CVE Vulnerability Catalog

Norton AntiVirus 5.00.01C with the Novell Netware client does not properly restart the auto-protection service after the first user has logged off of the system.

The uagentsetup program in ARCServeIT Client Agent 6.62 does not properly check for the existence or ownership of a temporary file that is moved to the agent.cfg configuration file. This allows local users to execute arbitrary commands by modifying the temporary file before it is moved.

The telnetd telnet server in IRIX versions 5.2 through 6.1 does not properly clean user-injected format strings, allowing remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.

The xpdf PDF viewer client earlier than version 0.91 does not properly launch a web browser for embedded URLs, allowing an attacker to execute arbitrary commands via a URL containing shell metacharacters.

Linux Intrusion Detection System (LIDS) version 0.9.7 allows local users to gain root privileges when LIDS is disabled via the security=0 boot option.

Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, allowing remote attackers to create a server on the victim's system via a malicious applet.

PCCS MySQLDatabase Admin Tool Manager version 1.2.4 and earlier installs the file dbconnect.inc within the web root, allowing remote attackers to obtain sensitive information such as the administrative password.

suidperl (also known as sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, allowing local users to gain privileges.

The Raptor GFX configuration tool, pgxconfig, uses a relative path for a system call to the 'cp' program, allowing local users to execute arbitrary commands by modifying their path to point to an alternate 'cp' program.

Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter.

Account Manager LITE does not properly authenticate attempts to change the administrator password, allowing remote attackers to gain privileges for the Account Manager by directly calling the amadmin.pl script with the setpasswd parameter.

Subscribe Me LITE does not properly authenticate attempts to change the administrator password, allowing remote attackers to gain privileges for the Account Manager by directly calling the subscribe.pl script with the setpwd parameter.

Buffer overflow in lpstat in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long -n option.

BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.

Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension.

CVS server version 1.10.8 does not properly restrict users from creating arbitrary Checkin.prog or Update.prog programs. This allows remote CVS committers to modify or create Trojan horse programs with the Checkin.prog or Update.prog names, then perform a CVS commit action.

Buffer overflow in dmplay in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long command line option.

The default installation of eTrust Access Control (formerly SeOS) uses a default encryption key, allowing remote attackers to spoof the eTrust administrator and gain privileges.

The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker to execute arbitrary commands.

IRC Xchat client versions 1.4.2 and earlier allows remote attackers to execute arbitrary commands by encoding shell metacharacters into a URL which XChat uses to launch a web browser.