CVE Vulnerability Catalog

Default ECL in Lotus Notes before version 5.02 allows remote attackers to execute arbitrary commands by attaching a malicious program in an email message that is automatically executed when the user opens the email.

The prepend.php3 file in PHPLib before version 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server.

Buffer overflow in the line printer daemon (in.lpd) for Solaris 8 and earlier allows local and remote attackers to gain root privileges via a 'transfer job' routine.

The telnet service in Microsoft Windows 2000 creates named pipes with predictable names and does not properly verify them, allowing local users to execute arbitrary commands.

Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid.

The dnskeygen tool in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for an HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG). This allows attackers to obtain the keys and perform dynamic DNS updates.

An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account.

The HTTP server for Cisco IOS versions 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands when local authorization is used by specifying a high access level in the URL.

Multiple buffer overflows in RADIUS daemon radiusd in (1) Merit 3.6b and (2) Lucent 2.1-2 allow remote attackers to cause a denial of service or execute arbitrary commands.

Buffer overflow in the Transparent Network Substrate (TNS) Listener in Oracle 8i version 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands STATUS, PING, SERVICES, TRC_FILE, SAVE_CONFIG, or RELOAD.

The SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier accepts arbitrary community strings with requested MIB modifications, allowing remote attackers to obtain sensitive information such as WEP keys.

Buffer overflows in the NetWin Authentication Module (NWAuth) version 3.0b and earlier could allow attackers to execute arbitrary code via long arguments to the -del or -lookup commands. This issue affects DMail, SurgeFTP, and possibly other packages.

Directory traversal vulnerability in IBM alphaWorks Java TFTP server 1.21 allows remote attackers to conduct unauthorized operations on arbitrary files via a .. (dot dot) attack.

Vulnerability in Scanner Access Now Easy (SANE) before version 1.0.5, related to pnm and saned.

Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.

Vulnerability in IntraGnat before version 1.4 allows potential attackers to gain unauthorized access to the system.

Vulnerability in autodns.pl for AutoDNS before version 0.0.4 related to domain names that are not fully qualified.

Vulnerability in mkacct in HP-UX 11.04 running Virtualvault Operating System (VVOS) 4.0 and 4.5 allows attackers to elevate privileges.

The checkAccess function in PHPSlice version 0.1.4 and all versions between 0.1.1 and 0.1.6 does not properly verify the administrative access level, which could allow remote attackers to gain privileges.

Vulnerability in the nPULSE server before version 0.53p4.