CVE Vulnerability Catalog

Buffer overflow vulnerability in the wvHandleDateTimePicture function of the wv library (wvWare) versions 0.7.4 through 0.7.6 and 1.0.0. An attacker can remotely execute arbitrary code by sending a document with a long DateTime field.

Utility Manager in Windows 2000 launches winhlp32.exe with raised privileges, allowing local users to gain system privileges via a 'Shatter' style attack. This attack sends a Windows message to cause Utility Manager to launch winhlp32, bypassing the GUI.

A format string vulnerability in the printlog function in log2mail before version 0.2.5.2 allows local users or remote attackers to execute arbitrary code via format string specifiers in a logfile monitored by log2mail.

Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root.

Vulnerability in BEA WebLogic Server and WebLogic Express versions 7.0 through 7.0 Service Pack 4 and 8.1 through 8.1 Service Pack 2 allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.

Off-by-one error in the POP3_readmsg function in popclient 3.0b6 allows remote attackers to cause a denial of service (application crash) via an e-mail message with a certain line length, which leads to a buffer overflow.

Vulnerability in PHP on Win32 platforms before version 4.3.7 allows attackers to execute arbitrary code, overwrite files, and access internal environment variables remotely or locally. The issue stems from improper filtering of shell metacharacters such as '%', '|', and '>' in the escapeshellcmd and escapeshellarg functions.

Heap-based buffer overflow in the HtmlHelp program (hh.exe) allows remote attackers to execute arbitrary commands via a .CHM file with a large length field.

Vulnerability in Safari web browser on Mac OS X 10.3.4 and 10.2.8. The 'Show in Finder' button may execute downloaded applications, allowing remote attackers to execute arbitrary code.

Vulnerability in Gallery 1.4.3 and earlier allows remote attackers to bypass authentication and obtain Gallery administrator privileges.

Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.

Multiple buffer overflows in LVM for AIX 5.1 and 5.2 allow local users to gain privileges via the putlvcb or getlvcb commands.

libsvn_ra_svn in Subversion 1.0.4 trusts the length field of svn protocol URLs, allowing remote attackers to cause a denial of service through a heap-based buffer overflow.

The vulnerability in eupdatedb in esearch 0.6.1 and earlier allows local users to create arbitrary files via a symlink attack on the esearchdb.py.tmp temporary file.

Vulnerability in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL.

Vulnerability in Mozilla Suite before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allows remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.

CVE-2004-0416 describes a double free vulnerability for the error_prog_name string in CVS versions 1.12.x through 1.12.8 and 1.11.x through 1.11.16. This may allow remote attackers to execute arbitrary code.

Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.

In Microsoft Windows 2000 running in a domain whose Fully Qualified Domain Name (FQDN) is exactly 8 characters long, users with expired passwords can log on to the domain.

A buffer overflow vulnerability in the write_packet function in control.c for l2tpd may allow remote attackers to execute arbitrary code.