CVE Vulnerability Catalog

The Symantec FireWall/VPN Appliance model 200 records a cleartext password for the password administration page, which may be cached on the administrator's local system or in a proxy.

The login page of cPanel 9.1.0 (and possibly other versions) allows a remote attacker to execute arbitrary code by injecting shell metacharacters in the 'user' parameter.

The 'Allow cPanel users to reset their password via email' feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

Multiple format string vulnerabilities in the HTTP Application Intelligence component in Check Point Firewall-1 NG-AI R55 and R54, and Check Point Firewall-1 HTTP Security Server, allow remote attackers to execute arbitrary code via crafted HTTP requests.

The MSS (maximum segment size) functionality in netinet allows remote attackers to cause a denial of service through resource exhaustion. This can be achieved by a low MTU, leading to a large number of small packets being generated, or by sending many packets with a small TCP payload.

Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81 allow remote attackers to cause a denial of service and possibly execute arbitrary code.

A stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges.

Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code. These issues involve both octal encoding and quoted-printable encoding.

Multiple vulnerabilities in PWLib before version 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.

Unknown vulnerability in Safari web browser in Mac OS X 10.2.8 and 10.3.2, with unknown impact.

The mksmbpasswd script in Samba 3.0.0 and 3.0.1 may overwrite the user password with an uninitialized buffer when creating an account marked as disabled. This could enable the account with a more easily guessable password.

mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.

Directory traversal vulnerability in editconfig_gedcom.php for phpGedView 2.65.1 and earlier allows remote attackers to read arbitrary files or execute arbitrary PHP programs on the server via .. (dot dot) sequences in the gedcom_config parameter.

The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets. This allows attackers to cause a denial of service and possibly execute arbitrary code.

Buffer overflow in ReadFontAlias from dirfile.c of XFree86 versions 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token.

Buffer overflow in the Extract Info Field Function for MSN and YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.

Buffer overflow in the ReadFontAlias function in XFree86 versions 4.1.0 to 4.3.0 allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file.

Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server. Examples include using the GLOBALS[rootdp] parameter in db.php and the GLOBALS[language_home] parameter in archivednews.php with a malicious version of lang_admin.php.

Apache-SSL versions 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allow remote attackers to forge a client certificate by using basic authentication with the target user's 'one-line DN'.