CVE Vulnerability Catalog

Buffer overflow in Sun ONE / iPlanet Web Server versions 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding.

Buffer overflow in Eudora 5.1.1 and 5.0-J for Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a multi-part message with a long boundary string.

Internet Explorer versions 5, 5.6, and 6 allow remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData (storeuserData) feature.

Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via the SOCKS, RSVP, AFS, or LMP dissectors, which can be caused to core dump.

FreeBSD kernel 4.6 and earlier closes file descriptors 0, 1, and 2 after they have been assigned to /dev/null when the descriptors reference procfs or linprocfs. This could allow local users to reuse the file descriptors in a setuid or setgid program to modify critical data and gain privileges.

Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.

Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434.

OpenSSL versions 0.9.6d and earlier, and 0.9.7-beta2 and earlier, do not properly handle ASCII representations of integers on 64-bit platforms. This could allow attackers to cause a denial of service and possibly execute arbitrary code.

Buffer overflows in OpenSSL versions 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via a large client master key in SSL2 or a large session ID in SSL3.

Cross-site scripting vulnerability in functions-inc.asp for ASP-Nuke RC1 allows remote attackers to execute script as other ASP-Nuke users by embedding it within an IMG tag.

The db.php file in phpBB 2.0 (including RC-3 and earlier versions) contains a vulnerability that allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter.

Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers to execute code in the Local System context by authenticating to a web page that calls the function.

Buffer overflow in Talentsoft Web+ 5.0 allows remote attackers to execute arbitrary code via an HTTP request with a long cookie.

Buffer overflow in lsmcode in AIX 4.3.3 may lead to unauthorized access or execution of malicious code.

Vulnerability in template.dhcpo in AIX 4.3.3 related to an insecure linker argument.

Buffer overflow in pioout on AIX 4.3.3 may lead to unauthorized access or execution of malicious code.

MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients.

CVE-2002-0735 describes a format string vulnerability in the logging() function in the C-Note Squid LDAP authentication module (squid_auth_LDAP) version 2.0.2 and earlier. This allows remote attackers to trigger log messages, potentially leading to denial of service and arbitrary code execution.

The b2edit.showposts.php file in B2 version 2.0.6pre2 and earlier has a flaw that fails to properly load the b2config.php file in some configurations. This allows remote attackers to execute arbitrary PHP code via a URL that sets the $b2inc variable to point to a malicious program stored on a remote server.

Cross-site scripting vulnerability in thttpd 2.20 and earlier allows remote attackers to execute arbitrary script via a URL to a nonexistent page, which causes thttpd to insert the script into a 404 error message.