CVE Vulnerability Catalog

Multiple buffer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.

Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.

The FTP server in HP-UX 10.20, B.11.00, and B.11.11 allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.

Paros 3.2.5 uses a default password for the 'sa' account in the underlying HSQLDB database and does not restrict access to the local machine, which allows remote attackers to gain privileges.

An integer overflow in the openpsfile function in gsinterf.c of Jan Kybic BitMap Viewer (BMV) 1.2 allows local users to execute arbitrary code via a PostScript (PS) file containing a large number of pages value, which leads to a resultant buffer overflow.

Splatt Forum versions 3.0 through 3.2 contain a vulnerability that allows remote attackers to bypass authentication via unknown vectors.

SQL injection vulnerability in Accelerated Mortgage Manager allows remote attackers to execute arbitrary SQL commands via the password field.

A stack-based buffer overflow in the vgasco_printf function of Jan Kybic BitMap Viewer (BMV) 1.2, when compiled with the M_UNIX flag and running setuid, allows local users to gain privileges via a long filename in the -b command line option.

Multiple buffer overflows in AhnLab V3 AntiVirus V3Pro 2004 before 6.0.0.488, V3Net for Windows Server 6.0 before 6.0.0.488, and MyV3, with compressed file scanning enabled, allow remote attackers to execute arbitrary code via crafted ALZ, UUE, or XXE archives.

A vulnerability in Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties, leading to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS). This is a different vulnerability than CVE-2005-2118.

The LPD service in HP-UX 10.20, 11.11 (11i) and earlier contains a vulnerability that allows a remote attacker to execute arbitrary code by sending a request containing shell metacharacters ("`" or single backquote). The flaw occurs when an error is not properly handled, for example after a connection is terminated.

The vulnerability in DiskMountNotify for Symantec Norton AntiVirus 9.0.3 is due to an untrusted search path. A local user can gain elevated privileges by modifying the PATH to point to a malicious ps or grep file.

Stack-based buffer overflow in help.cgi in the HTTP administrative interface of Sun Java System Directory Server, Red Hat Directory Server, Certificate Server, Sun ONE Directory Server, and Sun ONE Administration Server. Remote attackers can cause a denial of service (admin server crash), and local users can gain root privileges.

The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges.

Buffer overflow vulnerability in the unicode_to_bytes function in the Service Location Protocol (srvloc) dissector in Ethereal. A remote attacker can send a crafted srvloc packet with a modified length value, leading to arbitrary code execution.

A heap-based buffer overflow in the KWord RTF importer for KOffice versions 1.2.0 through 1.4.1 allows remote attackers to execute arbitrary code via a crafted RTF file.

A stack-based buffer overflow in UNACEV2.DLL for RARLAB WinRAR versions 2.90 through 3.50 allows remote attackers to execute arbitrary code via an ACE archive containing a file with a long name.

Multiple SQL injection vulnerabilities in versatileBulletinBoard (vBB) 1.0.0 RC2 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the login field, search this thread feature, search for posts feature, forgot password feature, list parameter in userlistpre.php, and the select, categ, and to parameters in index.php.

A format string vulnerability in WinRAR versions 2.90 through 3.50 allows remote attackers to execute arbitrary code via a crafted UUE/XXE file. The flaw occurs when WinRAR displays diagnostic errors related to an invalid filename.

Buffer overflow in the HTTP management interface for GFI MailSecurity 8.1 allows remote attackers to execute arbitrary code via long headers such as Host and Accept in HTTP requests. The vendor suggests that this issue may be in an underlying Microsoft technology, which could mean the overflow affects other products as well.