CVE Vulnerability Catalog

Internet Explorer 4 treats a 32-bit number ("dotless IP address") in a URL as the hostname instead of an IP address, causing Local Intranet Zone settings to be applied to the resulting web page.

Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, allowing remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data.

Buffer overflow in Internet Explorer 4.01 and earlier allows remote attackers to execute arbitrary commands via a long URL with the 'mk:' protocol.

Multiple buffer overflows in ISC DHCP Distribution server (dhcpd) versions 1.0 and 2.0 allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary commands via long options.

Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking.

mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.

SAS System 5.18 on VAX/VMS has insecure permissions for its directories and startup file, allowing local users to gain elevated privileges.

Multiple buffer overflows in the filter command in Elm 2.4 allow attackers to execute arbitrary commands via (1) long From: headers, (2) long Reply-To: headers, or (3) via a long -f (filterfile) command line argument.

The loadmodule function in SunOS 4.1.x, as used by xnews, does not properly sanitize its environment, allowing local users to gain privileges.

The rcS and mountall programs in Sun Solaris 2.x, possibly before 2.4, start a privileged shell on the system console if fsck fails while the system is booting.

The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.

Buffer overflow in AnalogX SimpleServer:WWW HTTP server allows remote attackers to execute commands via a long GET request.

Cisco PIX Private Link version 4.1.6 and earlier improperly processes certain commands in the configuration file, reducing the effective key length of the DES key to 48 bits instead of 56 bits.

The HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host.

Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.

The SystemSoft SystemWizard package on HP Pavilion PCs with Windows 98, and possibly other platforms, installs two ActiveX controls marked as safe for scripting. This allows remote attackers to execute arbitrary commands via a malicious web page that references the Launch control or the RegObj control.

The RSH service in Windows NT 3.5 through 4.0 improperly restricts access as specified in the .Rhosts file, potentially allowing unauthorized users to access the service from an authorized host.

Vulnerability in Cisco IOS versions 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical subinterface.

When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies.

Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabled.