CVE Vulnerability Catalog

Funk Software Proxy Host 3.x uses weak encryption for the Proxy Host password, allowing local users to gain privileges by recovering passwords from the PHOST.INI file or the Windows registry.

Funk Software Proxy Host versions 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control. This allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.

Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.

CVE-2002-0074 describes a cross-site scripting vulnerability in the Help File search facility for Internet Information Server (IIS) versions 4.0, 5.0, and 5.1. This allows remote attackers to embed scripts into another user's session.

CVE-2002-0159 describes a format string vulnerability in the administration function of Cisco Secure Access Control Server (ACS) for Windows, versions 2.6.x and earlier and 3.x up to 3.01 (build 40). This allows remote attackers to crash the CSADMIN module or execute arbitrary code via format strings in the URL to port 2002.

Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, known as the 'Local Applescript Invocation' vulnerability.

Buffer overflow in various Microsoft applications for Macintosh allows remote attackers to cause a denial of service (crash) or execute arbitrary code by invoking the file:// directive with a large number of / characters. Affects Internet Explorer 5.1, Outlook Express 5.0 through 5.0.2, Entourage v. X and 2001, PowerPoint v. X, 2001, and 98, and Excel v. X and 2001 for Macintosh.

Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers, potentially leading to denial of service or execution of arbitrary code.

Buffer overflow in the ASP Server-Side Include Function in IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.

Lotus Domino Servers 5.x, 4.6x, and 4.5x allow attackers to bypass the intended Reader and Author access list for a document's object via a Notes API call (NSFDbReadObject) that directly accesses the object.

AOL Instant Messenger (AIM) version 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions.

Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.

Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.

Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request.

LogWatch 2.5 allows local users to gain root privileges via a symlink attack, which is a different vulnerability than CVE-2002-0162.

Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.

Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header.

Check Point Firewall-1 versions 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules. This could allow local users to gain privileges or modify the firewall policy.

The vipw program in the util-linux package before version 2.10 causes the /etc/shadow file to be world-readable in some cases, making it easier for local users to perform brute force password guessing.

Oracle Configurator versions before 11.5.7.17.32 and 11.5.6.16.53 allow remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter set to 'version' or 'host'.