CVE Vulnerability Catalog

Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width.

Buffer overflow in dxterm allows local users to execute arbitrary code via a long -xrm argument.

Vulnerability in Compaq ProLiant BL e-Class Integrated Administrator versions 1.0 and 1.10 allows authenticated users with Telnet, SSH, or console access to conduct unauthorized activities.

Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted.

Microsoft Visual FoxPro 6.0 does not register its associated files with Internet Explorer, allowing remote attackers to execute Visual FoxPro applications without warning via HTML that references specially-crafted filenames.

Wordtrans version 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to execute arbitrary code or conduct cross-site scripting attacks via certain parameters (possibly 'dict') to the wordtrans.php script.

Multiple buffer overflows in in.rarpd (ARP server) on Solaris, and possibly other operating systems including Caldera UnixWare and Open UNIX, allow remote attackers to execute arbitrary code.

The 3Com OfficeConnect Remote 812 ADSL Router with firmware versions 1.1.9 and 1.1.7 allows remote attackers to bypass port access restrictions by quickly connecting to an approved port and then to the desired port.

The login form for LogiSense software, including Hawk-i Billing, Hawk-i ASP, and DNS Manager, has an SQL injection vulnerability that allows remote attackers to bypass authentication by injecting SQL code into the password field.

PostgreSQL versions 7.2.1 and 7.2.2 allow local users to delete transaction log (pg_clog) data via the VACUUM command, potentially leading to data loss.

Microsoft Internet Explorer 5.5 and 6.0 does not properly verify the domain of a frame within a browser window, allowing remote attackers to read client files or invoke executable objects via the Object tag.

The X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which could allow local users to gain elevated privileges.

The URL handler in the manual browser option for Gaim before version 0.59.1 allows remote attackers to execute arbitrary script via shell metacharacters in a link.

Buffer overflow in the parsing mechanism for ISS Internet Scanner 6.2.1, when using the license banner HTTP check, allows remote attackers to execute arbitrary code via a long web server response.

The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is vulnerable as components marked as safe for scripting allow remote attackers to execute arbitrary commands via the setTimeout method.

Buffer overflow in Microsoft File Transfer Manager (FTM) ActiveX control before version 4.0 allows remote attackers to execute arbitrary code via a long TS value.

CVE-2002-0985 describes a vulnerability in the mail function for PHP 4.x to 4.2.2 that allows attackers to bypass safe mode restrictions and modify command line arguments to the MTA, potentially leading to unauthorized command execution.

Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line.

Buffer overflow in Microsoft DirectX Files Viewer ActiveX control (xweb.ocx) version 2.0.6.15 and earlier allows remote attackers to execute arbitrary code via a long File parameter.

The IRC script in Light 2.7.x before version 2.7.30p5 and 2.8.x before version 2.8pre10, running EPIC, allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code.