CVE Vulnerability Catalog

Buffer overflow in the Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request passed to the extension through IIS 5.0.

INDEXU 2.0 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the cookie_admin_authenticated cookie value to 1.

Cisco Aironet 340 Series wireless bridge before version 8.55 does not properly disable access to the web interface, allowing remote attackers to modify its configuration.

A format string vulnerability in Mutt before 1.2.5 allows a remote malicious IMAP server to execute arbitrary commands.

Buffer overflow in uucp utilities in UnixWare 7 allows local users to execute arbitrary code via long command line arguments.

The vulnerability in saposcol in SAP R/3 Web Application Server Demo before version 1.5 relies on the PATH environmental variable to find and execute the expand program. This allows local users to gain root access by modifying the PATH to point to a malicious expand program.

Buffer overflow in IPSwitch IMail SMTP server 6.06 and possibly prior versions allows remote attackers to execute arbitrary code via a long From: header.

The vulnerability in template.cgi in Free On-Line Dictionary of Computing (FOLDOC) allows remote attackers to read files and execute commands via shell metacharacters in the arguments passed to template.cgi.

Unknown vulnerability in netprint in IRIX 6.2, and possibly other versions, allows local users with lp privileges to execute arbitrary commands via the -n option.

Buffer overflow in the wrapping and unwrapping functions of the slrn news reader before version 0.9.7.0 allows remote attackers to execute arbitrary commands via a long message header.

CVE-2001-0359 describes a format string vulnerability in Sierra Half-Life build 1573 and earlier that allows a remote attacker to execute arbitrary code via the map command.

CVE-2001-1162 describes a directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before version 2.2.0a. This allows remote attackers to overwrite certain files by using '..' in a NETBIOS name, which is used as the name for a .log file.

Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code.

CVE-2001-1078 describes a format string vulnerability in the flog function of eXtremail version 1.1.9 and earlier, allowing remote attackers to gain root privileges via format specifiers in SMTP and POP3 commands.

CVE-2001-1080 affects AIX 4.3.x and 5.1 systems, where the diagrpt program uses the DIAGDATADIR environment variable to locate and execute certain programs. This allows local users to gain privileges by modifying the variable to point to a Trojan horse program.

OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, allowing local users to bypass resource limits (rlimits) set in pam.d.

The vulnerability in Computer Associates CCC\Harvest 5.0 for Windows NT/2000 is due to the use of weak password encryption. A remote attacker can exploit this weakness to gain unauthorized privileges in the application.

Buffer overflows in BSD-based FTP servers allow remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence. This affects the functions g_opendir, g_lstat, g_stat, and the glob0 buffer used in glob functions glob2 and glob3.

Gene6 G6 FTP Server version 2.0 (also known as BPFTP Server 2.10) allows attackers to read file attributes outside of the web root via the SIZE and MDTM commands when the 'show relative paths' option is not enabled.

Buffer overflow in ntpd ntp daemon (version 4.0.99k and earlier) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.