CVE Vulnerability Catalog

Buffer overflow in atftp daemon (atftpd) 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename.

Ultimate PHP Board (UPB) version 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator runs admin_iplog.php.

The objects.inc.php4 file in BLNews 2.1.3 contains a vulnerability that allows remote attackers to execute arbitrary PHP code via a Server[path] parameter pointing to malicious code on an attacker-controlled website.

OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass 'from=' and 'user@host' address restrictions.

Buffer overflow in AnalogX Proxy 4.13 allows remote attackers to execute arbitrary code via a long URL to port 6588.

Buffer overflow in Uptime Client (UpClient) 5.0b7, and possibly other versions, allows local users to gain privileges via a long -p argument.

Vignette StoryServer 5 and Vignette V/5 allow remote attackers to read and modify license information and cause a denial of service by directly accessing the /vgn/license template.

The installation of Sun ONE Application Server 7.0 for Windows 2000/XP creates a statefile with world-readable permissions, allowing local users to gain privileges by reading a plaintext password in the statefile.

Buffer overflow in BRS WebWeaver 1.04 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP (1) POST or (2) HEAD request.

Buffer overflow in gbnserver for Gnome Batalla Naval 1.0.4 allows remote attackers to execute arbitrary code via a long connection string.

PalmVNC 1.40 and earlier stores passwords in plaintext in the PalmVNCDB, which is backed up to PCs that the Palm is synchronized with. This could allow attackers to gain privileges.

Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase '.JSP' extension instead of the lowercase .jsp extension.

Multiple buffer overflows in the dbm_open and dbminit functions in Solaris 2.6 through 9 may allow local users to gain root privileges via long arguments to programs like Xsun.

CVE-2003-1086 describes a vulnerability in pMachine Free and pMachine Pro 2.2 and 2.2.1 that allows remote file inclusion. Attackers can execute arbitrary PHP code by modifying the pm_path parameter to point to a URL on a remote server.

The Kerberos login authentication feature in Mac OS X, when used with an LDAPv3 server and LDAP bind authentication, may send cleartext passwords to the LDAP server when the AuthenticationAuthority attribute is not set.

Buffer overflow in url_filename function for wget 1.8.1 allows attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long URL.

Multiple unknown vulnerabilities in Nessus before version 2.0.6, in libnessus and possibly libnasl. These are different vulnerabilities than those identified by CVE-2003-0372 and CVE-2003-0373.

The IMAP Client for Evolution 1.2.4 allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large literal size values that cause either integer signedness errors or integer overflow errors.

The administration capability for Apple AirPort 802.11 wireless access point devices uses weak encryption (XOR with a fixed key) for protecting authentication credentials, which could allow remote attackers to obtain administrative access via sniffing when the capability is available via Ethernet or non-WEP connections.

Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.