CVE Vulnerability Catalog

The do_change_cipher_spec function in OpenSSL versions 0.9.6c to 0.9.6k and 0.9.7a to 0.9.7c allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.

An unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors.

A stack-based buffer overflow in The Palace client version 3.5 and earlier allows remote attackers to execute arbitrary code via a link to a palace:// URL followed by a long server address string.

AIM Sniff (aimSniff.pl) version 0.9b allows local users to overwrite arbitrary files via a symlink attack on /tmp/AS.log.

X-Cart version 3.4.3 allows remote attackers to execute arbitrary commands via the perl_binary argument in upgrade.php and general.php.

PHPX versions 2.0 through 3.2.4 allows remote attackers to gain access to other accounts by modifying the cookie's PXL variable to reference another userID.

Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long GET request on port 1080.

SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter.

Multiple SQL injection vulnerabilities in YaBB SE versions 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via the msg and postid parameters in ModifyMessage.php.

Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.

Load Sharing Facility (LSF) versions 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user. This could allow remote attackers within the local cluster to gain privileges.

SL Mail Pro 2.0.9 and earlier versions have a stack-based buffer overflow in Supervisor Report Center that allows remote attackers to execute arbitrary code via an HTTP request with a long HTTP sub-version.

SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.

A stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.

Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges.

Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.

Multiple buffer overflows in the auth_ident() function in auth.c for GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string.

CVE-2004-0277 in Dream FTP 1.02 has a format string vulnerability that allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via format string specifiers in the username.

The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed HTTP Referer.

Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via user.dll, loadpageadmin.dll, or loadpageuser.dll.