CVE Vulnerability Catalog

A stack-based buffer overflow in Active Directory in Windows 2000 before SP4 can be exploited by remote attackers. Attackers can cause a denial of service (reboot) and potentially execute arbitrary code by sending an LDAP version 3 search request with a large number of conditions.

Cistron RADIUS daemon (radiusd-cistron) version 1.6.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large value in an NAS-Port attribute, leading to a buffer overflow.

There is an SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before version 1.2.9rc1 that allows remote attackers to execute arbitrary SQL queries.

Snitz Forums 3.4.03 and earlier allows attackers to gain privileges as other users by stealing and replaying the encrypted password after obtaining a valid session ID.

Buffer overflow in the 'RuFSI Utility Class' ActiveX control used for the Symantec Security Check service allows remote attackers to execute arbitrary code via a long argument to CompareVersionStrings.

Multiple buffer overflows in Kerio MailServer 5.6.3 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code.

Buffer overflow in the WWWLaunchNetscape function of Adobe Acrobat Reader 5.0.7 and earlier allows remote attackers to execute arbitrary code via a .pdf file with a long mailto link.

TUTOS 1.1 allows remote attackers to execute arbitrary code by uploading the code using file_new.php, then directly accessing the uploaded code via a request to the repository containing the code.

The Tutorials 2.0 module in XOOPS and E-XOOPS allows remote attackers to execute arbitrary code by uploading a PHP file without a MIME image type, then directly accessing the uploaded file.

Multiple buffer overflows in xgalaga 2.0.34 and earlier allow local users to gain privileges via a long HOME environment variable.

An unknown vulnerability in the IPv6 capability in IRIX 6.5.19 causes snoop to process packets as the root user, with unknown implications.

Caché Database 5.x installs the /cachesys/csp directory with insecure permissions, allowing local users to execute arbitrary code by adding server-side scripts that are executed with root privileges.

Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via cut-and-paste operation, as demonstrated in Internet Explorer 5.0 using a long 'align' argument in an HR tag.

Buffer overflow in the ShellExecute API function of SHELL32.DLL in Windows 2000 before SP4 may allow attackers to cause a denial of service or execute arbitrary code via a long third argument.

The installation of Dantz Retrospect Client 5.0.540 on MacOS X 10.2.6, and possibly other versions, creates critical directories and files with world-writable permissions, allowing local users to gain privileges as other users by replacing programs with malicious code.

Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to WebAdmin.dll with a long USER argument.

Caché Database 5.x installs the file /cachesys/bin/cache with world-writable permissions, allowing local users to gain privileges by modifying the cache and executing it via cuxs.

The password.asp file in Snitz Forums version 3.4.03 and earlier allows remote attackers to reset passwords and gain privileges as other users by sending a modified request to password.asp with a different member id.

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute.

CVE-2003-0510 describes a format string vulnerability in ezbounce versions 1.0 through 1.50 that allows remote attackers to execute arbitrary code via the 'sessions' command.