CVE Vulnerability Catalog

The GetPassword function in function.php of SiteNews versions 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password.

Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell metacharacters in the -c argument for (1) scoadminreg.cgi or (2) service_action.cgi.

Outlook Express 5.5 and 6.0 on Windows treats a carriage return ('CR') in a message header as a valid carriage return/line feed combination (CR/LF). This could allow remote attackers to bypass virus protection and other filtering mechanisms via a mail message with headers that only contain the CR, causing Outlook to create separate headers.

Directory traversal vulnerability in Add2it Mailman Free 1.73 and earlier allows remote attackers to modify arbitrary files via a .. (dot dot) in the list parameter.

Buffer overflow in various decoders in Ettercap 0.6.3.1 and earlier, occurring on networks with an MTU greater than 2000, allows remote attackers to execute arbitrary code via large packets.

The Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator. This allows remote attackers to gain privileges via the username/password combinations.

Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existence of arbitrary files or execute any Perl program on the system via a .. (dot dot) in the p parameter.

pforum version 1.14 and earlier does not explicitly enable PHP magic quotes, allowing remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default.

Add2it Mailman Free version 1.73 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the list parameter.

NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.

Versions of wmtv 0.6.5 and earlier allow local users to modify arbitrary files via a symlink attack on a configuration file.

The pam_ldap PAM LDAP module before version 144 has a format string vulnerability in the logging function, allowing attackers to execute arbitrary code via format strings in the configuration file name.

Buffer overflow in AOL Instant Messenger (AIM) 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711.

Heap-based buffer overflow in the cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.

The vulnerability in nsd on SGI IRIX before version 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file.

Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain. This could allow remote attackers to execute arbitrary script in documents that the user does not expect.

Buffer overflow in EasyBoard 2000 version 1.27 (also known as EZboard) allows remote attackers to execute arbitrary code via a long boundary value in a multipart Content-Type header.

Directory traversal vulnerability in InstantServers MiniPortal 1.1.5 and earlier allows remote authenticated users to read arbitrary files via a modified GET command.

Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, which is not properly handled by the logging utility.

Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity.