CVE Vulnerability Catalog

Multiple heap-based buffer overflows in EMC Legato NetWorker and related products (Sun Solstice Backup, StorEdge EBS) allow remote attackers to execute arbitrary code or cause denial of service via malformed RPC packets to nsrd.exe (program 390109) and nsrexecd.exe (program 390113).

Vulnerability in initscripts in Red Hat Enterprise Linux 4 allows local users with sudo permissions for /sbin/service to escalate privileges to root via improper handling of environment variables.

Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.

A CSRF vulnerability in the management interface of VMware ESX Server allows a remote attacker to perform unauthorized actions as an administrator via crafted URLs, such as changing a password using the setUsr operation.

The tuxpaint-import.sh script in Tux Paint version 0.9.14 and earlier creates temporary files insecurely, which may lead to unknown impacts and attack vectors.

Multiple SQL injection vulnerabilities in PHPSurveyor before version 0.991 allow remote attackers to execute arbitrary SQL commands via the sql parameter in browse.php and the sid, lid, gid, and token parameters in other PHP scripts.

Juniper NetScreen-Security Manager (NSM) 2004 FP2 and FP3 are vulnerable to a denial of service attack via a long crafted string sent to port 7800 (GUI Server) or 7801 (Device Server), causing server components to crash or hang, though they are automatically restarted.

Buffer overflow in the IKEv1 implementation in ADTRAN NetVanta before version 10.03.03.E. A remote attacker can exploit crafted IKE packets, potentially leading to unspecified impacts, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the loginid parameter. This is a different vulnerability than CVE-2005-3875.

Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form.

In Plogger Beta 2, the file plog-admin-functions.php contains a PHP remote file inclusion vulnerability. An attacker can execute arbitrary code by providing a URL in the config[basedir] parameter.

IKEv1 implementations in FortiOS, FortiClient, and FortiManager allow remote attackers to cause a denial of service by sending IKE packets with invalid IPSec attribute values. The attack terminates a process that is automatically restarted.

Multiple SQL injection vulnerabilities in myEZshop Shopping Cart allow remote attackers to execute arbitrary SQL commands via the GroupsId and ItemsId parameters in admin.php.

Multiple format string vulnerabilities in FTGate 4.4 POP3 (USER, PASS, TOP) and IMAP (LIST, AUTHENTICATE) commands allow remote attackers to execute arbitrary code via crafted format specifiers.

A format string vulnerability in the IKEv1 implementation in ADTRAN NetVanta before version 10.03.03.E may allow a remote attacker to cause an unknown impact by sending crafted IKE packets containing format string specifiers, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

A stack-based buffer overflow in index.fts of FTGate 4.4 (Build 4.4.000 Oct 26 2005) allows remote attackers to execute arbitrary code via a long tzoffset value.

Electric Sheep 2.6.3 does not require authentication or integrity checks between server and client, allowing remote attackers to download and display arbitrary MPEG files via DNS spoofing, command-line URL, or configuration file URL. The description notes similar attack vectors apply to web browsers, questioning its specificity.

An unspecified vulnerability in the GTP dissector of Ethereal versions 0.9.1 through 0.10.13 allows remote attackers to cause an infinite loop, resulting in a denial of service (DoS). The attack can be carried out via unknown vectors.

The vulnerability in rssh versions 2.0.0 through 2.2.3 allows local users to bypass access restrictions and gain root privileges by using the rssh_chroot_helper command to chroot to an external directory.

A vulnerability in the Windows GDI32.DLL library allows remote code execution via a crafted WMF image with a SETABORTPROC GDI Escape call, affecting the Picture and Fax Viewer (SHIMGVW.DLL). This flaw was originally exploited in the wild on unionseek.com.