CVE Vulnerability Catalog

SQL injection vulnerability in pass_done.php for PY-Membres 4.2 and earlier allows remote attackers to execute arbitrary SQL queries via the email parameter.

CVE-2003-0784 describes a format string vulnerability in tsm for the bos.rte.security fileset on AIX 5.2, allowing remote attackers to gain root privileges and local users to gain privileges via login, su, or passwd using a username containing format string specifiers.

ipmasq versions before 3.5.12, in certain configurations, may forward packets to the external interface even if the packets are not associated with an established connection.

The lsh daemon (lshd) improperly returns from certain functions in read_line.c, channel_commands.c, and client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.

An unknown vulnerability in NFS for SGI IRIX 6.5.21 and earlier may allow an NFS client to bypass read-only restrictions.

Buffer overflow in db2dart in IBM DB2 Universal Data Base 7.2 before Fixpak 10 allows local users to gain root privileges via a long command line argument.

KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules.

Buffer overflow in db2licm in IBM DB2 Universal Data Base 7.2 before Fixpak 10a allows local users to gain root privileges via a long command line argument.

There is a potential buffer overflow in ruleset parsing for Sendmail 8.12.9 when using nonstandard rulesets such as recipient, final, or mailer-specific envelope recipients. The consequences of this issue are unknown.

Nokia Electronic Documentation (NED) version 5.0 allows remote attackers to use NED as an open HTTP proxy via a URL in the location parameter, which NED accesses and returns to the user.

CVE-2003-0697 describes a format string vulnerability in lpd in the bos.rte.printers fileset for AIX versions 4.3 through 5.2 with debug enabled. This allows local users to cause a denial of service (crash) or gain root privileges.

The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.

Multiple buffer overflows in UMN gopher daemon (gopherd) 2.x and 3.x before 3.0.6 allow attackers to execute arbitrary code via (1) a long filename as a result of a LIST command, and (2) the GSisText function, which calculates the view-type.

Multiple buffer management errors in OpenSSH before version 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code. These issues involve the buffer_init and buffer_free functions in buffer.c and a separate function in channels.c.

KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy. This allows attackers to guess session cookies via brute force methods and gain access to the user session.

Memory bugs in OpenSSH 3.7.1 and earlier have an unknown impact. These vulnerabilities are different from those described in CVE-2003-0693 and CVE-2003-0695.

Multiple buffer overflows in hztty 2.0 allow local users to gain root privileges.

SCO Internet Manager (mana) allows local users to execute arbitrary programs by setting the REMOTE_ADDR environment variable, causing menu.mana to run as if called from ncsa_httpd. Users can then modify the PATH environment variable to point to a malicious 'hostname' program.

The FUNC.pm file in IkonBoard 3.1.2a and earlier versions, including 3.1.1, does not properly cleanse the 'lang' cookie when it contains illegal characters. This allows remote attackers to execute arbitrary code when the cookie is inserted into a Perl 'eval' statement.

A buffer management error in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap.