CVE Vulnerability Catalog

The preferences.php file in Simple Internet Publishing System (SIPS) before version 0.3.1 contains a vulnerability that allows remote attackers to gain administrative privileges by injecting a linebreak in the 'theme' field, leading to the Status::admin line being added to the password file.

Identix BioLogon 3 allows users with physical access to the system to gain administrative privileges by using CTRL-ALT-DEL and running a 'Browse' function, which runs Explorer with SYSTEM privileges.

Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain. This could allow remote attackers to execute arbitrary script in documents that the user does not expect.

Buffer overflow in Microsoft MSN Chat ActiveX Control, used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX.

A cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via form fields such as TITLE, DESCRIPTION, EMAIL, and phone numbers.

The default configuration of Arescom NetDSL 800 does not require authentication, allowing remote attackers to cause a denial of service or reconfigure the router.

Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string of format string characters such as "%d".

The web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier allows unauthorized users to bypass authentication via a direct HTTP request to the web_access.html file, enabling the user to change the switch's configuration and modify the administrator password.

CVE-2002-0246 describes a vulnerability in the message catalog library functions in UnixWare 7.1.1 that allows local users to gain privileges by modifying the LC_MESSAGE environment variable. This enables reading other message catalogs containing format strings from setuid programs such as vxprint.

Lotus Domino server version 5.0.8 with NoBanner enabled allows remote attackers to determine the physical path of the server via a request for a nonexistent file with a .pl extension, leaking the pathname in the error message. Additionally, any request causing an HTTP 500 error leaks the server's version name in the HTTP error message.

Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir.

A cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.

Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) -hfn argument.

The web administration interface for NetGear RT314 and RT311 Gateway Routers has a cross-site scripting (XSS) vulnerability that allows remote attackers to execute arbitrary scripts on another client via a crafted URL.

Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a flood of large ICMP ping packets.

Lucent VitalSuite versions 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allow remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.

Castelle FaxPress, possibly version 6.3 and others, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event.

Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, which is not properly handled by the logging utility.

Ghostscript versions before 6.53 allow attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice.

Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions. This could allow remote attackers with access to the ID to gain privileges as that user.