CVE Vulnerability Catalog

The installation of Microsoft Exchange 2000 before Rev. A creates a user account with a known password, which could allow attackers to gain privileges, known as the 'Exchange User Account' vulnerability.

Buffer overflow in the setclock command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long argument.

WinVNC installs the WinVNC3 registry key with permissions that give Special Access (read and modify) to the Everybody group. This allows users to read and modify sensitive information such as passwords and gain access to the system.

The 24Link 1.06 web server allows remote attackers to bypass access restrictions by prepending strings such as '/+/' or '/.' to the HTTP GET request.

The default configuration for the PostACI webmail system installs the /includes/global.inc configuration file within the web root, allowing remote attackers to read sensitive information such as database usernames and passwords via a direct HTTP GET request.

Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands.

Buffer overflow in the phf CGI program allows remote attackers to execute arbitrary commands by specifying a large number of arguments and including a long MIME header.

Buffer overflow in the digest command in IBM AIX 4.3.x and earlier allows local users to execute arbitrary commands.

Buffer overflow in the remote web administration component (webprox.dll) of 602Pro LAN SUITE before version 2000.0.1.33 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.

Buffer overflow in the pam_localuser PAM module in Red Hat Linux 7.x and 6.x allows attackers to gain privileges.

Buffer overflow in the socks5 server on Linux allows attackers to execute arbitrary commands via a long connection request.

Buffer overflow in Netsnap webcam HTTP server before version 1.2.9 allows remote attackers to execute arbitrary commands via a long GET request.

Buffer overflow in NAI Sniffer Agent allows remote attackers to execute arbitrary commands via a long SNMP community name.

McAfee WebShield SMTP 4.5 allows remote attackers to bypass email content filtering rules by including Extended ASCII characters in the name of the attachment.

Vulnerability in auto_parms and set_parms in HP-UX 11.00 and earlier allows remote attackers to execute arbitrary commands or cause a denial of service.

WinCE 3.0.9348 generates predictable TCP Initial Sequence Numbers (ISNs), allowing remote attackers to spoof or hijack TCP connections.

The HTTP service in American Power Conversion (APC) PowerChute uses a default username and password, allowing remote attackers to gain system access.

Computer Associates InoculateIT Agent for Exchange Server does not recognize an e-mail virus attachment if the SMTP header is missing the 'From' field, allowing remote attackers to bypass virus protection.

SQL injection vulnerability in mod_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the query string of the URL.

BEA Systems WebLogic Express and WebLogic Server versions 5.1 SP1-SP6 allow remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages.