CVE Vulnerability Catalog

A format string vulnerability in the test_func_func function in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the str variable.

Multiple buffer overflows in LCDProc 0.4.1 and possibly other 0.4.x versions up to 0.4.4 allow remote attackers to execute arbitrary code via (1) a long invalid command to parse_all_client_messages function, or (2) long argv command to test_func_func function.

A buffer overflow vulnerability in the parse_all_client_messages function in LCDproc versions 0.4.x through 0.4.4 allows remote attackers to execute arbitrary code by sending a large number of arguments.

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 and 10 allow remote attackers to inject arbitrary web script or HTML via parameters such as email, file, dns, account, db, login, or ip in URLs.

Synaesthesia 2.2 and earlier allows local users to execute arbitrary code via a symlink attack on the configuration file.

GTKSee versions 0.5 and 0.5.1 have a heap-based buffer overflow that allows remote attackers to execute arbitrary code via a PNG image of certain color depths.

mod_access in Apache 1.3 before 1.3.30, when running on big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.

Buffer overflow in cd9660.util in Apple Mac OS X versions 10.0 through 10.3.2 and Apple Mac OS X Server versions 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.

Apple Mac OS X versions 10.0 through 10.2.8 allow local users with a USB keyboard to gain unauthorized access. This can be achieved by holding down the CTRL and C keys during system boot, which crashes the init process and leaves the user in a root shell.

Workgroup Manager in Apple Mac OS X Server 10.2 through 10.2.6 does not disable a password for a new account before it is saved, allowing remote attackers to gain unauthorized access via the new account before it is saved.

Directory Services in Apple Mac OS X versions 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server versions 10.2 through 10.3.2 accept authentication server information from unknown LDAP or NetInfo sources, which can be exploited by a malicious DHCP server.

CVE-2003-1018 describes a format string vulnerability in the enq command in AIX 4.3, 5.1, and 5.2 that allows local users with rintq group privileges to gain additional privileges.

A stack-based buffer overflow in the OutputDebugString function for Adobe Acrobat Reader 5.1 allows remote attackers to execute arbitrary code via a PDF document with XML Forms Data Format (XFDF) data.

Unknown vulnerability in ftpd in IBM AIX 5.2, when configured to use Kerberos 5 for authentication, allows remote attackers to gain privileges via unknown attack vectors.

Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to steal users' passwords by manipulating parameters in various scripts.

An unknown vulnerability in rpc.mountd on SGI IRIX versions 6.5.18 through 6.5.22 allows remote attackers to mount from unprivileged ports even with the -n option disabled.

SQL injection vulnerability in Extreme Messageboard (XMB) 1.9 beta allows remote attackers to execute arbitrary SQL commands via the restrict parameter to member.php, misc.php, or today.php.

A stack-based buffer overflow in WinSig.exe in eSignal 7.5 and 7.6 allows remote attackers to execute arbitrary code via a long STREAMQUOTE tag.

The vulnerability in Dameware Mini Remote Control 4.1.0.0 is due to using insufficiently random data to generate the encryption key. This allows a remote attacker to guess the key via brute force and gain access to sensitive information.

Buffer overflow vulnerability in the logging function of Picophone 1.63 and earlier allows remote attackers to execute arbitrary code via a large packet.