CVE Vulnerability Catalog

Buffer overflow in RobTex Viking server earlier than 1.06-370 allows remote attackers to cause a denial of service or execute arbitrary commands via a long HTTP GET request, or long Unless-Modified-Since, If-Range, or If-Modified-Since headers.

The Raptor GFX configuration tool, pgxconfig, uses a relative path for a system call to the 'cp' program, allowing local users to execute arbitrary commands by modifying their path to point to an alternate 'cp' program.

PCCS MySQLDatabase Admin Tool Manager version 1.2.4 and earlier installs the file dbconnect.inc within the web root, allowing remote attackers to obtain sensitive information such as the administrative password.

Buffer overflow in the IRIX libgl.so library allows local users to gain root privileges via a long HOME variable in programs such as gmemusage and gr_osview.

Linux Intrusion Detection System (LIDS) version 0.9.7 allows local users to gain root privileges when LIDS is disabled via the security=0 boot option.

Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, allowing remote attackers to create a server on the victim's system via a malicious applet.

Buffer overflow in gr_osview in IRIX 6.2 and 6.3 allows local users to gain privileges via a long -D option.

The xpdf PDF viewer client earlier than version 0.91 does not properly launch a web browser for embedded URLs, allowing an attacker to execute arbitrary commands via a URL containing shell metacharacters.

The mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, allowing remote attackers to execute arbitrary commands.

suidperl (also known as sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, allowing local users to gain privileges.

Buffer overflow in the Linux binary compatibility module in FreeBSD 3.x through 5.x allows local users to gain root privileges via long filenames in the linux shadow file system.

CVS server version 1.10.8 does not properly restrict users from creating arbitrary Checkin.prog or Update.prog programs. This allows remote CVS committers to modify or create Trojan horse programs with the Checkin.prog or Update.prog names, then perform a CVS commit action.

The telnetd telnet server in IRIX versions 5.2 through 6.1 does not properly clean user-injected format strings, allowing remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.

Subscribe Me LITE does not properly authenticate attempts to change the administrator password, allowing remote attackers to gain privileges for the Account Manager by directly calling the subscribe.pl script with the setpwd parameter.

The logrotate script for OpenLDAP before version 1.2.11 in Conectiva Linux sends an improper signal to the kernel log daemon (klogd), causing it to terminate.

Buffer overflow in lpstat in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long -n option.

The uagentsetup program in ARCServeIT Client Agent 6.62 does not properly check for the existence or ownership of a temporary file that is moved to the agent.cfg configuration file. This allows local users to execute arbitrary commands by modifying the temporary file before it is moved.

BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.

Account Manager LITE does not properly authenticate attempts to change the administrator password, allowing remote attackers to gain privileges for the Account Manager by directly calling the amadmin.pl script with the setpasswd parameter.

Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter.