CVE Vulnerability Catalog

NetWin SurgeFTP 2.0f and earlier uses weak password hashing with a fixed salt value and modulo 40 calculations, allowing remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.

A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264 does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.

Zetetic Secure Tool for Recalling Important Passwords (STRIP) version 0.5 and earlier for PalmOS allows a local attacker to recover passwords via a brute force attack. This is made feasible by STRIP's use of SysRandom, seeded by TimeGetTicks, and an implementation flaw that significantly reduces the password search space.

The Orinoco RG-1000 wireless Residential Gateway uses the last 5 digits of the 'Network Name' (SSID) as the default WEP encryption key. This allows a remote attacker to determine the WEP key and decrypt RG-1000 traffic.

The Lucent Closed Network protocol can allow remote attackers to join Closed Network networks which they do not have access to. The 'Network Name' or SSID, which is used as a shared secret to join the network, is transmitted in the clear.

Sdbsearch.cgi in SuSE Linux versions 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file containing filenames with shell metacharacters. Attackers can exploit the HTTP_REFERER variable to point to the directory containing the keylist.txt file.

Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript via a GIF image whose comment contains the Javascript.

In prefs.php of phpBB version 1.4.0 and earlier, remote authenticated users can execute arbitrary PHP code via an invalid language value. This causes the variables $l_statsblock in prefs.php or $l_privnotify in auth.php to be improperly initialized.

phpMyAdmin versions 2.2.0rc3 and earlier allow remote attackers to execute arbitrary commands by injecting them into the strCopyTableOK argument in tbl_copy.php or the strRenameTableOK argument in tbl_rename.php.

The ip_masq_irc module version 2.2 allows remote attackers to bypass intended firewall restrictions by sending a 'DCC SEND' request to a malicious server listening on port 6667.

CGI scripts such as login.gas.bat in Entrust getAccess allow remote attackers to execute Java programs and possibly arbitrary commands by specifying an alternate -classpath argument.

Vulnerability in MasqMail before version 0.1.15 allows local users to gain privileges via piped aliases.

Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to various FTP commands. This vulnerability can be exploited through commands such as DELE, MDTM, and others.

CVE-2001-1022 describes a format string vulnerability in the pic utility in groff 1.16.1 and other versions, and jgroff before 1.15. This allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command.

Directory traversal vulnerability in SnapStream PVS 1.2a allows remote attackers to read arbitrary files via a .. (dot dot) attack in the requested URL.

SonicWALL SOHO uses easily predictable TCP sequence numbers, allowing remote attackers to spoof or hijack sessions.

Mambo Site Server versions 3.0.0 through 3.0.5 have a vulnerability that allows remote attackers to gain Mambo administrator privileges by setting the PHPSESSID parameter and providing the appropriate administrator information in other parameters.

The default configuration of Sambar Server 5 and earlier uses a symmetric key compiled into the binary program for encrypting passwords, which could allow local users to break all user passwords by cracking the key or modifying a copy of the sambar program to call the decryption procedure.

Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other clients via an incorrect URL containing the malicious script, which is printed back in an error message.

Arkeia backup server version 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwrite the files or obtain sensitive information.