CVE Vulnerability Catalog

Untrusted execution path vulnerability in chcod on AIX IBM 5.1.0, 5.2.0, and 5.3.0 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious 'grep' program, which is executed from chcod.

Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment variable to point to a malicious 'uname' program, which is executed from lsvpd after lsvpd has been invoked by invscout.

The init scripts in Great Internet Mersenne Prime Search (GIMPS) 23.9 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.

The vulnerability in Cisco Secure Access Control Server for Windows and Solution Engine version 3.3.1, when EAP-TLS protocol is enabled, improperly handles expired or untrusted certificates. This allows a remote attacker to bypass authentication and gain unauthorized access using a cryptographically correct certificate with valid fields such as the username.

Multiple buffer overflows in ProZilla 1.3.6-r2 and earlier in files http.c, http-retr.c, main.c and other network protocol handling code allow remote servers to execute arbitrary code via a long Location header.

Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function, which decrements a counter to -1, or (2) the igmp_marksources function, which does not properly validate IGMP message parameters and performs an out-of-bounds read.

Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.

Buffer overflow in the auto_filter_extern function in auto.c for NapShare 1.2, with the extern filter enabled, allows remote attackers to execute arbitrary code via a crafted gnutella response.

An integer overflow in libtiff versions 3.5.7 and 3.7.0 in tif_dirread.c and tif_fax3.c allows remote attackers to execute arbitrary code via a crafted TIFF file with a TIFF_ASCII or TIFF_UNDEFINED directory entry having an entry count of -1, leading to a heap-based buffer overflow.

A vulnerability in Safari 1.x allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability, a different vulnerability than CVE-2004-1122.

Buffer overflow vulnerability in the put_words function in subs.c of abcm2ps version 3.7.20. A remote attacker can execute arbitrary code via crafted ABC files.

A buffer overflow in the Mesh::type method in mesh.c of the mview program in Mesh Viewer 0.2.2 allows remote attackers to execute arbitrary code via crafted mesh files.

Buffer overflow vulnerability in the error function in preproc.c in NASM 0.98.38 1.2 allows attackers to execute arbitrary code via a crafted asm file. This is a different vulnerability than CVE-2005-1194.

Stack-based buffer overflow in the ELF header parsing code in file before 4.12 allows attackers to execute arbitrary code via a crafted ELF file.

The Smc.exe process in My Firewall Plus 5.0 build 1117 (and possibly other versions) does not drop privileges before invoking help, allowing local users to gain privileges.

Vulnerability in Konqueror 3.x up to version 3.2.2-6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability.

The vulnerability in Netscape 7.x up to version 7.2 allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability.

A buffer overflow vulnerability in the get_file_list_stdin function in jpegtoavi 1.5 allows remote attackers to execute arbitrary code via a crafted set of JPEG files and filenames.

Multiple buffer overflows in the preparse function in asp2php 0.76.23 allow remote attackers to execute arbitrary code via crafted ASP scripts.

SQL injection vulnerability in SugarCRM Sugar Sales before version 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the 'record' parameter in a DetailView action to index.php, and record parameters in other functionality.