CVE Vulnerability Catalog

PhpSmsSend version 1.0 has a vulnerability that allows remote attackers to execute arbitrary commands via an SMS message containing shell metacharacters.

Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via format specifiers in a command line argument.

Etype Eserv 2.97 allows remote attackers to redirect traffic to other sites via the PORT command.

Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname.

Buffer overflow in sastcpd in SAS/Base 8.0 and 8.1 or in objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via large command line argument.

Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter.

CVE-2002-0074 describes a cross-site scripting vulnerability in the Help File search facility for Internet Information Server (IIS) versions 4.0, 5.0, and 5.1. This allows remote attackers to embed scripts into another user's session.

Funk Software Proxy Host versions 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control. This allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.

Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.

Funk Software Proxy Host 3.x uses weak encryption for the Proxy Host password, allowing local users to gain privileges by recovering passwords from the PHOST.INI file or the Windows registry.

Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code.

Buffer overflow in the ASP Server-Side Include Function in IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.

Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers, potentially leading to denial of service or execution of arbitrary code.

Buffer overflow in various Microsoft applications for Macintosh allows remote attackers to cause a denial of service (crash) or execute arbitrary code by invoking the file:// directive with a large number of / characters. Affects Internet Explorer 5.1, Outlook Express 5.0 through 5.0.2, Entourage v. X and 2001, PowerPoint v. X, 2001, and 98, and Excel v. X and 2001 for Macintosh.

Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, known as the 'Local Applescript Invocation' vulnerability.

CVE-2002-0159 describes a format string vulnerability in the administration function of Cisco Secure Access Control Server (ACS) for Windows, versions 2.6.x and earlier and 3.x up to 3.01 (build 40). This allows remote attackers to crash the CSADMIN module or execute arbitrary code via format strings in the URL to port 2002.

Cross-site scripting vulnerability in analog before version 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is logged in web logfiles and not properly filtered by analog during display.

Imlib before 1.9.13 sometimes uses the NetPBM package to load trusted images, which could allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain weaknesses of NetPBM.

Vulnerability in Imlib before version 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments passed to malloc, resulting in heap corruption.

Zope versions 2.2.0 through 2.5.1 do not properly verify access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.