CVE Vulnerability Catalog

A buffer overflow in GNU Chess (gnuchess) version 5.02 and earlier may occur when the application is used in a manner inconsistent with its design as a single-user application. This may allow local or remote attackers to execute arbitrary code via a long command.

Cross-site scripting (XSS) vulnerability in error.asp for Plumtree Corporate Portal versions 3.5 through 4.5 allows remote attackers to execute arbitrary script on other clients via the 'Description' parameter.

The index.php file in PHP-Nuke version 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter.

Buffer overflow in Real Networks RealPlayer 8.0 and earlier allows remote attackers to execute arbitrary code via a header length value that exceeds the actual length of the header.

The vulnerability in TOLIS Group's Backup and Restore Utility (BRU) 17.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/brutest.$$ temporary file.

Cross-site scripting (XSS) vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients. The attack can be carried out via the Title field or a Private Message Box and the image field parameter in pmlite.php.

PhpSmsSend version 1.0 has a vulnerability that allows remote attackers to execute arbitrary commands via an SMS message containing shell metacharacters.

Infopop UBB.Threads version 5.4 and Wired Community Software WWWThreads versions 5.0 through 5.0.9 allow remote attackers to upload arbitrary files by using a filename that contains an accepted extension but ends in a different extension.

Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter.

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.

Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.

Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.

Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code.

Webalizer 2.01-06 has a buffer overflow when configured to use reverse DNS lookups. This allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.

Zope versions 2.2.0 through 2.5.1 do not properly verify access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

Vulnerability in Imlib before version 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments passed to malloc, resulting in heap corruption.

Imlib before 1.9.13 sometimes uses the NetPBM package to load trusted images, which could allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain weaknesses of NetPBM.

Cross-site scripting vulnerability in analog before version 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is logged in web logfiles and not properly filtered by analog during display.

Funk Software Proxy Host versions 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control. This allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.

Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code.