CVE Vulnerability Catalog

Castelle FaxPress, possibly version 6.3 and others, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event.

Lucent VitalSuite versions 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allow remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.

Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a flood of large ICMP ping packets.

The web administration interface for NetGear RT314 and RT311 Gateway Routers has a cross-site scripting (XSS) vulnerability that allows remote attackers to execute arbitrary scripts on another client via a crafted URL.

Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) -hfn argument.

A cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.

Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir.

Lotus Domino server version 5.0.8 with NoBanner enabled allows remote attackers to determine the physical path of the server via a request for a nonexistent file with a .pl extension, leaking the pathname in the error message. Additionally, any request causing an HTTP 500 error leaks the server's version name in the HTTP error message.

CVE-2002-0246 describes a vulnerability in the message catalog library functions in UnixWare 7.1.1 that allows local users to gain privileges by modifying the LC_MESSAGE environment variable. This enables reading other message catalogs containing format strings from setuid programs such as vxprint.

The web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier allows unauthorized users to bypass authentication via a direct HTTP request to the web_access.html file, enabling the user to change the switch's configuration and modify the administrator password.

Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string of format string characters such as "%d".

The default configuration of Arescom NetDSL 800 does not require authentication, allowing remote attackers to cause a denial of service or reconfigure the router.

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields. These headers can cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message.

Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity.

Heap-based buffer overflow in the cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.

Vulnerability in the XFS filesystem reorganizer (fsr_xfs) in SGI IRIX 6.5.10 and earlier allows local users to gain root privileges by overwriting critical system files.

The pam_ldap PAM LDAP module before version 144 has a format string vulnerability in the logging function, allowing attackers to execute arbitrary code via format strings in the configuration file name.

NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.

Versions of wmtv 0.6.5 and earlier allow local users to modify arbitrary files via a symlink attack on a configuration file.

Buffer overflow in AOL Instant Messenger (AIM) 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711.