CVE Vulnerability Catalog

In PHP-Nuke 4.4, the files bb_smilies.php and bbcode_ref.php allow remote attackers to read arbitrary files and gain PHP administrator privileges by inserting a null character and .. (dot dot) sequences into a malformed username argument.

SEDUM 2.1 HTTP server allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.

PHP-Nuke version 4.4.1a allows remote attackers to modify a user's email address and obtain the password by guessing the user id (UID) and calling user.php with the saveuser operator.

The pam_ldap authentication module in Solaris 8 allows remote attackers to bypass authentication by using a NULL password.

Buffer overflow in Windows 2000 event viewer snap-in allows attackers to execute arbitrary commands via a malformed field that is improperly handled during the detailed view of event records.

The HTML e-mail feature in Internet Explorer 5.5 and earlier allows attackers to execute attachments by setting an unusual MIME type for the attachment, which Internet Explorer does not process correctly.

Buffer overflow in the vCard handler in Outlook 2000 and 98, and Outlook Express 5.x allows an attacker to execute arbitrary commands via a malformed vCard birthday field.

Buffer overflow in the VB-TSQL debugger object (vbsdicli.exe) in Visual Studio 6.0 Enterprise Edition allows remote attackers to execute arbitrary commands.

NewsDaemon before 0.21b allows remote attackers to execute arbitrary SQL queries and gain privileges via a malformed user_username parameter.

Buffer overflow in the ximp40 shared library in Solaris 7 and Solaris 8 allows local users to gain privileges via a long 'arg0' (process name) argument.

Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5 allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using an IFRAME tag. This issue may be due to a vulnerability in Windows Scripting Host (WSH).

Masquerading code for Linux kernel before 2.2.19 does not fully check packet lengths in certain cases, which may lead to a vulnerability.

mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.

Alcatel Speed Touch devices running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 have a TFTP server running without a password, allowing remote attackers to change firmware versions or the device's configurations.

Alcatel Speed Touch ADSL modem with specific firmware versions has a blank default password, allowing remote attackers to gain unauthorized access.

CVE-2001-1425 affects the challenge-response authentication for the EXPERT user on Alcatel Speed Touch devices running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134. Remote attackers can gain privileges by directly computing the response based on information provided by the device during login.

Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file.

CVE-2001-0181 describes a vulnerability in the error logging code of the DHCP server and client in Caldera Linux that allows remote attackers to execute arbitrary commands.

Buffer overflow in /usr/bin/cu in Solaris 2.8 and earlier, and possibly other operating systems, allows local users to gain privileges by executing cu with a long program name (arg0).

The setuid doroot program in Voyant Sonata 3.x executes arbitrary command line arguments, allowing local users to gain root privileges.