CVE Vulnerability Catalog

Lotus Domino server version 5.0.8 with NoBanner enabled allows remote attackers to determine the physical path of the server via a request for a nonexistent file with a .pl extension, leaking the pathname in the error message. Additionally, any request causing an HTTP 500 error leaks the server's version name in the HTTP error message.

Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir.

A cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.

Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) -hfn argument.

The web administration interface for NetGear RT314 and RT311 Gateway Routers has a cross-site scripting (XSS) vulnerability that allows remote attackers to execute arbitrary scripts on another client via a crafted URL.

Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a flood of large ICMP ping packets.

Lucent VitalSuite versions 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allow remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.

Castelle FaxPress, possibly version 6.3 and others, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event.

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields. These headers can cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message.

Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity.

A cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file.

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields. These headers can cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message.

The uudecode program in the sharutils package before version 4.2.1 does not check if the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands.

The vulnerability in nsd on SGI IRIX before version 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file.

PowerFTP Personal FTP Server versions 2.03 through 2.10 stores sensitive account information in plaintext in the ftpserver.ini file, allowing attackers with access to the file to gain privileges.

Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header.

Internet Explorer 6 has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts via an Extended HTML Form, whose output from the remote server is not properly cleansed.

Buffer overflows in wmtv version 0.6.5 and earlier may allow local users to gain elevated privileges.

Buffer overflow in AOL Instant Messenger (AIM) 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711.

The pam_ldap PAM LDAP module before version 144 has a format string vulnerability in the logging function, allowing attackers to execute arbitrary code via format strings in the configuration file name.