CVE Vulnerability Catalog

Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking.

Multiple buffer overflows in ISC DHCP Distribution server (dhcpd) versions 1.0 and 2.0 allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary commands via long options.

Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable.

The Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure default permissions.

The SystemSoft SystemWizard package on HP Pavilion PCs with Windows 98, and possibly other platforms, installs two ActiveX controls marked as safe for scripting. This allows remote attackers to execute arbitrary commands via a malicious web page that references the Launch control or the RegObj control.

Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabled.

The automatic download option in the ncftp 2.4.2 FTP client on Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files to be downloaded.

Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.

The RSH service in Windows NT 3.5 through 4.0 improperly restricts access as specified in the .Rhosts file, potentially allowing unauthorized users to access the service from an authorized host.

Cisco PIX Private Link version 4.1.6 and earlier improperly processes certain commands in the configuration file, reducing the effective key length of the DES key to 48 bits instead of 56 bits.

The rcS and mountall programs in Sun Solaris 2.x, possibly before 2.4, start a privileged shell on the system console if fsck fails while the system is booting.

The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.

Internet Explorer 4 treats a 32-bit number ("dotless IP address") in a URL as the hostname instead of an IP address, causing Local Intranet Zone settings to be applied to the resulting web page.

Buffer overflow in AnalogX SimpleServer:WWW HTTP server allows remote attackers to execute commands via a long GET request.

Multiple buffer overflows in the filter command in Elm 2.4 allow attackers to execute arbitrary commands via (1) long From: headers, (2) long Reply-To: headers, or (3) via a long -f (filterfile) command line argument.

The HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host.

The loadmodule function in SunOS 4.1.x, as used by xnews, does not properly sanitize its environment, allowing local users to gain privileges.

When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies.

IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain. This is known as the 'Domain Resolution' vulnerability.

The BMC Patrol component, when installed with Compaq Insight Management Agent 4.23 and earlier, or Management Agents for Servers 4.40 and earlier, creates a PFCUser account with a default password and potentially dangerous privileges.