CVE Vulnerability Catalog

Buffer overflow in HP Tru64 UNIX allows local users to execute arbitrary code via a long argument to /usr/bin/at.

In Oracle 9i and 8i, the catsnmp tool is installed with a dbsnmp user that has a default password. This allows attackers to perform restricted database operations and possibly gain other privileges.

l2tpd version 0.67 does not initialize the random number generator, allowing remote attackers to hijack sessions.

Buffer overflow in the ToolTalk RPC database server in Common Desktop Environment (CDE) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure.

Buffer overflow in ipcs for HP Tru64 UNIX versions 4.0f through 5.1a may allow attackers to execute arbitrary code.

The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability was incomplete, allowing remote attackers to gain additional privileges by directly requesting the web management URL.

CVE-2002-0851 describes a format string vulnerability in the ISDN Point to Point Protocol (PPP) daemon (ipppd) in the ISDN4Linux (i4l) package. This allows local users to gain root privileges via improperly handled format strings in the device name command line argument.

Format string vulnerabilities in the Oracle Listener Control utility (lsnrctl) for Oracle versions 9.2, 9.0, 8.1, and 7.3.4 allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.

Mailman before version 2.0.12 has a cross-site scripting vulnerability that allows remote attackers to execute scripts as other users via a subscriber's list subscription options in the adminpw or info parameters.

The i4l package on SuSE 7.3, 8.0, and possibly other operating systems has buffer overflows in the ISDN Point to Point Protocol (PPP) daemon (ipppd), which may allow local users to gain elevated privileges.

A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code.

Microsoft SQL Server 7.0 and 2000 have weak permissions for extended stored procedures associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges.

Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code.

Multiple buffer overflows in HP Tru64 UNIX allow local and possibly remote attackers to execute arbitrary code via a long NLSPATH environment variable. This affects components such as csh, dtsession, dxsysinfo, imapd, inc, uucp, uux, rdist, and deliver.

Buffer overflow in HP Tru64 UNIX versions 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows attackers to execute arbitrary code via a long _XKB_CHARSET environment variable in (1) dxpause, (2) dxconsole, or (3) dtsession.

Buffer overflow in the search capability for MyWebServer 1.0.2 allows remote attackers to execute arbitrary code via a long searchTarget parameter.

The ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file.

Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.

The db.php file in phpBB 2.0 (including RC-3 and earlier versions) contains a vulnerability that allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter.

AeroMail versions before 1.45 have a cross-site scripting vulnerability in message.php, allowing remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.