CVE Vulnerability Catalog

Transsoft Broker version 5.9.5.0 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.

WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a '.lnk.' extension, which bypasses WFTPD's check for a '.lnk' extension.

ArGoSoft FTP Server version 1.2.2.2 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.

PHP versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse the 5th parameter to the mail() function, allowing local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.

Buffer overflow in the SNMP proxy agent snmpd in Solaris 8 may allow local users to gain root privileges by calling snmpd with a long program name.

The index.php file in Jelsoft vBulletin improperly initializes a PHP variable used to store template information. This allows remote attackers to execute arbitrary PHP code via special characters in the templatecache parameter.

SSH daemon version 1 (SSH-1) 1.2.30 and earlier does not log repeated login attempts, which could allow remote attackers to compromise accounts without detection via a brute force attack.

A directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.

CVE-2001-0489 describes a format string vulnerability in gftp prior to version 2.0.8 that allows malicious remote FTP servers to execute arbitrary commands.

A directory traversal vulnerability in phpPgAdmin 2.2.1 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.

Multiple buffer overflows in the s.cgi program in Aspseek search engine version 1.03 and earlier allow remote attackers to execute arbitrary commands via (1) a long HTTP query string, or (2) a long tmpl parameter.

Bugzilla 2.10 allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for the globals.pl file, which is normally returned by the web server without being executed.

Eudora before 5.1 allows a remote attacker to execute arbitrary code when the 'Use Microsoft Viewer' and 'allow executables in HTML content' options are enabled, via an HTML email message containing Javascript, with ActiveX controls and malicious code within IMG tags.

Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.

Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks.

Buffer overflow in the Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request passed to the extension through IIS 5.0.

Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the '.ASX Buffer Overrun' vulnerability.

Buffer overflow in Microsoft Index Server 2.0 allows remote attackers to execute arbitrary commands via a long search parameter.

The time server daemon 'timed' allows remote attackers to cause a denial of service by sending malformed packets.

Buffer overflow in Mercury MTA POP3 server for NetWare 1.48 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long APOP command.