CVE Vulnerability Catalog

CVE-2002-0319 is a cross-site scripting vulnerability in edituser.php for pforum version 1.14 and earlier, allowing remote attackers to execute scripts and steal cookies from other users via JavaScript in a username.

XChat versions 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allow remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING.

The XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.

The codeparse.php in Open Bulletin Board (OpenBB) 1.0.0 has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts and steal cookies via JavaScript in the IMG tag.

Buffer overflow in Sun AnswerBook2 versions 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program.

service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long service argument.

Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, which could allow an attacker to gain privileges.

Buffer overflow in Century Software TERM allows local users to gain root privileges via a long tty argument to the callin program.

WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password.

Buffer overflow in WTRS_UI.EXE (WTX_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a long HTTP GET request to the /reports/ directory.

FileSeek.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) head or (2) foot parameters.

Buffer overflow in Matu FTP client 1.74 allows remote FTP servers to execute arbitrary code via a long '220' banner.

Buffer overflow in Flash OCX for Macromedia Flash 6 revision 23 allows remote attackers to execute arbitrary code via a long movie parameter.

Buffer overflow in 4D WebServer 6.7.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP request with Basic Authentication containing a long user name or password.

Buffer overflow in the X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms.

Buffer overflow in the Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows remote attackers to cause a denial of service or execute arbitrary code via the Error or Notice parameters.

Buffer overflow in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via an NFS packet.

The SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer.

A format string vulnerability in the libnspd.a library in AOLServer 3.0 through 3.4.2 allows remote attackers to execute arbitrary code via the Error or Notice parameters.

PVote before 1.9 allows remote attackers to change the administrative password and gain privileges by directly calling ch_info.php with the newpass and confirm parameters both set to the new password.