CVE Vulnerability Catalog

BadBlue Enterprise Edition versions 1.7 through 1.74 attempts to restrict administrator actions to the local host's IP address but does not provide additional authentication. This allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request that accesses the dir.hts page on the localhost and adds an entire hard drive to be shared.

The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP port scan using a tool such as nmap.

CuteCast Forum version 1.2 stores passwords in plaintext under the web document root, allowing remote attackers to obtain the passwords via an HTTP request to a .user file.

An unknown vulnerability in Sun Solaris 8.0 allows local users to cause a denial of service (kernel panic) via a program that uses /dev/poll, triggering a NULL pointer dereference.

Buffer overflow in ZMailer before version 2.99.51_1 allows remote attackers to execute arbitrary code during HELO processing from an IPv6 address, possibly using an address that resolves to a long hostname.

The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the printer name.

Eudora email client 5.1.1 with 'use Microsoft viewer' enabled allows remote attackers to execute arbitrary programs via an HTML email message containing a META refresh tag that references an embedded .mhtml file with ActiveX controls.

php.exe in PHP versions 3.0 through 4.2.2, when running on Apache, does not terminate properly, allowing remote attackers to cause a denial of service via a direct request without arguments.

3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, allowing remote attackers to modify shopping cart prices by using JavaScript to decrypt the cookie containing the data.

Buffer overflow in ftpd 5.4 in 3Com NBX 4.0.17 or ftpd 5.4.2 in 3Com NBX 4.1.4 allows remote attackers to cause a denial of service (crash) via a long CEL command.

Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal (WSC-WebPortal) 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) l parameter to customize.php or the (2) pg parameter to index.php.

PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to backend.php, screen.php, or admin/modules/comment.php.

WikkiTikkiTavi versions before 0.21 have a PHP remote file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the TemplateDir variable.

Buffer overflow in GNU DataDisplay Debugger (DDD) 3.3.1 allows local users to execute arbitrary code and possibly gain privileges via a long HOME environment variable.

The FTP service in Zaurus PDAs SL-5000D and SL-5500 does not require authentication, allowing remote attackers to access the file system as root.

The ping utility in networking_utils.php in Sourcecraft Networking_Utils 1.0 allows remote attackers to read arbitrary files via shell metacharacters in the Domain name or IP address argument.

Unknown vulnerability in the AUTH_DES authentication for RPC in Solaris 2.5.1, 2.6, and 7, SGI IRIX 6.5 to 6.5.19f, and possibly other platforms, allows remote attackers to gain privileges.

In Open WebMail version 1.81 and earlier, the openwebmail_init function allows local users to execute arbitrary code via .. (dot dot) sequences in a login name. Such a name is used in the sessionid parameter for the openwebmail-abook.pl script, leading to the discovery of a configuration file that specifies additional code to be executed.

Buffer overflow in Winamp 2.81 allows remote attackers to execute arbitrary code via a long Artist ID3v2 tag in an MP3 file.

Multiple buffer overflows in Winamp 3.0 when displaying an MP3 in the Media Library window allow remote attackers to execute arbitrary code via an MP3 file containing a long (1) Artist or (2) Album ID3v2 tag.