CVE Vulnerability Catalog

Cisco ONS15454 and ONS15327 running ONS before 3.4 have an account for the VxWorks Operating System that cannot be changed or disabled. This allows remote attackers to gain privileges by connecting to the account via Telnet.

Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.

Novell eDirectory version 8.6.2 and Netware 5.1 eDir 85.x allows users with expired passwords to gain inappropriate permissions when logging in from Remote Manager.

CVE-2002-1553 affects Cisco ONS15454 and ONS15327 devices running ONS versions prior to 3.4. It allows remote attackers to modify system configuration and delete files by establishing an FTP connection to TCC, TCC+, or XTC using a non-existent username and password.

Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3 and OpenBSD 3.2 and earlier allows local users to gain root privileges via long command line arguments such as request ID or user name.

A buffer overflow in the SMB/CIFS packet fragment re-assembly code for the Samba daemon (smbd) before version 2.2.8 and Samba-TNG before version 0.3.1 allows remote attackers to execute arbitrary code.

The kernel module loader in Linux kernel 2.2.x before 2.2.25 and 2.4.x before 2.4.21 allows local users to gain root privileges by using ptrace to attach to a child process spawned by the kernel.

Multiple vulnerabilities in NetPBM 9.20 and earlier may allow remote attackers to cause a denial of service or execute arbitrary code via maths overflow errors, such as integer signedness errors or integer overflows, leading to buffer overflows.

Unknown vulnerability in newtask for Solaris 9 allows local users to gain root privileges.

Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields.

Integer overflow in the JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating systems allows remote attackers to execute arbitrary code via a malicious web page or HTML email that uses a large array index value.

Version 4 of the Kerberos protocol (krb4) in the krb5 distribution has weaknesses that allow an attacker to create krb4 tickets for unauthorized principals. This is achieved through a cut-and-paste attack and 'ticket splicing', especially when triple-DES keys are used.

The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a are vulnerable to an attack that allows remote attackers to perform unauthorized RSA private key operations. This attack uses a modified Bleichenbacher method that involves establishing a large number of SSL or TLS connections.

MySQL version 3.23.55 and earlier creates world-writable files, allowing MySQL users to gain root privileges by using the 'SELECT * INFO OUTFILE' operator to overwrite a configuration file, resulting in MySQL running as root upon restart.

Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.

BEA WebLogic Server and Express versions 6.0 through 7.0 do not properly restrict access to certain internal servlets that perform administrative functions. This allows remote attackers to read arbitrary files or execute arbitrary code.

Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.

CVE-2003-0081 describes a format string vulnerability in packet-socks.c of the SOCKS dissector for Ethereal versions 0.8.7 through 0.9.9. This allows remote attackers to execute arbitrary code via SOCKS packets containing format string specifiers.

The aterm terminal emulator 0.42 allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the command line in the user's terminal.

The PuTTY terminal emulator version 0.53 allows attackers to modify the window title via a certain character escape sequence, which could lead to injecting malicious commands into the user's command line.