CVE Vulnerability Catalog

IIS versions 4.0 and 5.0 have an issue with session cookies being sent identically for both secure and insecure web sessions. This could allow remote attackers to hijack a user's secure session if that user switches to an insecure session.

CVE-2000-0950 describes a format string vulnerability in x-gw in TIS Firewall Toolkit (FWTK) that allows local users to execute arbitrary commands via a malformed display name.

CVE-2000-0997 describes format string vulnerabilities in the eeprom program in OpenBSD, NetBSD, and possibly other operating systems, allowing local attackers to gain root privileges.

Avirt Mail versions 4.0 and 4.2 are vulnerable to a denial of service attack that may also allow remote execution of arbitrary commands via long 'RCPT TO' or 'MAIL FROM' commands.

GNU Groff uses the current working directory to find a device description file, allowing a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff.

Buffer overflow in bftp daemon (bftpd) version 1.0.11 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER command.

Glint in Red Hat Linux 5.2 allows local users to overwrite arbitrary files and cause a denial of service via a symlink attack.

Directory traversal vulnerability in the ssi CGI program in thttpd 2.19 and earlier allows remote attackers to read arbitrary files via a "%2e%2e" string, a variation of the .. (dot dot) attack.

The Samba Web Administration Tool (SWAT) in version 2.0.7 allows local users to overwrite arbitrary files via a symlink attack on the cgi.log file.

EServ 2.92 Build 2982 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long HELO and MAIL FROM commands.

The default installation for the Oracle listener program in versions 7.3.4, 8.0.6, and 8.1.6 allows an attacker to append logging information to arbitrary files and execute commands via the SET TRC_FILE or SET LOG_FILE commands.

Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the 'whois' parameter.

Buffer overflow in the HTTP protocol parser for Microsoft Network Monitor (Netmon) allows remote attackers to execute arbitrary commands via malformed data.

Auction Weaver versions 1.0 through 1.04 do not properly validate form field names, allowing remote attackers to delete arbitrary files and directories via a .. (dot dot) attack.

Buffer overflow in Half Life dedicated server before build 3104 allows remote attackers to execute arbitrary commands via a long rcon command.

IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands. This is known as the 'Web Server File Request Parsing' vulnerability.

Buffer overflows in Microsoft Network Monitor (Netmon) allow remote attackers to execute arbitrary commands via a long Browser Name in a CIFS Browse Frame, a long SNMP community name, or a long username or filename in an SMB session.

The Samba Web Administration Tool (SWAT) in version 2.0.7 does not log login attempts where the username is correct but the password is wrong, allowing remote attackers to conduct brute force password guessing attacks.

Buffer overflow in the IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command.

GnoRPM before 0.95 allows local users to modify arbitrary files via a symlink attack.