CVE Vulnerability Catalog

The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specified length.

Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.

Ethereal versions 0.9.4 and earlier contain buffer overflow vulnerabilities that can be exploited by remote attackers to cause denial of service or execute arbitrary code.

Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument.

The multibyte support in PostgreSQL 6.5.x with SQL_ASCII encoding consumes an extra character when processing a character that cannot be converted. This could remove an escape character from the query, making the application subject to SQL injection attacks.

Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument.

Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.

Off-by-one overflow in the PreservePermissions function in rcs.c for CVS before version 1.11.2 allows local users to execute arbitrary code.

In Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2, during a mass change, the groupset of all bugs is set to the groupset of the first bug. This could inadvertently lead to insecure groupset permissions being assigned to some bugs.

Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter.

getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter. This issue is addressed by the 'UpdateUser' hot fix.

Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.

Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Tinyproxy versions 1.5.0, 1.4.3, and earlier allow remote attackers to execute arbitrary code via memory that is freed twice (double-free).

Vulnerability in pppd on UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to gain root privileges via ppptalk or ppp. This is a different vulnerability than CVE-2002-0824.

The namerslv program in AIX 4.3.3 core dumps when called with a very long argument, possibly resulting in a buffer overflow.

Opera browser versions 6.01, 6.0, and 5.12 allow remote attackers to execute arbitrary JavaScript in the security context of other sites by setting the location of a frame or iframe to a Javascript: URL.

Cross-site scripting vulnerabilities in the iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute scripts as the administrator via modified LOCID or OC parameters in administrator URLs.

Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument.

Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2 may be vulnerable to a SQL injection attack, allowing remote attackers to cause a denial of service or execute certain queries via manipulation of the sort order parameter in buglist.cgi.