CVE Vulnerability Catalog

SQL injection vulnerability in loginact.asp for Hummingbird CyberDOCS before version 3.9 allows remote attackers to execute arbitrary SQL commands.

There is an off-by-one buffer overflow in spamc of SpamAssassin versions 2.40 through 2.43 when using BSMTP mode ('-B'). This allows remote attackers to execute arbitrary code via emails containing headers with leading '.' characters.

Integer overflow in MP3Broadcaster for Apple QuickTime/Darwin Streaming Server 4.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed ID3 tags in MP3 files.

The SIP implementation in Mediatrix Telecom VoIP Access Devices and Gateways running SIPv2.4 and SIPv4.3 firmware allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages.

XMMS.pm in X2 XMMS Remote allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086.

MAILsweeper for SMTP version 4.3 allows remote attackers to bypass virus protection via a mail message with a malformed zip attachment, as exploited by certain MIMAIL virus variants.

Kerio Personal Firewall (KPF) version 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), allowing remote attackers to bypass the firewall filters.

The slashem-tty program in the FreeBSD Ports Collection is installed with write permissions for the games group, allowing local users with games group privileges to modify slashem-tty and execute arbitrary code as other users.

Aladdin Knowlege Systems eSafe Gateway version 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, allowing remote attackers to bypass virus protection.

DotBr version 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter in (1) exec.php3 or (2) system.php3.

DotBr 0.1 stores config.inc with insufficient access control under the web document root, allowing remote attackers to obtain sensitive information such as SQL usernames and passwords.

Buffer overflow in Gupta SQLBase 8.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long EXECUTE command.

Buffer overflow in the reverse DNS lookup of Smart IRC Daemon (SIRCD) versions 0.4.0 and 0.4.4 allows remote attackers to execute arbitrary code via a client with a long hostname.

Buffer overflow in wall for HP-UX versions 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.

Aprelium Technologies Abyss Web Server version 1.1.2, and possibly earlier versions, allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty Connection or Range fields.

Unknown vulnerability in VERITAS Bare Metal Restore (BMR) of Tivoli Storage Manager (TSM) versions 3.1.0 through 3.2.1 allows remote attackers to gain root privileges on the BMR Main Server.

Incorrect file handling in sort in HP-UX 10.01 through 10.20 and 11.00 through 11.11 may allow attackers to gain access or cause a denial of service.

Multiple stack-based buffer overflows in Atrium MERCUR IMAPD in MERCUR Mailserver before version 4.2.15.0 allow remote attackers to execute arbitrary code via long commands such as EXAMINE, DELETE, SUBSCRIBE, RENAME, UNSUBSCRIBE, LIST, LSUB, STATUS, LOGIN, CREATE, or SELECT.

The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals.

Buffer overflow in CuteFTP 5.0 allows remote attackers to execute arbitrary code via a long response to a LIST command.