CVE Vulnerability Catalog

Buffer overflow in University of Washington imap server (uw-imapd) in versions imap-2001 and imap-2001a, as well as earlier versions, allows remote authenticated users to execute arbitrary code via a long BODY request.

Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long HTTP GET request.

Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a LIST command containing a large number of /, *, and .. characters.

Cross-site scripting vulnerability in Ikonboard 3.0.1 allows remote attackers to execute arbitrary script as other Ikonboard users and steal cookies via Javascript in an IMG tag.

Buffer overflows in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allow remote attackers to execute arbitrary code via (1) a long DNS hostname determined using reverse DNS lookups, (2) a long AUTH string, or (3) certain data in the xtell request.

XChat versions 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allow remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING.

Buffer overflow in Essentia Web Server 2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL.

The Gator ActiveX component (IEGator.dll) version 3.0.6.1 allows remote websites to install arbitrary software by specifying a Trojan Gator installation file (setup.ex_) in the src parameter.

Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing.

Fasttrack p2p, used in applications such as KaZaA, grokster, and morpheus, allows remote attackers to spoof other users by modifying the username and network information in the message header.

Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long message or IMvironment field.

CVE-2002-0319 is a cross-site scripting vulnerability in edituser.php for pforum version 1.14 and earlier, allowing remote attackers to execute scripts and steal cookies from other users via JavaScript in a username.

CVE-2002-0316 describes a cross-site scripting vulnerability in eXtreme message board (XMB) version 1.6x and earlier. It allows remote attackers to execute scripts as other XMB users by inserting the script into an IMG tag.

The XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.

Version 3.3.03 and earlier of Snitz Forums 2000 contains a SQL injection vulnerability in members.asp, allowing remote attackers to execute arbitrary code.

AOL Instant Messenger (AIM) allows remote attackers to steal files that are being transferred to other clients by connecting to port 4443 (Direct Connection) or port 5190 (file transfer) before the intended user.

dnstools.php for DNSTools 2.0 beta 4 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user_logged_in or user_dnstools_administrator parameters.

Vulnerability in FTPSRVR in HP MPE/iX versions 6.0 through 7.0 does not properly validate certain FTP commands, allowing attackers to gain privileges.

Buffer overflow in 3Cdaemon 2.0 FTP server allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long commands such as login.