CVE Vulnerability Catalog

Buffer overflow in the web administration service for the HiNet LP5100 IP-phone allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.

CVE-2000-0995 describes a vulnerability in the yp_passwd program in OpenBSD that allows attackers to gain root privileges by providing a malformed name.

WinU versions 1.0 through 5.1 has a backdoor password that allows remote attackers to gain access to its administrative interface and modify configuration.

cmd5checkpw version 0.21 and earlier allows remote attackers to cause a denial of service via an 'SMTP AUTH' command with an unknown username.

Shambala Server 4.5 stores passwords in plaintext, which could allow local users to obtain the passwords and compromise the server.

Heap overflow in the savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option.

The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.

CVE-2000-0969 describes a format string vulnerability in Half Life dedicated server build 3104 and earlier, allowing remote attackers to execute arbitrary commands by injecting format strings into the changelevel command via the system console or rcon.

A vulnerability in the pw_error function in the BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.

FreeBSD version 4.1.1 and earlier, and possibly other BSD-based operating systems, use an insufficient random number generator to generate initial TCP sequence numbers (ISN), allowing remote attackers to spoof TCP connections.

Buffer overflows in Microsoft Network Monitor (Netmon) allow remote attackers to execute arbitrary commands via a long Browser Name in a CIFS Browse Frame, a long SNMP community name, or a long username or filename in an SMB session.

Buffer overflow in All-Mail 1.1 allows remote attackers to execute arbitrary commands via a long 'MAIL FROM' or 'RCPT TO' command.

IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands. This is known as the 'Web Server File Request Parsing' vulnerability.

GnuPG (gpg) version 1.0.3 does not properly check all signatures of a file containing multiple documents, allowing an attacker to modify the contents of all documents except the first without detection.

GnoRPM before 0.95 allows local users to modify arbitrary files via a symlink attack.

Buffer overflow in Pegasus Mail 3.11 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long email message containing binary data.

The Samba Web Administration Tool (SWAT) in version 2.0.7 does not log login attempts where the username is correct but the password is wrong, allowing remote attackers to conduct brute force password guessing attacks.

Buffer overflow in the IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command.

Zope versions 2.2.0 through 2.2.4 improperly perform security registration for legacy names of object constructors, which could allow attackers to perform unauthorized activities.

Buffer overflow in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large TACACS+ packet.