CVE Vulnerability Catalog

DotBr version 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter in (1) exec.php3 or (2) system.php3.

Aladdin Knowlege Systems eSafe Gateway version 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, allowing remote attackers to bypass virus protection.

Adiscon WinSyslog 4.21 SP1 is vulnerable to a denial of service attack that can be triggered by remote attackers sending long syslog messages.

Buffer overflow in AOL Instant Messenger (AIM) 5.2.3292 allows remote attackers to execute arbitrary code via an aim:getfile URL with a long screen name.

The slashem-tty program in the FreeBSD Ports Collection is installed with write permissions for the games group, allowing local users with games group privileges to modify slashem-tty and execute arbitrary code as other users.

Unspecified vulnerability in CDE dtmailpr of HP Tru64 versions 4.0F through 5.1B allows local users to gain privileges via unknown attack vectors.

Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F, related to 'malicious script'.

Kerio Personal Firewall (KPF) version 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), allowing remote attackers to bypass the firewall filters.

RTS CryptoBuddy versions 1.0 and 1.2 use a weak encryption algorithm for the passphrase and generate predictable keys, making it easier for attackers to guess the passphrase.

RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute force guessing attacks.

iisPROTECT versions 2.1 and 2.2 allow remote attackers to bypass authentication via an HTTP request containing URL-encoded characters.

Planet Technology WGSD-1020 and WSW-2401 Ethernet switches use a default 'superuser' account with the 'planet' password, allowing remote attackers to gain administrative access.

Unspecified vulnerability in the non-SSL web agent in various HP Management Agent products allows local users or remote attackers to gain privileges or cause a denial of service via unknown attack vectors.

Buffer overflow in Epic Games Unreal Engine versions 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.

LICQ versions 1.2.6, 1.0.3, and possibly others have a format string vulnerability that allows remote attackers to perform unknown actions via format string specifiers.

MAILsweeper for SMTP versions 4.3.6 and 4.3.7 allows remote attackers to cause a denial of service (CPU consumption) via a PowerPoint attachment that is either (1) corrupt or (2) contains "embedded objects."

In OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and PAM keyboard-interactive authentication is used, there is no delay after a root login attempt with the correct password. This makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful.

Buffer overflow in the IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a CREATE command with a long mailbox name.

CVE-2003-1533 describes an SQL injection vulnerability in accesscontrol.php in PhpPass 2 that allows remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameters.

CVE-2003-1532 is an SQL injection vulnerability in compte.php in PhpMyShop 1.00 that allows remote attackers to execute arbitrary SQL commands via the identifiant and password parameters.