CVE Vulnerability Catalog

The new account wizard in Mail.app 2.0 in Mac OS 10.4, when configuring an IMAP mail account and checking the credentials, does not prompt the user to use SSL until after the password has already been sent, which causes the password to be sent in plaintext.

Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fpassword parameter to inc_functions.asp, (2) txtAddress, (3) message, or (4) subject parameter to post_info.asp, (5) andor parameter to search.asp, (6) verkey parameter to pop_profile.asp, or (7) Remove or (8) Delete parameter to pm_delete2.asp.

The SSH module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via shell metacharacters in arguments to certain commands, as demonstrated using ping and traceroute.

A vulnerability in DMail 3.1a allows a remote attacker to bypass authentication, read log files, and shut down the system by sending a sendlog command with an incorrect password hash, which is not properly handled by the _cmd_sendlog function.

Multiple SQL injection vulnerabilities in FishCart 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) cartid parameter to upstnt.php or (2) psku parameter to display.php. NOTE: the vendor disputes this report, claiming they are forced SQL errors; the original researcher is known to be unreliable.

The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.

Vulnerability in PwsPHP 1.2.2 allows remote attackers to obtain sensitive information via a direct request to the admin directory, which reveals the path in an error message.

Vulnerability in PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie.

Multiple SQL injection vulnerabilities in Quick.Forum 2.1.6 allow remote attackers to execute arbitrary SQL commands via the iCategory or page parameter to index.php, or iCategory parameter in the query string to the forum directory.

Heap-based buffer overflow in RSA SecurID Web Agent 5, 5.2, and 5.3 allows remote attackers to execute arbitrary code via crafted chunked-encoding data.

Multiple format string vulnerabilities in the DHCP and ANSI A dissectors in Ethereal before version 0.10.11 may allow remote attackers to execute arbitrary code.

A double free vulnerability in the ICEP dissector in Ethereal before 0.10.11 may allow remote attackers to execute arbitrary code.

Multiple buffer overflows in various protocol dissectors in Ethereal before 0.10.11 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.

The x-man-page: URI handler for Apple Terminal 1.4.4 in Mac OS X 10.3.9 does not cleanse terminal escape sequences, which allows remote attackers to execute arbitrary commands.

The vulnerability in index.php of Zorum 3.5 allows a remote attacker to trigger an SQL error and potentially inject arbitrary SQL commands via the search functionality.

The HTTP proxy service in Server Admin for Mac OS X 10.3.9 does not restrict access when it is enabled, which allows remote attackers to use the proxy.

In Mac OS X 10.3.9, the Bluetooth file exchange service is enabled by default, allowing remote attackers to access files without user notification, and local users to access files via the default directory.

Buffer overflow in the Netinfo Setup Tool (NeST) allows local users to execute arbitrary code.

In Mac OS X 10.3.9, an unknown vulnerability in chfn, chpass, and chsh programs uses external helper programs in an insecure manner, allowing local users to gain privileges.

lukemftpd in Mac OS X 10.3.9 allows remote authenticated users to escape the chroot environment by logging in with their full name.