CVE Vulnerability Catalog

The installation of Apple QuickTime / Darwin Streaming Server before version 4.1.3f starts the administration server with a 'Setup Assistant' page that allows remote attackers to set the administrator password and gain privileges before the real administrator.

CVE-2003-0672 describes a format string vulnerability in pam-pgsql version 0.5.2 and earlier that allows remote attackers to execute arbitrary code via the username provided during authentication. The username is not properly handled when logging messages.

Up2date versions 3.0.7 and 3.1.23 do not properly verify RPM GPG signatures, which could allow remote attackers to install unsigned packages from the Red Hat Network if that network is compromised.

Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks the memory in the server's response.

BEA WebLogic Server and Express, when using NodeManager to start servers, allow Operator users to overwrite usernames and passwords, which may enable Operators to gain Admin privileges.

Internet Explorer versions 5.01 SP3 through 6.0 SP1 improperly determine object types returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter pointing to a malicious file.

Buffer overflow in the BR549.DLL ActiveX control for Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to execute arbitrary code.

The EXTPROC functionality in Oracle9i Database and Oracle 8i has a stack-based buffer overflow that can be exploited by authenticated database users to execute arbitrary code via a long library name.

Apple QuickTime / Darwin Streaming Server before version 4.1.3g is vulnerable to an attack that can lead to service crashes. Attackers can exploit a .. (dot dot) sequence followed by an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220.

Multiple buffer overflows in Novell iChain 2.1 before Field Patch 3 and iChain 2.2 before Field Patch 1a allow attackers to cause a denial of service (ABEND) and possibly execute arbitrary code via (1) a long user name or (2) an unknown attack related to a "special script against login."

A stack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable.

Multiple buffer overflows in ActiveX controls used by Trend Micro HouseCall 5.5 and 5.7, and Damage Cleanup Server 1.0 allow remote attackers to execute arbitrary code via long parameter strings.

Multiple SQL injection vulnerabilities in the infolog module for phpgroupware 0.9.14 and earlier could allow remote attackers to conduct unauthorized database actions.

A vulnerability in rscsi in cdrtools 2.01 and earlier allows local users to overwrite arbitrary files and gain root privileges by specifying the target file as a command line argument, which is modified while rscsi is running with privileges.

Buffer overflow in autorespond may allow remote attackers to execute arbitrary code as the autorespond user via qmail.

Buffer overflow in xpcd-svga for xpcd 2.08 and earlier allows local users to execute arbitrary code via a long HOME environment variable.

Patches for cachefs on Solaris 2.6 and 7 overwrite the inetd.conf file, which may silently reenable services and allow remote attackers to bypass the intended security policy.

The checklogin function in omail.pl for omail webmail version 0.98.4 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in (1) password, (2) domain name, or (3) username.

SQL injection vulnerability in shopexd.asp for VP-ASP allows remote attackers to gain administrator privileges via the id parameter.

mpg123 version 0.59r allows remote attackers to cause a denial of service and possibly execute arbitrary code via an MP3 file with a zero bitrate, leading to a negative frame size.