CVE Vulnerability Catalog

Cisco Catalyst 2900 VLAN switches allow remote attackers to inject 802.1q frames into another VLAN by forging the VLAN identifier in the trunking tag.

Buffer overflow in the inews program in INN may lead to unauthorized access or execution of malicious code.

The 'download behavior' in Internet Explorer 5 allows remote attackers to read arbitrary files via a server-side redirect.

A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresses, which causes the gateway to continuously try to return the message every 10 seconds.

Buffer overflows in the Mars NetWare Emulation (NWE, mars_nwe) package via long directory names.

The email client in Softarc FirstClass Internet Server 5.506 and earlier stores usernames and passwords in cleartext in the files home.fc, network.fc, or FCCLIENT.LOG.

The management information base (MIB) for a 3Com SuperStack II hub running software version 2.10 contains an object identifier that is accessible by a read-only community string but lists the entire table of community strings.

Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.

Microsoft HTML control used in Internet Explorer 5.0, FrontPage Express, Outlook Express 5, and Eudora allows remote malicious websites or HTML emails to cause a denial of service through large HTML form fields, leading to 100% CPU consumption.

CVE-1999-0939 affects the IRC Epic/epic4 client in Debian, which is vulnerable to a denial of service (DoS) attack via a long string.

Buffer overflow in Vixie Cron on Red Hat systems via the MAILTO environmental variable.

Internet Explorer 5.0 records the username and password for FTP servers in the URL history, which could allow local users to read the information from another user's index.dat or people physically observing another user to read the information from the status bar when the user hovers the mouse over a link.

Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file.

Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable.

Windows NT 4.0 generates predictable random TCP initial sequence numbers (ISN), allowing remote attackers to perform spoofing and session hijacking.

Microsoft FrontPage stores form results in a default location at /_private/form_results.txt, which is world-readable and accessible in the document root. This allows remote attackers to read possibly sensitive information submitted by other users.

The pt_chown command in Linux allows local users to modify TTY terminal devices that belong to other users.

Buffer overflow in WU-FTPD and related FTP servers allows remote attackers to gain root privileges via MAPPING_CHDIR.

The default configuration of kdm in Caldera and Mandrake Linux, and possibly other distributions, allows XDMCP connections from any host. This enables remote attackers to obtain sensitive information or bypass additional access restrictions.

Multiple buffer overflows in WindowMaker versions 0.52 through 0.60.0 allow attackers to cause a denial of service and possibly execute arbitrary commands by executing WindowMaker with a long program name (argv[0]).