CVE Vulnerability Catalog

The October 1998 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the ps and grep commands.

The invoke.cfm template in Allaire Spectra 1.0 allows users to bypass authentication via the bAuthenticated parameter.

Buffer overflow in the setlocale function in the libc module of FreeBSD allows attackers to execute arbitrary code via a long PATH_LOCALE environment variable.

Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabled.

The BMC Patrol component, when installed with Compaq Insight Management Agent 4.23 and earlier, or Management Agents for Servers 4.40 and earlier, creates a PFCUser account with a default password and potentially dangerous privileges.

The RSH service in Windows NT 3.5 through 4.0 improperly restricts access as specified in the .Rhosts file, potentially allowing unauthorized users to access the service from an authorized host.

IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain. This is known as the 'Domain Resolution' vulnerability.

Vulnerability in Cisco IOS versions 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical subinterface.

The automatic download option in the ncftp 2.4.2 FTP client on Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files to be downloaded.

Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.

The Web Cache Control Protocol (WCCP) in Cisco Cache Engine for Cisco IOS 11.2 and earlier does not use authentication, allowing remote attackers to redirect HTTP traffic to arbitrary hosts via WCCP packets sent to UDP port 2048.

Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, known as the Excel 'CALL Vulnerability.'

The loadmodule function in SunOS 4.1.x, as used by xnews, does not properly sanitize its environment, allowing local users to gain privileges.

The HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host.

Cisco PIX Private Link version 4.1.6 and earlier improperly processes certain commands in the configuration file, reducing the effective key length of the DES key to 48 bits instead of 56 bits.

Internet Explorer 4 treats a 32-bit number ("dotless IP address") in a URL as the hostname instead of an IP address, causing Local Intranet Zone settings to be applied to the resulting web page.

Buffer overflow in AnalogX SimpleServer:WWW HTTP server allows remote attackers to execute commands via a long GET request.

The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.

The rcS and mountall programs in Sun Solaris 2.x, possibly before 2.4, start a privileged shell on the system console if fsck fails while the system is booting.

Multiple buffer overflows in the filter command in Elm 2.4 allow attackers to execute arbitrary commands via (1) long From: headers, (2) long Reply-To: headers, or (3) via a long -f (filterfile) command line argument.