CVE Vulnerability Catalog

Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the s_key cookie.

The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, allowing remote attackers with access to the admin.html file to gain administrative privileges to SWS.

The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well known location on the local file system, allowing attackers to execute HTML scripts in the Local Computer zone.

The FTP proxy in Symantec Raptor Firewall 6.5.3 and Enterprise 7.0 rewrites an FTP server's 'FTP PORT' responses, allowing remote attackers to redirect FTP data connections to arbitrary ports, a variant of the 'FTP bounce' vulnerability.

Buffer overflow in Tivoli Storage Manager (TSM) versions 3.1 through 5.1 for server and storage agents, and versions 4.2 and 5.1 for TSM Client Acceptor Service, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 1580 or 1581.

Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via long authentication data.

The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer.

The XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.

Fasttrack p2p, used in applications such as KaZaA, grokster, and morpheus, allows remote attackers to spoof other users by modifying the username and network information in the message header.

Buffer overflow in University of Washington imap server (uw-imapd) in versions imap-2001 and imap-2001a, as well as earlier versions, allows remote authenticated users to execute arbitrary code via a long BODY request.

Buffer overflow in Essentia Web Server 2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL.

Windows Media Player version 8.00.00.4477, and possibly other versions, automatically detects and executes .wmf files and other content, even when the file's extension or content type does not specify .wmf. This could make it easier for attackers to conduct unauthorized activities via Trojan horse files containing .wmf content.

Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a LIST command containing a large number of /, *, and .. characters.

Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long HTTP GET request.

Buffer overflows in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allow remote attackers to execute arbitrary code via (1) a long DNS hostname determined using reverse DNS lookups, (2) a long AUTH string, or (3) certain data in the xtell request.

Snitz Forums 2000 versions 3.3.03 and earlier have a cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts as other Forums 2000 users via Javascript in an IMG tag.

Cross-site scripting vulnerability in Ikonboard 3.0.1 allows remote attackers to execute arbitrary script as other Ikonboard users and steal cookies via Javascript in an IMG tag.

BadBlue before version 1.6.1 beta has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts and possibly additional commands via a URL containing JavaScript.

Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-*.reg file which contains the administrator name and password in cleartext.

Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing.