CVE Vulnerability Catalog

Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter.

CVS server version 1.10.8 does not properly restrict users from creating arbitrary Checkin.prog or Update.prog programs. This allows remote CVS committers to modify or create Trojan horse programs with the Checkin.prog or Update.prog names, then perform a CVS commit action.

Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension.

Zope before 2.2.1 does not properly restrict access to the getRoles method, allowing users who can edit DTML to add or modify roles by modifying the roles list included in a request.

Account Manager LITE does not properly authenticate attempts to change the administrator password, allowing remote attackers to gain privileges for the Account Manager by directly calling the amadmin.pl script with the setpasswd parameter.

Subscribe Me LITE does not properly authenticate attempts to change the administrator password, allowing remote attackers to gain privileges for the Account Manager by directly calling the subscribe.pl script with the setpwd parameter.

Buffer overflow in lpstat in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long -n option.

BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.

Buffer overflows in brouted in FreeBSD and possibly other OSes allows local users to gain root privileges via long command line arguments.

Buffer overflows in the Raptor GFX configuration tool (pgxconfig) allow local users to gain elevated privileges via command line options.

O'Reilly WebSite Pro 2.3.7 installs the uploader.exe program with execute permissions for all users, allowing remote attackers to create and execute arbitrary files by directly calling uploader.exe.

The sshd program in the Rapidstream 2.1 Beta VPN appliance has a hard-coded 'rsadmin' account with a null password, allowing remote attackers to execute arbitrary commands via ssh.

The URLConnection function in MacOS Runtime Java (MRJ) 2.1 and earlier and the Microsoft virtual machine (VM) for MacOS allows a malicious web site operator to connect to arbitrary hosts using HTTP redirection, violating the Java security model.

CVE-2000-0699 describes a format string vulnerability in ftpd on HP-UX 10.20 that allows remote attackers to cause a denial of service or execute arbitrary commands via format strings in the PASS command.

The Gnome Lokkit firewall package before version 0.41 does not properly restrict access to some ports, even if a user does not make any services available.

The xpdf PDF viewer client earlier than 0.91 allows local users to overwrite arbitrary files via a symlink attack.

The logrotate script for OpenLDAP before version 1.2.11 in Conectiva Linux sends an improper signal to the kernel log daemon (klogd), causing it to terminate.

The admin.php3 file in PHP-Nuke does not properly verify the administrator password, allowing remote attackers to gain privileges by requesting a URL that does not specify the aid or pwd parameters.

The telnetd telnet server in IRIX versions 5.2 through 6.1 does not properly clean user-injected format strings, allowing remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.

The xpdf PDF viewer client earlier than version 0.91 does not properly launch a web browser for embedded URLs, allowing an attacker to execute arbitrary commands via a URL containing shell metacharacters.