CVE Vulnerability Catalog

The 'sa' account in Microsoft SQL Server 2000, SQL Server 7.0, and MSDE 1.0 is installed with a default null password, allowing remote attackers to gain privileges. This also affects third-party packages that use these products.

CVE-2000-1208 describes a vulnerability in the startprinting() function in printjob.c of the BSD-based lpr lpd package. It may allow local users to gain privileges through an improper syslog call that uses format strings from the checkremote() call.

Multiple buffer overflows in HP Tru64 UNIX allow local users to gain root privileges through commands such as su, chsh, passwd, chfn, dxchpwd, and libc.

eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by reading password.txt.

Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode.

Yahoo! Messenger version 5.0.0.1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI.

The URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&).

The TFTP server for Red-M 1050 (Bluetooth Access Point) cannot be disabled, making it easier for remote attackers to crack the administration password via brute force methods.

Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges.

The Network Address Translation (NAT) capability for Netfilter ('iptables') 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.

The FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, allowing remote attackers to bypass firewall rules or spoof FTP server responses.

CVE-2002-0716 describes a format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 that allows local users to gain privileges via format string specifiers in the file name argument.

Buffer overflow in lprintf and cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server.

The directory.php script by Marcus S. Xenakis allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter.

Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript. Attackers can steal credit card numbers or delete items by injecting the script into new customer information fields such as the message field.

Trend Micro InterScan VirusWall HTTP proxy 3.6 with the 'Skip scanning if Content-length equals 0' option enabled allows malicious web servers to bypass content scanning via a Content-length header set to 0, which is often ignored by HTTP clients.

Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum. This may allow remote authenticated users to bypass group policies.

Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to webplus.exe program, which triggers the overflow in webpsvc.exe.

Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.

Smsd in SMS Server Tools (SMStools) before version 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, referred to as a 'string format vulnerability'.