CVE Vulnerability Catalog

In Microsoft Windows 2000 running in a domain whose Fully Qualified Domain Name (FQDN) is exactly 8 characters long, users with expired passwords can log on to the domain.

Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.

Vulnerability in Mozilla Suite before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allows remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.

Vulnerability in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL.

The vulnerability in eupdatedb in esearch 0.6.1 and earlier allows local users to create arbitrary files via a symlink attack on the esearchdb.py.tmp temporary file.

The syssgi SGI_IOPROBE system call in IRIX 6.5.20 through 6.5.24 allows local users to gain privileges by reading and writing to kernel memory.

The jail system call in FreeBSD 4.x before 4.10-RELEASE does not verify that an attempt to manipulate routing tables originated from a non-jailed process, which could allow local users to modify the routing table.

Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report.

LVM for AIX 5.1 and 5.2 allows local users to overwrite arbitrary files via a symlink attack.

A stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0 allows local or remote attackers to execute arbitrary code via a .job file containing long parameters.

Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite versions 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.

Directory traversal vulnerability in Fastream NETFile FTP/Web Server 6.7.2.1085 and earlier allows remote attackers to create or delete arbitrary files via .. (dot dot) and // (double slash) sequences in the filename parameter.

A buffer overflow vulnerability in the ntlm_check_auth (NTLM authentication) function of Squid Web Proxy Cache versions 2.5.x and 3.x, compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10 allows remote attackers to read and delete arbitrary files via '..' sequences in the dynamicimag argument to crystalimagehandler.aspx.

A vulnerability in LaunchServices on Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications, which could allow attackers to execute arbitrary code without warning the user.

The WebBrowser ActiveX control or the MSHTML rendering engine in Internet Explorer 6 allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute JavaScript, as demonstrated via delayed HTTP redirects with a Location header containing a "URL:" prefix before a "ms-its" protocol URI, or by modifying the window's location attribute.

Buffer overflow vulnerability in the TranslateFilename function in common.c in MPlayer 1.0pre4 allows remote attackers to execute arbitrary code via a long file name.

CVS versions 1.12.x through 1.12.8 and 1.11.x through 1.11.16 do not properly handle malformed 'Entry' lines. This may lead to a NULL terminator not being used, resulting in a denial of service (crash), modification of critical program data, or arbitrary code execution.

The PHP package in Slackware 8.1, 9.0, and 9.1, when linked against a static library, includes /tmp in the search path, which allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path.

CVS versions from 1.11.x to 1.11.16 and from 1.12.x to 1.12.8 improperly handle empty data lines, which may allow remote attackers to perform an out-of-bounds write. This can lead to arbitrary code execution or modification of critical program data.