CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap-based buffer overflow in the DCOM interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter.
Aspppls for Solaris 8 allows local users to overwrite arbitrary files via a symlink attack on the .asppp.fifo temporary file.
Buffer overflow in Netris 0.52 and earlier, and possibly other versions, allows remote malicious Netris servers to execute arbitrary code on netris clients via a long server response.
A vulnerability in GSAPAK.EXE for GameSpy Arcade, possibly in versions before 1.3e, allows remote attackers to overwrite arbitrary files and execute arbitrary code via .. (dot dot) sequences in filenames in a .APK (Zip) file.
The C-Media PCI sound driver in Linux before version 2.4.21 does not use the get_user function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities.
CVE-2003-0671 describes a format string vulnerability in tcpflow that allows local users to execute arbitrary code via the device name argument in a setuid context.
CVE-2003-0616 describes a format string vulnerability in the ePO service for McAfee ePolicy Orchestrator versions 2.0, 2.5, and 2.5.1. It allows remote attackers to execute arbitrary code via a POST request with format strings in the computerlist parameter, which are used when logging a failed name resolution.
Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434.
CVE-2003-0575 involves a heap-based buffer overflow in the name services daemon (nsd) in SGI IRIX 6.5.x through 6.5.21f, allowing attackers to gain root privileges via the AUTH_UNIX gid list.
Buffer overflow in WiTango Application Server and Tango 2000 allows remote attackers to execute arbitrary code via a long cookie to Witango_UserReference.
Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare version 0.9.16preRC and earlier, related to the VFS path being under the web document root.
Novell iChain 2.2 before Support Pack 1 does not properly verify that URL redirects match the DNS name of an accelerator, allowing attackers to redirect URLs to malicious web sites.
Windows Media Player (WMP) 7 and 8, running on Internet Explorer and possibly other Microsoft products that process HTML, allows remote attackers to bypass zone restrictions and access or execute arbitrary files via an IFRAME tag pointing to an ASF file whose Content-location contains a File:// URL.
The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.
The installation of Apple QuickTime / Darwin Streaming Server before version 4.1.3f starts the administration server with a 'Setup Assistant' page that allows remote attackers to set the administrator password and gain privileges before the real administrator.
Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with large length for a Text or Copyright string, or a large number of tracks, leading to a heap-based buffer overflow.
Apple QuickTime / Darwin Streaming Server before version 4.1.3g is vulnerable to an attack that can lead to service crashes. Attackers can exploit a .. (dot dot) sequence followed by an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220.
Internet Explorer versions 5.01 SP3 through 6.0 SP1 improperly determine object types returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter pointing to a malicious file.
Up2date versions 3.0.7 and 3.1.23 do not properly verify RPM GPG signatures, which could allow remote attackers to install unsigned packages from the Red Hat Network if that network is compromised.
Buffer overflow in the BR549.DLL ActiveX control for Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to execute arbitrary code.