CVE Vulnerability Catalog

Ecartis (formerly Listar) 1.0.0 in snapshot 20020125 and earlier does not properly drop privileges when installed setuid-root, and 'lock-to-user' is not set. This could allow local users to gain elevated privileges.

Multiple buffer overflows in HP Tru64 UNIX allow local users to gain root privileges through commands such as su, chsh, passwd, chfn, dxchpwd, and libc.

eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by reading password.txt.

Buffer overflow in HTTP Proxy for Symantec Norton Personal Internet Firewall 3.0.4.91 and Norton Internet Security 2001 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large outgoing HTTP request.

PHP versions 4.2.0 and 4.2.1 allow remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, leading to improper memory management.

Buffer overflows in Squid before 2.4.STABLE6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the MSNT auth helper, gopher client, or FTP server directory listing parser.

CVE-2002-0702 describes format string vulnerabilities in the logging routines for dynamic DNS code in the ISC DHCP daemon (DHCPD) versions 3 to 3.0.1rc8, with the NSUPDATE option enabled. This allows remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response.

An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prevent a system from properly verifying the integrity of the data.

Yahoo! Messenger version 5.0.0.1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI.

The URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&).

Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges.

The FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, allowing remote attackers to bypass firewall rules or spoof FTP server responses.

The Network Address Translation (NAT) capability for Netfilter ('iptables') 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.

The TFTP server for Red-M 1050 (Bluetooth Access Point) cannot be disabled, making it easier for remote attackers to crack the administration password via brute force methods.

CVE-2002-0716 describes a format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 that allows local users to gain privileges via format string specifiers in the file name argument.

The sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.

The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, allowing attackers to connect to the server from the same IP address as a user who has already established a session.

Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, making it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords.

Buffer overflow in the management web interface of Red-M 1050 (Bluetooth Access Point) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password.

Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.