CVE Vulnerability Catalog

PHPGEDVIEW version 2.61 allows remote attackers to reinstall the software and change the administrator password via a direct HTTP request to editconfig.php.

Directory traversal vulnerability in fsp before version 2.81.b18 allows remote users to access files outside the FSP root directory.

Buffer overflow in CDE libDtSvc on HP-UX B.11.00, B.11.04, B.11.11, and B.11.22 allows local users to gain root privileges via unknown vectors.

XChat version 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, leading to a null dereference.

Multiple unknown vulnerabilities in (1) lpstat and (2) the libprint library in Solaris versions 2.6 through 9 may allow attackers to execute arbitrary code or read and write arbitrary files.

CVS server before version 1.11.10 may allow attackers to create directories and files in the file system root directory via malformed module requests.

CVE-2003-0978 describes a format string vulnerability in gpgkeys_hkp, allowing remote attackers or a malicious keyserver to cause a denial of service (crash) and potentially execute arbitrary code during key retrieval.

Buffer overflows in lftp version 2.6.9 and earlier in the try_netscape_proxy and try_squid_eplf functions allow remote HTTP servers to execute arbitrary code via long directory names processed by the ls or rels commands.

Buffer overflow in the authentication module for Cisco ACNS 4.x before 4.2.11 and 5.x before 5.0.5 allows remote attackers to execute arbitrary code via a long password.

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer. This allows local or remote attackers to conduct unauthorized activities via a 'bubba' local user account, an open TCP port 34571, or when a local DHCP server is unavailable, a DHCP server on the manufacturer's test network.

Cisco PIX firewall versions 5.x.x and 6.3.1 and earlier are vulnerable to an attack that can cause a crash and reload of the device via an SNMPv3 message when the snmp-server feature is enabled.

The Q.931 dissector in Ethereal before version 0.10.0 and Tethereal allows remote attackers to cause a denial of service (crash) by sending a malformed Q.931 packet, leading to a null dereference.

Buffer overflow in the Microsoft Message Queue Manager (MSQM) allows remote attackers to cause a denial of service (RPC service crash) via a queue registration request.

SQL injection vulnerability in calendar.php in Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which sets the $this->chosen_month variable.

Buffer overflow vulnerability in the web server of Webcam Watchdog 3.63 allows remote attackers to execute arbitrary code via a long HTTP GET request.

Directory traversal vulnerability in Advanced Poll 2.0.2 allows remote attackers to read arbitrary files or inject arbitrary local PHP files via .. sequences in the base_path or pollvars[lang] parameters.

Buffer overflow in mIRC before version 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.

iisPROTECT versions 2.1 and 2.2 allow remote attackers to bypass authentication via an HTTP request containing URL-encoded characters.

CVE-2003-1533 describes an SQL injection vulnerability in accesscontrol.php in PhpPass 2 that allows remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameters.

Buffer overflow in Epic Games Unreal Engine versions 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.