer overflow in tnslsnr of Oracle 8i Database Server 8.1.5 for Linux allows local users to execute arbitrary code as the oracle user via a long command line argument.

A buffer underflow in ssldump 0.9b2 and earlier allows remote attackers to cause a denial of service via a crafted SSLv2 challenge value.

Unspecified vulnerability in the pcilynx ieee1394 firewire driver in Linux kernel before 2.4.20, related to 'wrap handling'.

Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, allowing remote attackers to gain access.

The RPC module in Webmin versions 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remote_foreign_require and remote_foreign_call requests.

Netgear FM114P firmware version 1.3 stores configuration information such as DDNS username and password, and MAC address filtering table in cleartext. This could allow local users to obtain sensitive information.

The 'System Restore' directory and subdirectories, as well as other subdirectories in the 'System Volume Information' directory on Windows XP Professional have insecure access control list (ACL) permissions, allowing local users to access restricted files and modify registry settings.

SSH Secure Shell for Servers versions 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.

Unknown vulnerability in AIX before version 4.0, with unknown attack vectors and unknown impact, referred to as 'security issue'.

MyPHPLinks versions 2.1.9 and 2.2.0 have an SQL injection vulnerability in admin/auth/checksession.php that allows remote attackers to execute arbitrary SQL commands via the idsession parameter.