CVE Vulnerability Catalog

Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.5.2B does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.

Buffer overflow in AnalogX SimpleServer:WWW version 1.16 and earlier allows remote attackers to cause a denial of service (crash) and execute code via a long HTTP request method name.

Multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to execute arbitrary script as other CBMS users.

Jana Server versions 2.x through 2.2.1, and 1.4.6 and earlier do not restrict the number of unsuccessful login attempts, making it easier for remote attackers to gain privileges via brute force username and password guessing.

Cisco VPN 3000 Concentrator versions 2.2.x and 3.x before 3.5.3 introduces an 'HTTPS on Public Inbound (XML-Auto)(forward/in)' rule but sets the protocol to 'ANY', allowing arbitrary traffic to pass through the concentrator.

The summary_graph_functions.php file in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location of the PHP code.

Buffer overflow in HylaFAX faxgetty before version 4.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long line of image data.

CVE-2002-0958 is a cross-site scripting vulnerability in browse.php for PHP(Reactor) 1.2.7 that allows remote attackers to execute scripts as other users via the go parameter in the comments section.

CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privileges via newlines in the title field of the edit page.

BlackICE Agent 3.1.eal does not always reactivate after a system standby, which could allow remote attackers and local users to bypass intended firewall restrictions.

Cross-site scripting (XSS) vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier allows remote attackers to execute arbitrary script as other web site visitors via script in the num parameter, which is not filtered in the resulting error message.

CGIScript.net csNews.cgi allows remote authenticated users to read arbitrary files and possibly gain privileges via the (1) pheader or (2) pfooter parameters in the 'Advanced Settings' capability.

Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier allow local users to gain root privileges via long parameters (-U, -D, -P, -S, -N, -u).

Buffer overflow in the Web Messaging daemon for Ipswitch IMail before version 7.12 allows remote attackers to execute arbitrary code via a long HTTP GET request for HTTP/1.0.

Buffer overflow in SHOUTcast 1.8.9 and other versions before 1.8.12 allows a remote authenticated DJ to execute arbitrary code on the server via a long value in a header whose name begins with 'icy-'.

Multiple format string vulnerabilities in in.rarpd (ARP server) on Solaris, Caldera UnixWare and Open UNIX, and possibly other operating systems, allow remote attackers to execute arbitrary code via format strings that are not properly handled in the functions syserr and error.

Lotus Domino R4 allows remote attackers to bypass access restrictions for files in the web root via an HTTP request appended with a '?' character, which is treated as a wildcard character.

Buffer overflow in traffic_manager for Inktomi Traffic Server versions 4.0.18 through 5.2.2, Traffic Edge versions 1.1.2 and 1.5.0, and Media-IXT version 3.0.4 allows local users to gain root privileges via a long path argument.

login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to 'insert,' which adds the provided username to the adminUsers table.

Cross-site scripting vulnerability in TransWARE Active! mail 1.422 and 2.0 allows remote attackers to execute arbitrary code via a certain e-mail header, which is not properly filtered.