CVE Vulnerability Catalog

Vulnerability in HelpViewer on Mac OS X 10.3.3 and 10.2.8 allows arbitrary code execution by processing scripts that were not initiated by the user. The issue was originally reported as a directory traversal vulnerability in Safari using the runscript parameter in a help: URI handler.

Vulnerability in BEA WebLogic Server and WebLogic Express versions 7.0 through SP5 and 8.1 through SP2. When editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, if the weblogic.xml does not have a principal-name tag, the security-role-assignment tags are inadvertently removed. This can remove intended access restrictions for the associated web application.

Buffer overflow vulnerability in the ISAKMP functionality of Check Point VPN-1 and FireWall-1 NG products prior to versions R55 HFA-03, R54 HFA-410, NG FP3 HFA-325, and VPN-1 SecuRemote/SecureClient R56. A remote attacker can exploit this flaw to execute arbitrary code during VPN tunnel negotiation.

Multiple vulnerabilities in SYMDNS.SYS for Symantec Norton Internet Security and Professional 2002-2004, Norton Personal Firewall 2002-2004, Norton AntiSpam 2004, and Client Firewall and Client Security may allow remote attackers to cause a denial of service or execute arbitrary code.

The Windows Shell application in Windows 98, ME, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename.

Stack-based buffer overflow in the ssl_util_uuencode_binary function in Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.

Unknown vulnerability in Sun StorEdge Enterprise Storage Manager (ESM) 2.1 for Solaris 8 and Solaris 9 allows local users with the 'ESMUser' role to gain root access.

Buffer overflow in the zms script in ZoneMinder before version 1.19.2 may allow a remote attacker to execute arbitrary code via a long query string.

Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing '..' (dot dot) sequences and a filename that ends in '::' which is treated as a .chm file even if it does not have a .chm extension.

CVE-2004-0396 is a heap-based buffer overflow vulnerability in CVS versions 1.11.x up to 1.11.15 and 1.12.x up to 1.12.7 when using the pserver mechanism. It allows remote attackers to execute arbitrary code via Entry lines.

McAfee ePolicy Orchestrator versions 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allow remote attackers to execute arbitrary commands via certain HTTP POST requests to the spipe/file handler on TCP port 81.

Integer overflow in imapparse.c for Cyrus IMAP server versions 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value, leading to a buffer overflow attack.

CVE-2004-0385 involves a heap-based buffer overflow in the Web Cache listener of Oracle 9i Application Server, allowing remote attackers to execute arbitrary code via a long HTTP request method header.

There is a stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of Microsoft Windows, allowing remote attackers to execute arbitrary code.

Buffer overflow in Microsoft Jet Database Engine 4.0 allows remote attackers to execute arbitrary code via a specially-crafted database query.

The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, allowing remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.

The Virtual DOS Machine (VDM) subsystem component in Windows NT 4.0 and Windows 2000 does not properly validate system structures, allowing local users to access protected kernel memory and execute arbitrary code.

An unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code.

Cisco Wireless LAN Solution Engine (WLSE) versions 2.0 through 2.5 and Hosting Solution Engine (HSE) versions 1.7 through 1.7.3 have a hardcoded username and password. This allows remote attackers to add new users, modify existing users, and change configuration.

The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.