CVE Vulnerability Catalog

Gravity Storm Service Pack Manager 2000 creates a hidden share (SPM2000c$) mapped to the C drive, which may allow local users to bypass access restrictions on certain directories in the C drive, such as system32, by accessing them through the hidden share.

PHPNetToolpack 0.1 relies on its environment's PATH to find and execute the traceroute program, which could allow local users to gain privileges by inserting a Trojan horse program into the search path.

Webmin 0.96 and Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication. Attackers can gain privileges by using certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.

The authoring function in Microsoft Content Management Server (MCMS) 2001 allows attackers to authenticate and upload executable content by modifying the upload location.

Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.

The ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file.

Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execute arbitrary code via a long PASV command.

The csMailto.cgi program in CGIscript.net allows remote attackers to use it as a 'spam proxy', enabling them to send emails to arbitrary users via modified form-to, form-from, and form-results parameters.

SquirrelMail version 1.2.5 and earlier allows authenticated users to execute arbitrary commands by modifying the THEME variable in a cookie.

The PHP administration script in popper_mod version 1.2.1 and earlier relies on Apache .htaccess authentication, allowing remote attackers to gain privileges if the script is not properly configured by the administrator.

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

The account lockout capability in Oblix NetPoint 5.2 and earlier only locks out users once for the specified lockout period, making it easier for remote attackers to conduct brute force password guessing.

PostCalendar 3.02 is vulnerable to cross-site scripting, allowing remote attackers to insert arbitrary HTML and scripts by modifying a calendar entry in its preview page.

csSearch.cgi in version 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, leading to the overwriting of the setup.cgi configuration file.

CVE-2002-0465 describes a vulnerability in filemanager.asp for Hosting Controller 1.4.1 and earlier, allowing remote attackers to read and modify arbitrary files and execute commands via a .. (dot dot) in the OpenPath parameter.

Cross-site scripting (XSS) vulnerability in signgbook.php for BG GuestBook 1.0 allows remote attackers to execute arbitrary Javascript via encoded tags in fields such as name, email, AIM screen name, website, location, or message.

Buffer overflow in slrnpull for the SLRN package, when installed setuid or setgid, allows local users to gain privileges via a long -d (SPOOLDIR) argument.

Cross-site scripting vulnerability in guestbook.pl for Philip Chinery's Guestbook 1.1 allows remote attackers to execute Javascript or HTML via fields such as Name, EMail, or Homepage.

SQL injection vulnerability in the function that services for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary commands via an MCMS resource request for image files or other files.

ASP-Nuke RC2 and earlier allows remote attackers to bypass authentication and gain privileges by modifying the 'pseudo' cookie.