CVE Vulnerability Catalog

Up2date versions 3.0.7 and 3.1.23 do not properly verify RPM GPG signatures, which could allow remote attackers to install unsigned packages from the Red Hat Network if that network is compromised.

Internet Explorer versions 5.01 SP3 through 6.0 SP1 improperly determine object types returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter pointing to a malicious file.

Buffer overflow in the BR549.DLL ActiveX control for Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to execute arbitrary code.

The installation of Apple QuickTime / Darwin Streaming Server before version 4.1.3f starts the administration server with a 'Setup Assistant' page that allows remote attackers to set the administrator password and gain privileges before the real administrator.

Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with large length for a Text or Copyright string, or a large number of tracks, leading to a heap-based buffer overflow.

Microsoft SQL Server 7, 2000, and MSDE allow local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port, leading to a buffer overflow.

The 'Named Pipe Hijacking' vulnerability in Microsoft SQL Server 7, 2000, and MSDE allows local users to gain privileges by hijacking a named pipe during the authentication of another user.

Heap-based buffer overflow in ePO agent for McAfee ePolicy Orchestrator 2.0, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code via a POST request containing long parameters.

The default installation of MSDE via McAfee ePolicy Orchestrator versions 2.0 to 3.0 allows attackers to execute arbitrary code. This process involves obtaining the database administrator username and encrypted password from a configuration file, cracking the password due to weak cryptography, and using it to pass commands through xp_cmdshell.

An off-by-one error in the fb_realpath() function may allow attackers to execute arbitrary code. The issue affects wu-ftpd versions 2.5.0 to 2.6.2 when commands cause pathnames to exceed MAXPATHLEN, leading to a buffer overflow.

Patches for cachefs on Solaris 2.6 and 7 overwrite the inetd.conf file, which may silently reenable services and allow remote attackers to bypass the intended security policy.

The checklogin function in omail.pl for omail webmail version 0.98.4 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in (1) password, (2) domain name, or (3) username.

mpg123 version 0.59r allows remote attackers to cause a denial of service and possibly execute arbitrary code via an MP3 file with a zero bitrate, leading to a negative frame size.

SQL injection vulnerability in shopexd.asp for VP-ASP allows remote attackers to gain administrator privileges via the id parameter.

A format string vulnerability in the Backup and Restore Utility for Unix (BRU) version 17.0 and earlier, when running setuid, allows local users to execute arbitrary code via format string specifiers in a command line argument.

The mainfile.php in phpforum 2 RC-1, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by modifying the MAIN_PATH parameter to reference a URL on a remote web server that contains the code.

Multiple SQL injection vulnerabilities in ProductCart versions 1.5 through 2 allow remote attackers to gain access to the admin control panel or other privileges.

ImageMagick version 5.4.3.x and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a "%x" filename, possibly triggering a format string vulnerability.

Multiple buffer overflows in IglooFTP PRO 3.8 allow remote FTP servers to execute arbitrary code via long FTP banners or long responses to client commands such as USER, PASS, ACCT, and possibly other commands.

SQL injection vulnerability in login.asp for StoreFront 6.0, and possibly earlier versions, allows remote attackers to obtain sensitive user information via SQL statements in the password field.