CVE Vulnerability Catalog

Serv-U FTP Server allows remote attackers to bypass its anti-hammering feature by first logging on as a valid user (possibly anonymous) and then attempting to guess the passwords of other users.

eWave ServletExec 3.0C and earlier does not restrict access to the UploadServlet Java/JSP servlet, allowing remote attackers to upload files and execute arbitrary commands.

A format string vulnerability in the top program allows local attackers to gain root privileges via the 'kill' or 'renice' function.

Multiple buffer overflows in LBNL tcpdump allow remote attackers to execute arbitrary commands.

A vulnerability in Element InstantShop allows remote attackers to modify price information via the 'price' hidden form variable in add_2_basket.asp.

Buffer overflow in the host command allows a remote attacker to execute arbitrary commands via a long response to an AXFR query.

Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via long 'RCPT TO,' 'SAML FROM,' or 'SOML FROM' commands.

Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.

Buffer overflows in TYPSoft FTP Server 0.78 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER, PASS, or CWD command.

Check Point Firewall-1 versions 3.0 through 4.1 generate different error messages for invalid usernames and passwords, allowing remote attackers to determine valid usernames and guess passwords via brute force attacks.

A format string vulnerability in the logging function of ypbind 3.3, while running in debug mode, leaks file descriptors and allows an attacker to cause a denial of service.

The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, allowing remote attackers to execute restricted commands by sending a DATA command before sending the restricted commands.

Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL.

The default configuration of Slashcode before version 2.0 Alpha has a default administrative password, allowing remote attackers to gain Slashcode privileges and possibly execute arbitrary commands.

The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable.

Buffer overflow in the catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable.

CVE-2000-1010 describes a format string vulnerability in talkd in OpenBSD and possibly other BSD-based operating systems, allowing remote attackers to execute arbitrary commands via a user name containing format characters.

In Red Hat Linux 6.2, there is a vulnerability that relies on the pathname specified by the RSH environmental variable. This allows local users to gain root privileges by modifying the RSH variable to point to a Trojan horse program.

Format string vulnerabilities in the ssh program in OpenBSD (and possibly other BSD-based operating systems) allow attackers to gain root privileges.

CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to bypass LDAP authentication if the LDAP server allows null passwords.