CVE Vulnerability Catalog

The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS versions 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.

SQL injection vulnerability in Gender MOD 1.1.3 allows remote attackers to gain administrative access via the user_level parameter in the User Profile page.

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server.

Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.

The POP3 proxy service (POPROXY.EXE) in Norton AntiVirus 2001 allows local users to cause a denial of service through a long username with multiple /localhost entries.

AtGuard 3.2 allows remote attackers to bypass firewall filters and execute prohibited programs by changing the filenames to permitted filenames.

The x_news.php file in X-News (x_news) version 1.1 and earlier allows remote attackers to gain administrative privileges by stealing and replaying the md5_password cookie.

Buffer overflow in CHttpServer::OnParseError in the ISAPI extension when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0 and 6.0 before SP3 can lead to denial of service and potentially execute arbitrary code by remote attackers.

CVE-2002-2022 describes a format string vulnerability in Kaffe OpenVM 1.0.6 and earlier that allows local users to execute arbitrary code when a java.lang.NoClassDefFoundError is thrown, via format specifiers in the forName attribute.

Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allow local users to execute arbitrary code via (1) a long ABLANG environment variable in phlocale or (2) a long -u option to pkg-installer.

UTStarcom BAS 1000 version 3.1.10 creates several default or backdoor accounts and passwords, allowing remote attackers to gain access to the system.

Netgear RP114 Cable/DSL router with firmware 3.26 uses a default administrator password and accepts admin logins on the external interface, allowing remote attackers to gain privileges if the password is not changed.

Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC versions 2.5 through 2.7 may allow remote attackers to have unknown impact with unknown attack vectors.

An unknown vulnerability in WesMo phpEventCalendar 1.1 allows remote attackers to execute arbitrary commands via unknown attack vectors.

Buffer overflow in AN HTTPd versions 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username.

Terminal 1.3 in Apple Mac OS X 10.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link, which is executed by Terminal.app window.

SQLData Enterprise Server 3.0 has a stack-based buffer overflow that allows a remote attacker to execute arbitrary code and cause a denial of service via a long HTTP request.

Buffer overflow in the French documentation patch for Gnuplot 3.7 in SuSE Linux before 8.0 allows local users to execute arbitrary code as root.

ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension.

Unspecified vulnerability in Internet Group Management Protocol (IGMP) of HP Tru64 4.0F through 5.1A allows remote attackers to cause a denial of service via unknown attack vectors.