CVE Vulnerability Catalog

The RSH service in Windows NT 3.5 through 4.0 improperly restricts access as specified in the .Rhosts file, potentially allowing unauthorized users to access the service from an authorized host.

The Web Cache Control Protocol (WCCP) in Cisco Cache Engine for Cisco IOS 11.2 and earlier does not use authentication, allowing remote attackers to redirect HTTP traffic to arbitrary hosts via WCCP packets sent to UDP port 2048.

Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabled.

Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.

Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable.

Buffer overflow in Internet Explorer 4.01 and earlier allows remote attackers to execute arbitrary commands via a long URL with the 'mk:' protocol.

Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, allowing remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data.

Unspecified vulnerability in crontab in IBM AIX 3.2 allows local users to gain root privileges via unknown attack vectors.

Passfilt.dll in Windows NT SP2 allows users to create a password that contains the user's name, which could make it easier for an attacker to guess.

The BMC Patrol component, when installed with Compaq Insight Management Agent 4.23 and earlier, or Management Agents for Servers 4.40 and earlier, creates a PFCUser account with a default password and potentially dangerous privileges.

Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, known as the Excel 'CALL Vulnerability.'

The automatic download option in the ncftp 2.4.2 FTP client on Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files to be downloaded.

The Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure default permissions.

When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies.

The soundplayer program in IRIX allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program.

The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.

SAS System 5.18 on VAX/VMS has insecure permissions for its directories and startup file, allowing local users to gain elevated privileges.

Multiple unspecified vulnerabilities in sendmail 5, as installed on Sun SunOS 4.1.3_U1 and 4.1.4, have unspecified attack vectors and impact.

Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes, does not require authentication credentials under certain conditions, allowing remote attackers to bypass authentication requirements.

PowerPoint 95 and 97 allows remote attackers to cause an application to be run automatically without prompting the user, possibly through the slide show, when the document is opened in browsers such as Internet Explorer.