CVE Vulnerability Catalog

UTStarcom BAS 1000 version 3.1.10 creates several default or backdoor accounts and passwords, allowing remote attackers to gain access to the system.

Netgear RP114 Cable/DSL router with firmware 3.26 uses a default administrator password and accepts admin logins on the external interface, allowing remote attackers to gain privileges if the password is not changed.

Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC versions 2.5 through 2.7 may allow remote attackers to have unknown impact with unknown attack vectors.

An unknown vulnerability in WesMo phpEventCalendar 1.1 allows remote attackers to execute arbitrary commands via unknown attack vectors.

Buffer overflow in AN HTTPd versions 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username.

Terminal 1.3 in Apple Mac OS X 10.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link, which is executed by Terminal.app window.

SQLData Enterprise Server 3.0 has a stack-based buffer overflow that allows a remote attacker to execute arbitrary code and cause a denial of service via a long HTTP request.

Buffer overflow in the French documentation patch for Gnuplot 3.7 in SuSE Linux before 8.0 allows local users to execute arbitrary code as root.

ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension.

Unspecified vulnerability in Internet Group Management Protocol (IGMP) of HP Tru64 4.0F through 5.1A allows remote attackers to cause a denial of service via unknown attack vectors.

Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code via a long argument.

Sendmail versions 8.9.0 through 8.12.6 allow remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

The default configuration in MySQL versions 3.20.32 through 3.23.52 on Windows does not have logging enabled, which could allow remote attackers to conduct activities without detection.

mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, resulting in a read/write deadlock between httpd and the CGI script.

SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a base64-encoded user parameter.

CVE-2002-1885 is a remote file inclusion vulnerability in PowerPhlogger (PPhlogger) versions 2.0.9 through 2.2.2 in showhits.php3, allowing remote attackers to execute arbitrary PHP code via the rel_path parameter.

The default configuration of MySQL versions 3.20.32 through 3.23.52 on Windows sets the bind address to the loopback interface, allowing remote attackers to connect to the database.

Multiple buffer overflows in Sybase Adaptive Server 12.0 and 12.5 allow remote attackers to execute arbitrary code via (1) a long parameter to the xp_freedll extended stored procedure or (2) a long database name argument to the DBCC CHECKVERIFY function.

The index.php in Py-Membres 3.1 has a vulnerability that allows remote attackers to log in as an administrator by setting the pymembs parameter to 'admin'.

Buffer overflow in the netlog function in pen.c for Pen 0.9.1 and 0.9.2 allows remote attackers to execute arbitrary commands via malformed log messages.