CVE Vulnerability Catalog

Zetetic Secure Tool for Recalling Important Passwords (STRIP) version 0.5 and earlier for PalmOS allows a local attacker to recover passwords via a brute force attack. This is made feasible by STRIP's use of SysRandom, seeded by TimeGetTicks, and an implementation flaw that significantly reduces the password search space.

The Orinoco RG-1000 wireless Residential Gateway uses the last 5 digits of the 'Network Name' (SSID) as the default WEP encryption key. This allows a remote attacker to determine the WEP key and decrypt RG-1000 traffic.

The Lucent Closed Network protocol can allow remote attackers to join Closed Network networks which they do not have access to. The 'Network Name' or SSID, which is used as a shared secret to join the network, is transmitted in the clear.

Sdbsearch.cgi in SuSE Linux versions 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file containing filenames with shell metacharacters. Attackers can exploit the HTTP_REFERER variable to point to the directory containing the keylist.txt file.

In prefs.php of phpBB version 1.4.0 and earlier, remote authenticated users can execute arbitrary PHP code via an invalid language value. This causes the variables $l_statsblock in prefs.php or $l_privnotify in auth.php to be improperly initialized.

phpMyAdmin versions 2.2.0rc3 and earlier allow remote attackers to execute arbitrary commands by injecting them into the strCopyTableOK argument in tbl_copy.php or the strRenameTableOK argument in tbl_rename.php.

The ip_masq_irc module version 2.2 allows remote attackers to bypass intended firewall restrictions by sending a 'DCC SEND' request to a malicious server listening on port 6667.

CGI scripts such as login.gas.bat in Entrust getAccess allow remote attackers to execute Java programs and possibly arbitrary commands by specifying an alternate -classpath argument.

Directory traversal vulnerability in SnapStream PVS 1.2a allows remote attackers to read arbitrary files via a .. (dot dot) attack in the requested URL.

Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to various FTP commands. This vulnerability can be exploited through commands such as DELE, MDTM, and others.

CVE-2001-1022 describes a format string vulnerability in the pic utility in groff 1.16.1 and other versions, and jgroff before 1.15. This allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command.

Vulnerability in MasqMail before version 0.1.15 allows local users to gain privileges via piped aliases.

Mambo Site Server versions 3.0.0 through 3.0.5 have a vulnerability that allows remote attackers to gain Mambo administrator privileges by setting the PHPSESSID parameter and providing the appropriate administrator information in other parameters.

The default configuration of Sambar Server 5 and earlier uses a symmetric key compiled into the binary program for encrypting passwords, which could allow local users to break all user passwords by cracking the key or modifying a copy of the sambar program to call the decryption procedure.

SonicWALL SOHO uses easily predictable TCP sequence numbers, allowing remote attackers to spoof or hijack sessions.

Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other clients via an incorrect URL containing the malicious script, which is printed back in an error message.

Arkeia backup server version 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwrite the files or obtain sensitive information.

Buffer overflows in Pileup before 1.2 allow local users to gain root privileges via (1) long command line arguments, or (2) a long callsign.

Cross-site scripting vulnerability in CGIWrap before version 3.7 allows remote attackers to execute arbitrary Javascript on other web clients. Attackers can inject Javascript into error messages generated by CGIWrap.

The prepend.php3 file in PHPLib before version 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server.