CVE Vulnerability Catalog

Cross-site scripting (XSS) vulnerability in scp/ajax.php of osTicket before version 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.

Metamail before 2.7-7.2 allows remote attackers to overwrite arbitrary files via an email message containing a uuencoded attachment that specifies the full pathname of the file to be modified, processed by uuencode in Metamail scripts such as sun-audio-file.

glibc2 does not properly clear the LD_DEBUG_OUTPUT and LD_DEBUG environmental variables when a program is spawned from a setuid program, which could allow local users to overwrite files via a symlink attack.

Samba Web Administration Tool (SWAT) in Samba 2.0.7 installs the cgi.log logging file with world readable permissions. This allows local users to read sensitive information such as user names and passwords.

WQuinn QuotaAdvisor 4.1 allows users to list directories and files by running a report on the targeted shares.

The shred 1.0 file wiping utility does not properly open a file for overwriting or flush its buffers, which prevents shred from properly replacing the file's data and allows local users to recover the file.

The IFRAME of the WebBrowser control in Internet Explorer 5.01 allows a remote attacker to violate the cross frame security policy via the NavigateComplete2 event.

Internet Explorer 4.x and 5.x does not properly verify all contents of an SSL certificate if a connection is made to the server via an image or a frame. This is one of two different 'SSL Certificate Validation' vulnerabilities.

Internet Explorer 4.x and 5.x does not properly re-validate an SSL certificate if the user establishes a new SSL session with the same server during the same Internet Explorer session.

The Protected Store in Windows 2000 does not properly select the strongest encryption, resulting in the use of a default 40-bit encryption instead of 56-bit DES.

Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, known as the 'DTS Password' vulnerability.

The vulnerability in Microsoft SQL Server 7.0 allows the Mixed Mode authentication mechanism to store the System Administrator (sa) account password in plaintext in a log file, which is accessible to any user.

The undocumented semconfig system call in BSD freezes the state of semaphores, allowing local users to cause a denial of service of the semaphore system.

Buffer overflow in xlockmore xlock program version 4.16 and earlier allows local users to read sensitive data from memory via a long -mode option.

The ftpd function in NetBSD 1.4.2 improperly parses entries in /etc/ftpchroot, preventing chroot from being applied to specified users. As a result, users can access files outside of their home directory.

NetBSD 1.4.2 and earlier allows local users to cause a denial of service by repeatedly running certain system calls in the kernel which do not yield the CPU.

A race condition in IPFilter firewall 3.4.3 and earlier allows remote attackers to bypass access restrictions when configured with overlapping 'return-rst' and 'keep state' rules.

The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys.

The Netopia R9100 router does not prevent authenticated users from modifying SNMP tables, even if the administrator has configured it to do so.

Internet Explorer 4.0 and 5.0 allow a malicious website to obtain client cookies from another domain by including that domain name and escaped characters in a URL, known as the 'Unauthorized Cookie Access' vulnerability.