CVE Vulnerability Catalog

The CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.

The CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, potentially gaining privileges. This issue occurs in the AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.

Pingtel xpressa SIP-based VoIP phones versions 1.2.5 through 1.2.7.4 do not time out inactive administrator sessions, which could allow other users to perform administrator actions if the administrator does not explicitly end the session.

The web interface for Pingtel xpressa SIP-based VoIP phone versions 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, allowing remote attackers to steal and easily decode passwords via sniffing.

An off-by-one buffer overflow in the ssl_compat_directive function allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries. This issue affects mod_ssl version 2.8.9 and earlier.

InterScan VirusWall 3.52 build 1462 allows remote attackers to bypass virus protection via e-mail messages with headers that violate RFC specifications by having (or missing) space characters in unexpected places.

SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server.

Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL.

An undocumented SNMP read/write community string ('NoGaH$@!') in Avaya P330, P130, and M770-ATM Cajun products allows remote attackers to gain administrative privileges.

PHPGroupware version 0.9.12 and earlier, when running with the magic_quotes_gpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack.

xfsmd for IRIX 6.5 through 6.5.16 allows remote attackers to execute arbitrary code via shell metacharacters that are not properly filtered from several calls to the popen() function, such as export_fs().

Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges.

Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, may allow rexec or rsh to run another user's shell, or atrun to change to a different user's directory. This issue may be due to memory allocation failures or an incorrect call to auth_approval().

Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter.

Anthill allows remote attackers to bypass authentication and file bug reports by directly accessing the postbug.php program instead of enterbug.php.

OpenBSD versions 2.9 and 3.0 have a vulnerability in the mail program that processes the tilde (~) escape character in a message even when not in interactive mode. This could allow local users to gain root privileges via calls to mail in cron.

Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via long authentication data.

Oracle9i database server version 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax.

xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, allowing remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems.

Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions.