CVE Vulnerability Catalog

Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named winlogon.exe, csrss.exe, smss.exe, and services.exe. This could allow local users to install Trojan horses that cannot be stopped with the Task Manager.

CVE-2001-1308 describes format string vulnerabilities in iPlanet Directory Server 4.1.4 and earlier that can be exploited by remote attackers. They may cause a denial of service (crash) and potentially execute arbitrary code.

Buffer overflows in the InJoin Directory Server or LiveContent Directory may allow remote attackers to cause a denial of service (crash) and potentially execute arbitrary code.

CVE-2001-0975 describes a buffer overflow vulnerability in Oracle Internet Directory Server (LDAP) versions 2.1.1.x and 3.0.1, allowing remote attackers to execute arbitrary code.

Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings, potentially leading to buffer overflows.

Format string vulnerabilities in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

Buffer overflows in IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for certain BER object types, as demonstrated by the PROTOS LDAPv3 test suite.

Lotus Domino R5 versions before R5.0.7a are vulnerable to buffer overflows that can be exploited by remote attackers to cause a denial of service (crash) and potentially execute arbitrary code.

The static kernel symbol table in the dynamically loadable kernel module (dlkm) in HP-UX 11.11 is not properly configured, allowing local users to gain privileges.

IBM SecureWay 3.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for the L field of a BER encoding.

AdLogin.pm in AdCycle 1.15 and earlier allows remote attackers to bypass authentication and gain privileges by injecting SQL code in the $password argument.

CVE-2001-1176 describes a format string vulnerability in Check Point VPN-1/FireWall-1 4.1 that allows a remote authenticated firewall administrator to execute arbitrary code via format strings in the control connection.

Buffer overflow in xman allows local users to gain privileges via a long MANPATH environment variable.

The default configuration of sudo in Engarde Secure Linux 1.0.1 allows any user in the admin group to run certain commands that could be leveraged to gain full root access.

An unknown vulnerability in ColdFusion Server from version 2.0 to 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors.

FreeBSD 4.3 does not properly clear shared signal handlers when executing a process, allowing local users to gain privileges.

Trend Micro InterScan AppletTrap 2.0 does not properly filter URLs, which can lead to modifications in various forms, such as using a double slash (//) instead of a single slash, URL-encoded characters, requesting the IP address instead of the domain name, or using a leading 0 in an octet of an IP address.

Check Point VPN-1/FireWall-1 version 4.1 contains a default macro, accept_fw1_rdp, which may allow remote attackers to bypass intended restrictions with forged RDP (internal protocol) headers to UDP port 259 of arbitrary hosts.