CVE Vulnerability Catalog

A stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier may occur in situations that cross security boundaries, such as an FTP server. This may allow remote attackers to execute arbitrary code via a long filename argument.

A vulnerability in Apple iChat AV 2.1, AV 2.0, and 1.0.1 allows remote attackers to execute arbitrary programs via a specially crafted link.

Vulnerability in Sendmail before version 8.12.3 on Debian GNU/Linux, when using sasl and sasl-bin, uses a configuration script with a fixed username and password, allowing remote attackers to use Sendmail as an open mail relay to send spam.

A format string vulnerability in the Speedtouch USB driver before version 1.3.1 allows local users to execute arbitrary code via modem_run, pppoa2, or pppoa3.

A vulnerability in distcc before version 2.16 on 64-bit platforms causes incorrect interpretation of IP-based access control rules. This allows remote attackers to bypass intended restrictions.

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from 'memory corruption') via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the '<STYLE>@;/*' string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the 'CSS Heap Memory Corruption Vulnerability.'

Multiple stack-based buffer overflows in Sybase Adaptive Server Enterprise (ASE) 12.x before 12.5.3 ESD#1 allow remote authenticated users to execute arbitrary code via the attrib_valid function, covert function, declare statement, crafted query plan, or crafted install java statement (requires database owner or 'sa' role privileges).

Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.

Buffer overflow in htget 0.93 allows remote attackers to execute arbitrary code via a crafted URL.

Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.

Untrusted execution path vulnerability in the diag commands (lsmcode, diag_exec, invscout, invscoutd) in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program.

Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges.

The vulnerability in Asante FM2008 running firmware 1.06 stores the username and password in cleartext in the configuration backup, which could allow remote attackers to gain unauthorized access.

The Asante FM2008 device running firmware version 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorized access.

The vulnerability in Cisco Unity versions 2.x, 3.x, and 4.x integrated with Microsoft Exchange is due to hard-coded usernames and passwords. A remote attacker can exploit these credentials to gain unauthorized access and change configuration settings or read incoming and outgoing email messages.

Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.

Buffer overflow in cgi.c in www-sql before version 0.5.7 allows local users to execute arbitrary code via a web page processed by www-sql.

Multiple format string vulnerabilities in the logquit, logerr, or loginfo functions in Software Upgrade Protocol (SUP) allow remote attackers to execute arbitrary code via format string specifiers in messages logged by syslog.

A vulnerability in the Unreal Engine allows remote attackers to execute arbitrary code by sending a UDP packet with a long value in a secure query, causing memory overwrite. It affects multiple games including Unreal Tournament 2004, DeusEx, and Postal 2.

A stack-based buffer overflow in MySQL 4.1.x before 4.1.3 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long scramble string.