CVE Vulnerability Catalog

Webmin 0.96 and Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication. Attackers can gain privileges by using certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.

Cross-site scripting vulnerabilities in the iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute scripts as the administrator via modified LOCID or OC parameters in administrator URLs.

Opera browser versions 6.01, 6.0, and 5.12 allow remote attackers to execute arbitrary JavaScript in the security context of other sites by setting the location of a frame or iframe to a Javascript: URL.

The namerslv program in AIX 4.3.3 core dumps when called with a very long argument, possibly resulting in a buffer overflow.

PHPNetToolpack 0.1 relies on its environment's PATH to find and execute the traceroute program, which could allow local users to gain privileges by inserting a Trojan horse program into the search path.

Vulnerability in pppd on UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to gain root privileges via ppptalk or ppp. This is a different vulnerability than CVE-2002-0824.

Tinyproxy versions 1.5.0, 1.4.3, and earlier allow remote attackers to execute arbitrary code via memory that is freed twice (double-free).

Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.

getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter. This issue is addressed by the 'UpdateUser' hot fix.

Off-by-one overflow in the PreservePermissions function in rcs.c for CVS before version 1.11.2 allows local users to execute arbitrary code.

The 'sa' account in Microsoft SQL Server 2000, SQL Server 7.0, and MSDE 1.0 is installed with a default null password, allowing remote attackers to gain privileges. This also affects third-party packages that use these products.

CVE-2000-1208 describes a vulnerability in the startprinting() function in printjob.c of the BSD-based lpr lpd package. It may allow local users to gain privileges through an improper syslog call that uses format strings from the checkremote() call.

Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.

CVE-2002-0458 is a cross-site scripting vulnerability in News-TNK version 1.2.1 and earlier that allows remote attackers to execute arbitrary Javascript via the WEB parameter.

AeroMail versions before 1.45 have a cross-site scripting vulnerability in message.php, allowing remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.

CVE-2002-0412 describes a vulnerability in the TraceEvent function in ntop before version 2.1 that allows remote attackers to execute arbitrary code by injecting format strings into calls to the syslog function. This can be done via an HTTP GET request, a username in HTTP authentication, or a password in HTTP authentication.

A cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.

KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems do not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.

Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.