CVE Vulnerability Catalog

Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges.

Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, may allow rexec or rsh to run another user's shell, or atrun to change to a different user's directory. This issue may be due to memory allocation failures or an incorrect call to auth_approval().

Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter.

OpenBSD versions 2.9 and 3.0 have a vulnerability in the mail program that processes the tilde (~) escape character in a message even when not in interactive mode. This could allow local users to gain root privileges via calls to mail in cron.

PHPGroupware version 0.9.12 and earlier, when running with the magic_quotes_gpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack.

Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query.

Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter.

Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache.

Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the s_key cookie.

xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, allowing remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems.

The Windows Media Device Manager (WMDM) Service in Microsoft Windows Media Player 7.1 on Windows 2000 systems allows local users to obtain LocalSystem rights via a program that connects to an invalid local storage device.

Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.

The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, allowing remote attackers with access to the admin.html file to gain administrative privileges to SWS.

Apache versions 1.3 through 1.3.24 and 2.0 through 2.0.36 are vulnerable to an attack that can lead to denial of service and potentially execute arbitrary code. Attackers can exploit a chunk-encoded HTTP request that causes Apache to use an incorrect size.

Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions.

The default configuration of the LPRng print spooler in Red Hat Linux 7.0 through 7.3 and Mandrake 8.1 and 8.2 accepts print jobs from arbitrary remote hosts.

The FTP proxy in Symantec Raptor Firewall 6.5.3 and Enterprise 7.0 rewrites an FTP server's 'FTP PORT' responses, allowing remote attackers to redirect FTP data connections to arbitrary ports, a variant of the 'FTP bounce' vulnerability.

Buffer overflow in gopher client for Microsoft Internet Explorer versions 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.

The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer.

In FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, local users can access restricted files by closing file descriptors 0, 1, or 2. This may lead to unauthorized reading or writing of data by setuid processes.