CVE Vulnerability Catalog

A heap-based buffer overflow in the TFTP server capability in Cisco IOS versions 11.1, 11.2, and 11.3 can be exploited by remote attackers. Attackers can cause a denial of service or modify configuration by sending a long filename.

Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2 improperly handle URL-encoded field names, which may cause certain fields to appear unset. This results in the removal of group permissions on bugs when buglist.cgi is provided with the encoded field names.

Bugzilla 2.14 before 2.14.2 and 2.16 before 2.16rc2 have cross-site scripting vulnerabilities. Attackers can exploit the full name field to execute scripts in the context of other Bugzilla users.

Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname.

Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to the filter with a long HTTP host header field in a URL for a .jsp file.

Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434.

Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.

The Mail Merge Tool in Microsoft Word 2002 for Windows, when Microsoft Access is present on a system, allows remote attackers to execute Visual Basic (VBA) scripts within a mail merge document that is saved in HTML format.

Ecartis (formerly Listar) 1.0.0 in snapshot 20020125 and earlier does not properly drop privileges when installed setuid-root, and 'lock-to-user' is not set. This could allow local users to gain elevated privileges.

Vulnerability in pppd on UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to gain root privileges via ppptalk or ppp. This is a different vulnerability than CVE-2002-0824.

Tinyproxy versions 1.5.0, 1.4.3, and earlier allow remote attackers to execute arbitrary code via memory that is freed twice (double-free).

Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter.

ASP-Nuke RC2 and earlier allows remote attackers to bypass authentication and gain privileges by modifying the 'pseudo' cookie.

Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.

In Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2, during a mass change, the groupset of all bugs is set to the groupset of the first bug. This could inadvertently lead to insecure groupset permissions being assigned to some bugs.

getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter. This issue is addressed by the 'UpdateUser' hot fix.

Off-by-one overflow in the PreservePermissions function in rcs.c for CVS before version 1.11.2 allows local users to execute arbitrary code.

Cross-site scripting vulnerabilities in the iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute scripts as the administrator via modified LOCID or OC parameters in administrator URLs.

Opera browser versions 6.01, 6.0, and 5.12 allow remote attackers to execute arbitrary JavaScript in the security context of other sites by setting the location of a frame or iframe to a Javascript: URL.