CVE Vulnerability Catalog

Cisco VPN 3000 Concentrator version 3.6(Rel) and earlier, as well as 2.x.x, allows remote VPN clients to log in using PPTP or IPSEC user authentication when configured to use internal authentication with group accounts and without any user accounts.

Buffer overflow in SmartMax MailMax POP3 daemon (popmax) 4.8 allows remote attackers to execute arbitrary code via a long USER command.

Cisco VPN 3000 Concentrator versions 2.2.x and 3.x before 3.5.1 allows restricted administrators to access user passwords stored in plaintext in HTML source code.

The BadBlue server stores passwords in plaintext in the ext.ini file, which could allow local and possibly remote attackers to gain privileges.

Buffer overflow in KeyFocus (KF) web server 1.0.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed HTTP header.

Multiple SQL injection vulnerabilities in ezContents 1.41 and earlier allow remote attackers to conduct unauthorized activities.

SunPCi II VNC uses a weak authentication scheme, allowing remote attackers to obtain the VNC password by sniffing the random byte challenge used as the key for encrypted communications.

Buffer overflow in the inc mail utility for Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long MH environment variable.

The config_inc2.php file in Mantis before version 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via specified parameters and cookies.

Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allow remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to account_update.php.

Cisco VPN 3000 Concentrator versions 2.2.x and 3.x before 3.5.2 allows restricted administrators to access certificate passwords stored in plaintext in the HTML source code for Certificate Management pages.

Buffer overflow in read_smtp_response of protocol.c in libesmtp before version 0.8.11 allows a remote SMTP server to (1) execute arbitrary code via a certain response or (2) cause a denial of service via long server responses.

Multiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary and other capabilities.

The Administration console for Abyss Web Server 1.0.3 before Patch 2 allows remote attackers to gain privileges and modify server configuration via direct requests to CHL files.

The PHPWiki Postnuke wiki module has a cross-site scripting vulnerability that allows remote attackers to execute scripts as other PHPWiki users via the pagename parameter.

Buffer overflow in Pegasus mail client 4.01 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long (1) To or (2) From headers.

Buffer overflow in the control service for MERCUR Mailserver 4.2 allows remote attackers to execute arbitrary code via a long password.

Jana Server version 1.4.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large message index value in RETR or DELE commands to the POP3 server, which exceeds array limits and allows a buffer overflow attack.

Multiple buffer overflows in Thomas Hauck's Jana Server versions 2.x through 2.2.1 and 1.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code.

Buffer overflow in Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Subject field.