CVE Vulnerability Catalog

The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, allowing remote attackers to execute arbitrary code via a buffer overflow attack.

A stack-based buffer overflow in webfs before version 1.20 allows attackers to execute arbitrary code by creating directories that result in a long pathname.

Integer overflows in PHP versions before 4.3.3 in base64_encode and the GD library have unknown impact and attack vectors.

CVE-2003-0865 involves a heap-based buffer overflow in the readstring function of httpget.c for mpg123 versions 0.59r and 0.59s. This allows remote attackers to execute arbitrary code via a long request.

Versions gv 3.5.8 and possibly earlier allow remote attackers to execute arbitrary commands via shell metacharacters in the filename for (1) a PDF file or (2) a gzip file.

CVE-2001-1411 describes a format string vulnerability in gm4 (also known as m4) on Mac OS X that may allow local users to gain privileges if gm4 is called by setuid programs.

In OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, the PAM authentication mechanism in SSH1 does not check the result of the authentication attempt, which may allow remote attackers to gain privileges.

The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange 2000.

A stack-based buffer overflow in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.

The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval.

Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long LB_DIR messages to ListBox or CB_DIR messages to ComboBox controls in a privileged application.

The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, allowing attackers to modify the stack and possibly gain privileges.

Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allow remote attackers to execute arbitrary code via an ASX header with a long hostname.

Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.

Buffer overflow in the log viewing interface in Perception LiteServe versions 1.25 through 2.2 allows remote attackers to execute arbitrary code via a GET request with a long file name.

mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.

Multiple SQL injection vulnerabilities in the Portal DB components, including List of Values, Forms, Hierarchy, and XML components in Oracle9i Application Server allow remote attackers to execute arbitrary SQL commands via the URL.

Mail in Mac OS X before version 10.3, when configured to use MD5 Challenge Response, uses plaintext authentication if the CRAM-MD5 hashed login fails. This could allow remote attackers to sniff passwords.

An unknown vulnerability in QuickTime Java in Mac OS X v10.3 and Mac OS X Server 10.3 allows attackers to gain unauthorized access to a system.

IA WebMail Server 3.1.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long GET request.