CVE Vulnerability Catalog

A format string vulnerability in the test_func_func function in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the str variable.

A buffer overflow vulnerability in the parse_all_client_messages function in LCDproc versions 0.4.x through 0.4.4 allows remote attackers to execute arbitrary code by sending a large number of arguments.

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 and 10 allow remote attackers to inject arbitrary web script or HTML via parameters such as email, file, dns, account, db, login, or ip in URLs.

Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to steal users' passwords by manipulating parameters in various scripts.

A stack-based buffer overflow in the OutputDebugString function for Adobe Acrobat Reader 5.1 allows remote attackers to execute arbitrary code via a PDF document with XML Forms Data Format (XFDF) data.

CVE-2003-1018 describes a format string vulnerability in the enq command in AIX 4.3, 5.1, and 5.2 that allows local users with rintq group privileges to gain additional privileges.

An unknown vulnerability in rpc.mountd on SGI IRIX versions 6.5.18 through 6.5.22 allows remote attackers to mount from unprivileged ports even with the -n option disabled.

mod_access in Apache 1.3 before 1.3.30, when running on big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.

GTKSee versions 0.5 and 0.5.1 have a heap-based buffer overflow that allows remote attackers to execute arbitrary code via a PNG image of certain color depths.

Buffer overflow in cd9660.util in Apple Mac OS X versions 10.0 through 10.3.2 and Apple Mac OS X Server versions 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.

Unknown vulnerability in ftpd in IBM AIX 5.2, when configured to use Kerberos 5 for authentication, allows remote attackers to gain privileges via unknown attack vectors.

Workgroup Manager in Apple Mac OS X Server 10.2 through 10.2.6 does not disable a password for a new account before it is saved, allowing remote attackers to gain unauthorized access via the new account before it is saved.

Directory Services in Apple Mac OS X versions 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server versions 10.2 through 10.3.2 accept authentication server information from unknown LDAP or NetInfo sources, which can be exploited by a malicious DHCP server.

Apple Mac OS X versions 10.0 through 10.2.8 allow local users with a USB keyboard to gain unauthorized access. This can be achieved by holding down the CTRL and C keys during system boot, which crashes the init process and leaves the user in a root shell.

Synaesthesia 2.2 and earlier allows local users to execute arbitrary code via a symlink attack on the configuration file.

SQL injection vulnerability in Extreme Messageboard (XMB) 1.9 beta allows remote attackers to execute arbitrary SQL commands via the restrict parameter to member.php, misc.php, or today.php.

A stack-based buffer overflow in WinSig.exe in eSignal 7.5 and 7.6 allows remote attackers to execute arbitrary code via a long STREAMQUOTE tag.

The vulnerability in Dameware Mini Remote Control 4.1.0.0 is due to using insufficiently random data to generate the encryption key. This allows a remote attacker to guess the key via brute force and gain access to sensitive information.

Buffer overflow vulnerability in the logging function of Picophone 1.63 and earlier allows remote attackers to execute arbitrary code via a large packet.

A buffer overflow vulnerability in Mollensoft Lightweight FTP Server 3.6, triggered by a long CWD command, allows remote authenticated users to cause a denial of service (crash) and potentially execute arbitrary code.