CVE Vulnerability Catalog

A stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 for Windows, before Fixpak 10a, allows attackers with 'Connect' privileges to execute arbitrary code via the INVOKE command.

ProFTPD versions 1.2.7 through 1.2.9rc2 do not properly translate newline characters when transferring files in ASCII mode, allowing remote attackers to execute arbitrary code via a buffer overflow using certain files.

A stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 before Fixpak 10 and 10a, and 8.1 before Fixpak 2 allows attackers with 'Connect' privileges to execute arbitrary code via a LOAD command.

Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a 'data' tag pointing to the malicious code.

Buffer overflow in dtprintinfo on HP-UX 11.00, and possibly other operating systems, allows local users to gain root privileges via a long DISPLAY environment variable.

An unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements.

Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, occurs when running in debug mode and using the Apache log. This allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an 'Accept-Encoding: gzip' header.

The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, allowing attackers to modify the stack and possibly gain privileges.

In OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, the PAM authentication mechanism in SSH1 does not check the result of the authentication attempt, which may allow remote attackers to gain privileges.

The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval.

Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long LB_DIR messages to ListBox or CB_DIR messages to ComboBox controls in a privileged application.

A stack-based buffer overflow in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.

The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange 2000.

Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allow remote attackers to execute arbitrary code via an ASX header with a long hostname.

CVE-2001-1411 describes a format string vulnerability in gm4 (also known as m4) on Mac OS X that may allow local users to gain privileges if gm4 is called by setuid programs.

Versions gv 3.5.8 and possibly earlier allow remote attackers to execute arbitrary commands via shell metacharacters in the filename for (1) a PDF file or (2) a gzip file.

A double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.

Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.

Buffer overflow in the log viewing interface in Perception LiteServe versions 1.25 through 2.2 allows remote attackers to execute arbitrary code via a GET request with a long file name.

mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.