CVE Vulnerability Catalog

In Ethereal versions 0.9.15 and earlier, a heap-based buffer overflow allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SOCKS dissector.

Buffer overflow in the CDE libDtHelp library allows local users to execute arbitrary code via modified DTHELPUSERSEARCHPATH, DTSEARCHPATH, or LOGNAME environment variables.

CVE-2003-0886 describes a format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier that allows remote attackers to execute arbitrary code.

CVE-2003-1216 describes an SQL injection vulnerability in search.php for phpBB versions 2.0.6 and earlier. This allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter.

SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn variable.

Unknown vulnerability in the libraries for the PGX32 frame buffer in Solaris 2.5.1 and 2.6 through 9 allows local users to gain root access.

Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.

Internet Explorer versions 5.01 through 6.0 improperly handle object tags returned from a Web server during XML data binding, allowing remote attackers to execute arbitrary code via an HTML email message or web page.

Opera versions 7.11 and 7.20 have a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code via an HREF with a large number of escaped characters in the server name.

Buffer overflow in net.c for cfengine 2.x before version 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which are trusted by the ReceiveTransaction function.

Buffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.

The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains '/' instead of '.'

A stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to execute arbitrary code via a long filename in a GET request with an 'Accept-Encoding: gzip' header.

An unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements.

A stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 before Fixpak 10 and 10a, and 8.1 before Fixpak 2 allows attackers with 'Connect' privileges to execute arbitrary code via a LOAD command.

The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration. This differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.

Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a 'data' tag pointing to the malicious code.

Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, occurs when running in debug mode and using the Apache log. This allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an 'Accept-Encoding: gzip' header.

Buffer overflow in dtprintinfo on HP-UX 11.00, and possibly other operating systems, allows local users to gain root privileges via a long DISPLAY environment variable.

ProFTPD versions 1.2.7 through 1.2.9rc2 do not properly translate newline characters when transferring files in ASCII mode, allowing remote attackers to execute arbitrary code via a buffer overflow using certain files.