CVE Vulnerability Catalog

Buffer overflow in ISMail 1.4.3 and earlier allows remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) RCPT TO fields.

In the default configuration of Majordomo 2.0 through 1.94.4, the which_access variable is set to 'open', allowing remote attackers to identify the email addresses of mailing list members via a 'which' command.

Bastille B.02.00.00 on HP-UX 11.00 and 11.11 improperly configures the (1) NOVRFY and (2) NOEXPN options in the sendmail.cf file, which could allow remote attackers to verify the existence of system users and expand defined sendmail aliases.

Buffer overflow in the stmkfont utility of HP-UX from version 10.0 to 11.22 allows local users to gain privileges via a long command line argument.

rs.F300 for HP-UX versions 10.0 through 11.22 uses the PATH environment variable to find and execute programs like rm while operating at raised privileges. This allows local users to gain elevated privileges by modifying the path to point to a malicious rm program.

Trend Micro ScanMail for Exchange (SMEX) versions before 3.81 and 6.1 may install a back door account in smg_Smxcfg30.exe, allowing remote attackers to access the web management interface via the vcc parameter.

A stack-based buffer overflow in eZnet.exe can be exploited by remote attackers to cause a denial of service (crash) or execute arbitrary code. The attack can be carried out via a long GET request or long operation or autologin parameters to SwEzModule.dll.

ProxyView has a default administrator password of 'Administrator' for Embedded Windows NT, which allows remote attackers to gain access.

Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program.

Buffer overflow in cmd.exe in Windows NT 4.0 may allow local users to execute arbitrary code via a long pathname argument to the cd command.

CVE-2003-1170 describes a format string vulnerability in main.cpp in versions 0.9.1 and 0.9.5pre2 of kpopup. This allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via format string specifiers in command line arguments.

Multiple PHP remote file inclusion vulnerabilities in Advanced Poll 2.0.2 allow remote attackers to execute arbitrary PHP code via the include_path parameter in several files.

Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke versions 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to the getit function or the (2) min parameter to the search function.

The scripts menu.inc.php, datasets.php, and mass_operations.inc.php in N/X 2002 allow remote attackers to execute arbitrary PHP code via a c_path that references a URL on a remote web server containing the code.

Multiple format string vulnerabilities in the logger function in netzio.c for Tanne 0.6.17 allow remote attackers to execute arbitrary code via format string specifiers in syslog.

In Mambo 4.0.12, the index2.php file allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie.

Buffer overflow in Avant Browser 8.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.

A stack-based buffer overflow in the reply_nttrans function in Samba 2.2.7a and earlier allows remote attackers to execute arbitrary code via a crafted request.

Buffer overflow in the setupterm function of the lanadmin and landiag programs in HP-UX 10.0 through 10.34 allows local users to execute arbitrary code via a long TERM environment variable.

Multiple buffer overflows in H-Sphere WebShell 2.3 allow remote attackers to execute arbitrary code via (1) a long URL content type in CGI::readFile, (2) a long path in diskusage, and (3) a long fname in flist.