CVE Vulnerability Catalog

Buffer overflow in the host command allows a remote attacker to execute arbitrary commands via a long response to an AXFR query.

Buffer overflow in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large TACACS+ packet.

The csstart program in iCal 2.1 Patch 2 searches the current working directory for the cshttpd program, allowing local users to gain root privileges by creating a Trojan Horse cshttpd program in that directory and calling csstart from there.

iCal 2.1 Patch 2 installs many files with world-writeable permissions, allowing local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse.

Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly calling the com.livesoftware.jrun.plugins.JSP JSP servlet.

The csstart program in iCal 2.1 Patch 2 uses relative pathnames to install the libsocket and libnsl libraries, which could allow the icsuser account to gain root privileges by creating a Trojan Horse library in the current or parent directory.

The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, allowing remote attackers to execute restricted commands by sending a DATA command before sending the restricted commands.

Buffer overflow in the catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable.

The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable.

The default configuration of Slashcode before version 2.0 Alpha has a default administrative password, allowing remote attackers to gain Slashcode privileges and possibly execute arbitrary commands.

A format string vulnerability in the logging function of ypbind 3.3, while running in debug mode, leaks file descriptors and allows an attacker to cause a denial of service.

Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL.

Check Point Firewall-1 versions 3.0 through 4.1 generate different error messages for invalid usernames and passwords, allowing remote attackers to determine valid usernames and guess passwords via brute force attacks.

Format string vulnerabilities in the ssh program in OpenBSD (and possibly other BSD-based operating systems) allow attackers to gain root privileges.

In Red Hat Linux 6.2, there is a vulnerability that relies on the pathname specified by the RSH environmental variable. This allows local users to gain root privileges by modifying the RSH variable to point to a Trojan horse program.

CVE-2000-1010 describes a format string vulnerability in talkd in OpenBSD and possibly other BSD-based operating systems, allowing remote attackers to execute arbitrary commands via a user name containing format characters.

Poll It 2.0 has a vulnerability in pollit.cgi that allows remote attackers to execute arbitrary commands via shell metacharacters in the poll_options parameter.

Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via long 'RCPT TO,' 'SAML FROM,' or 'SOML FROM' commands.

Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.

Buffer overflows in TYPSoft FTP Server 0.78 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER, PASS, or CWD command.