CVE Vulnerability Catalog

The NTLM Security Support Provider (NTLMSSP) service does not properly check the function number in an LPC request, which could allow local users to gain administrator level access.

In Windows 2000, Dynamic Data Exchange (DDE) allows local users to gain SYSTEM privileges by sending a 'WM_COPYDATA' message to an invisible window running with the privileges of the WINLOGON process.

Buffer overflow in the jaZip Zip/Jaz drive manager allows local users to gain root privileges via a long DISPLAY environmental variable.

CVE-2001-0111 describes a format string vulnerability in splitvt before version 1.6.5 that allows local users to execute arbitrary commands via the -rcfile command line argument.

Buffer overflow in the arp command in Solaris 7 and earlier allows local users to execute arbitrary commands via a long -f parameter.

Buffer overflow in exrecover in Solaris 2.6 and earlier possibly allows local users to gain privileges via a long command line argument.

The web administration interface for Interscan VirusWall 3.6.x and earlier does not use encryption, which could allow remote attackers to obtain the administrator password to sniff the administrator password via the setpasswd.cgi program or other HTTP GET requests that contain base64 encoded usernames and passwords.

Sample runnable code snippets in ColdFusion Server 4.0 allow remote attackers to read files, conduct a denial of service, or use the server as a proxy for other HTTP calls.

Buffer overflow in calserver in SCO OpenServer allows remote attackers to gain root access via a long message.

A vulnerability in cron in OpenBSD 2.5 allows local users to gain root privileges via an argv[] that is not NULL terminated, which is passed to cron's fake popen function.

A vulnerability in the Sendmail configuration file (sendmail.cf) in SCO UnixWare 7.1.0 and earlier allows an attacker to gain root privileges.

ptylogin in Unix systems allows users to perform a denial of service by locking out modems, dial out with that modem, or obtain passwords.

Insecure file permissions for Netscape FastTrack Server 2.x, Enterprise Server 2.0, and Proxy Server 2.5 in SCO UnixWare 7.0.x and 2.1.3 allow an attacker to gain root privileges.

FTP Voyager ActiveX control before version 8.0, when marked as safe for scripting, allows remote attackers to execute arbitrary commands.

An unknown vulnerability in the SMTP server in Lotus Domino versions 5.0 through 5.7 allows remote attackers to bypass mail relaying restrictions via crafted e-mail addresses in 'RCPT TO' commands.

Vulnerability in Cisco IOS 12.1(3) and 12.1(3)T allows remote attackers to read and modify device configuration via the default DOCSIS read-write community string.

IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, allowing remote attackers to gain access to the database.

Multiple buffer overflows in Lexmark MarkVision printer driver programs allow local users to gain privileges via long arguments to the cat_network, cat_paraller, and cat_serial commands.

The common.inc.php file in phpWebLog 0.4.2 improperly initializes the $CONF array, inadvertently setting the password to a single character. This allows remote attackers to easily guess the SiteKey and gain administrative privileges to phpWebLog.

MailMan Webmail version 3.0.25 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the alternate_template parameter.