CVE Vulnerability Catalog

SSH protocols 1 and 2, as implemented in OpenSSH and other packages, have various weaknesses that can allow a remote attacker to obtain information via sniffing. Attackers may learn about password lengths, the type of authentication used, and the lengths of shell commands.

In SCO OpenServer versions 5.0 through 5.0.6, a vulnerability allows a local attacker to gain additional privileges via a buffer overflow attack in the first command line argument.

lpadmin in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow attack in the first argument to the command.

Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary .jsp files via a '..' (dot dot) attack.

Headlight Software MyGetright prior to 1.0b allows a remote attacker to upload and/or overwrite arbitrary files via a malicious .dld (skins-data) file which contains long strings of random data.

The Nirvana Editor (NEdit) 5.1.1 and earlier allows a local attacker to overwrite other users' files via a symlink attack on (1) backup files or (2) temporary files used when nedit prints a file or portions of a file.

O'Reilly Website Professional 2.5.4 and earlier allows remote attackers to determine the physical path to the root directory via a URL request containing a ':' character.

A vulnerability in the AIF interface in MPE/iX 5.5 through 6.5 on HP3000 allows an attacker to gain additional privileges and access databases via the AIFCHANGELOGON program.

Carello E-Commerce version 1.2.1 and earlier allows a remote attacker to gain additional privileges and execute arbitrary commands via a specially constructed URL.

The deliver program in MMDF 2.43.3b in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow in the first argument to the command.

Sun Chili!Soft version 3.5.2 on Linux and 3.6 on AIX creates default admin credentials in the default installation.

Sun Chili!Soft ASP has weak permissions on various configuration files, allowing a local attacker to gain additional privileges and create a denial of service.

FormMail.pl in version 1.6 and earlier allows a remote attacker to send anonymous email (spam) by modifying the recipient and message parameters.

The vulnerability in InoculateIT 6.0 allows a local attacker to overwrite arbitrary files via a symlink attack on /tmp/ftpdownload.log.

DCScripts DCForum versions 2000 and earlier allow a remote attacker to gain additional privileges by inserting pipe symbols (|) and newlines into the last name in the registration form, which will create an extra entry in the registration database.

CVE-2001-0561 describes a directory traversal vulnerability in Drummond Miles A1Stats prior to version 1.6 that allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in the scripts a1disp2.cgi, a1disp3.cgi, or a1disp4.cgi.

ZyXEL Prestige 642R and 642R-I routers do not filter the Telnet and FTP ports on the external WAN interface from inside access, allowing someone on an internal computer to reconfigure the router if the password is known.

SSH Secure Shell 3.0.0 on Unix systems does not properly perform password authentication to the sshd2 daemon, allowing local users to gain access to accounts with short password fields, such as locked accounts using 'NP' in the password field.

Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags.

HP Event Correlation Service (ecsd) included with OpenView Network Node Manager 6.1 allows a remote attacker to gain additional privileges via a buffer overflow attack in the '-restore_config' command line parameter.