CVE Vulnerability Catalog

Bugzilla before version 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading this information from web server logs or by observing the web browser's location bar.

shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the 'page' parameter.

Directory traversal vulnerability in r.pl (aka r.cgi) of Randy Parker Power Up HTML 0.8033beta allows remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the FILE parameter.

Baltimore Technologies WEBsweeper 4.02 allows remote attackers to bypass URL blacklist restrictions, enabling connections to unauthorized web servers. Attackers can achieve this by modifying requested URLs using various techniques, such as double slashes or URL encoding.

Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty site or list password, which is not properly handled during the call to the crypt function during authentication.

shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the 'file' parameter.

The edit_image.php file in Vibechild Directory Manager before version 0.91 has a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the userfile_name parameter, which is sent unfiltered to the PHP passthru function.

Vulnerability in screen before version 3.9.10, related to a multi-attach error, allows local users to gain root privileges when there is a subdirectory under /tmp/screens/.

The rmuser utility in FreeBSD 4.2 and 4.3 creates a copy of the master.passwd file with world-readable permissions while updating the original file. This could allow local users to gain privileges by reading the copied file while rmuser is running.

Buffer overflow in the smap/smapd and CSMAP daemons for Gauntlet Firewall versions 5.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted mail message.

PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display messages when invalid user IDs are used. This could allow an attacker to mislead the user into believing that a document has been signed by a trusted third party.

In HP-UX 10.26, the login process does not record failed login attempts in /var/adm/btmp, allowing attackers to conduct brute force password guessing attacks without detection.

Buffer overflow in swverify in HP-UX 11.0, and possibly other programs, allows local users to gain privileges via a long command line argument.

The keyinit program in S/Key does not require authentication to initialize a one-time password sequence, allowing an attacker with privileges to a user account to create new one-time passwords for use in other activities that may require S/Key authentication, such as sudo.

HP CIFS/9000 Server (SAMBA) A.01.07 and earlier with the 'unix password sync' option enabled calls the passwd program without specifying the username of the user making the request, which could cause the server to change the password of a different user.

PHProjekt before 2.4a allows remote attackers to perform actions as other PHProjekt users by modifying the ID number in an HTTP request to PHProjekt CGI programs.

Vulnerability in HP Process Resource Manager (PRM) C.01.08.2 and earlier, as used by HP-UX Workload Manager (WLM), allows local users to gain root privileges via modified libraries or environment variables.

Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities via an applet that has been signed by an expired certificate.

Knox Arkeia server version 4.2, and possibly other versions, installs its root user with a null password by default, allowing local and remote users to gain privileges.

ipfw in FreeBSD does not properly handle the use of 'me' in its rules when point to point interfaces are used, which allows connections from arbitrary remote hosts.