CVE Vulnerability Catalog

Vulnerability in the authentication process for the SMTP service in Microsoft Windows 2000 allows remote attackers to use incorrect credentials to gain privileges and conduct activities such as mail relaying.

Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags.

Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent filtering of SCRIPT tags by embedding scripts within certain HTML tags, such as onload in the BODY tag, href in the A tag, BUTTON tag, INPUT tag, or any other tag where scripts can be defined.

The ActiveX control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML email message or web page.

Oracle E-Business Suite Release 11i Applications Desktop Integrator (ADI) version 7.x includes a debug version of FNDPUB11I.DLL, which logs the APPS schema password in cleartext in a debug file. This allows local users to obtain the password and gain privileges.

Buffer overflow in dsh in dqs 3.2.7 in SuSE Linux 7.0 and earlier, and possibly other operating systems, allows local users to gain privileges via a long first command line argument.

eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, allowing a remote attacker to send arbitrary length strings to IIS, contrary to an advertised feature of SecureIIS.

eEye SecureIIS versions 1.0.3 and earlier allows a remote attacker to bypass filtering of requests made to SecureIIS by escaping HTML characters within the request, which could allow a remote attacker to use restricted variables and perform directory traversal attacks on vulnerable programs.

Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document.

OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack.

The a1disp.cgi program in Drummond Miles A1Stats prior to version 1.6 allows a remote attacker to execute commands via a specially crafted URL containing shell metacharacters.

The crontab in Vixie cron 3.0.1 and earlier does not properly drop privileges after a failed parsing of a modification operation, which could allow a local attacker to gain additional privileges when an editor is called to correct the error.

ScreamingMedia SITEWare versions 2.5 through 3.1 allow a remote attacker to read world-readable files via a .. (dot dot) attack through (1) the SITEWare Editor's Desktop or (2) the template parameter in SWEditServlet.

HP Event Correlation Service (ecsd) included with OpenView Network Node Manager 6.1 allows a remote attacker to gain additional privileges via a buffer overflow attack in the '-restore_config' command line parameter.

Microsoft Word 2000 does not check AutoRecovery (.asd) files for macros, allowing a local attacker to execute arbitrary macros with the user ID of the Word user.

The web management service on Cisco Content Service series 11000 switches before WebNS 4.01B29s or WebNS 4.10B17s allows a remote attacker to gain additional privileges by directly requesting the web management URL instead of navigating through the interface.

The FTP server on Cisco Content Service 11000 series switches before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands.

Becky! version 2.00.05 and earlier can allow a remote attacker to gain additional privileges via a buffer overflow attack on long messages without newline characters.

Minicom version 1.83.1 and earlier allows a local attacker to gain additional privileges via numerous format string attacks.

Buffer overflow in the BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.