CVE Vulnerability Catalog

Directory traversal vulnerability in Carello 1.3 allows remote attackers to execute programs on the server via a .. (dot dot) in the VBEXE parameter.

The CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.

Buffer overflow in the bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query.

Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication.

The CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, potentially gaining privileges. This issue occurs in the AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.

The web interface for Pingtel xpressa SIP-based VoIP phone versions 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, allowing remote attackers to steal and easily decode passwords via sniffing.

Pingtel xpressa SIP-based VoIP phones versions 1.2.5 through 1.2.7.4 do not time out inactive administrator sessions, which could allow other users to perform administrator actions if the administrator does not explicitly end the session.

The registry key containing the SQL Server service account information in Microsoft SQL Server 2000 has insecure permissions, allowing local users to gain privileges.

The web interface for the Pingtel xpressa SIP-based VoIP phone versions 1.2.5 to 1.2.7.4 allows authenticated users to modify Call Forwarding settings, potentially leading to call hijacking.

Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.

Cross-site scripting vulnerability in GoAhead Web Server 2.1 allows remote attackers to execute script as other web users via script in a URL that generates a '404 not found' message, which does not quote the script.

Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a long argument to the NS-rel-doc-name parameter.

A heap-based buffer overflow in the message decoding functionality for the PGP Outlook Encryption Plug-In allows remote attackers to modify the heap and gain privileges via a large, malformed mail message.

An off-by-one buffer overflow in the ssl_compat_directive function allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries. This issue affects mod_ssl version 2.8.9 and earlier.

InterScan VirusWall 3.52 build 1462 allows remote attackers to bypass virus protection via e-mail messages with headers that violate RFC specifications by having (or missing) space characters in unexpected places.

SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server.

Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL.

An undocumented SNMP read/write community string ('NoGaH$@!') in Avaya P330, P130, and M770-ATM Cajun products allows remote attackers to gain administrative privileges.

Anthill allows remote attackers to bypass authentication and file bug reports by directly accessing the postbug.php program instead of enterbug.php.

PHPGroupware version 0.9.12 and earlier, when running with the magic_quotes_gpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack.