CVE Vulnerability Catalog

The password.asp file in Snitz Forums version 3.4.03 and earlier allows remote attackers to reset passwords and gain privileges as other users by sending a modified request to password.asp with a different member id.

Caché Database 5.x installs the file /cachesys/bin/cache with world-writable permissions, allowing local users to gain privileges by modifying the cache and executing it via cuxs.

Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to WebAdmin.dll with a long USER argument.

CVE-2003-0510 describes a format string vulnerability in ezbounce versions 1.0 through 1.50 that allows remote attackers to execute arbitrary code via the 'sessions' command.

Buffer overflow in the ShellExecute API function of SHELL32.DLL in Windows 2000 before SP4 may allow attackers to cause a denial of service or execute arbitrary code via a long third argument.

TUTOS 1.1 allows remote attackers to execute arbitrary code by uploading the code using file_new.php, then directly accessing the uploaded code via a request to the repository containing the code.

Multiple buffer overflows in xgalaga 2.0.34 and earlier allow local users to gain privileges via a long HOME environment variable.

An unknown vulnerability in the IPv6 capability in IRIX 6.5.19 causes snoop to process packets as the root user, with unknown implications.

The Tutorials 2.0 module in XOOPS and E-XOOPS allows remote attackers to execute arbitrary code by uploading a PHP file without a MIME image type, then directly accessing the uploaded file.

Buffer overflow in the WWWLaunchNetscape function of Adobe Acrobat Reader 5.0.7 and earlier allows remote attackers to execute arbitrary code via a .pdf file with a long mailto link.

There is an SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before version 1.2.9rc1 that allows remote attackers to execute arbitrary SQL queries.

SQL injection vulnerability in Cyberstrong eShop 4.2 and earlier allows remote attackers to steal authentication information and gain privileges via the ProductCode parameter in (1) 10expand.asp, (2) 10browse.asp, and (3) 20review.asp.

A stack-based buffer overflow in Active Directory in Windows 2000 before SP4 can be exploited by remote attackers. Attackers can cause a denial of service (reboot) and potentially execute arbitrary code by sending an LDAP version 3 search request with a large number of conditions.

Snitz Forums 3.4.03 and earlier allows attackers to gain privileges as other users by stealing and replaying the encrypted password after obtaining a valid session ID.

The installation of Dantz Retrospect Client 5.0.540 on MacOS X 10.2.6, and possibly other versions, creates critical directories and files with world-writable permissions, allowing local users to gain privileges as other users by replacing programs with malicious code.

Caché Database 5.x installs the /cachesys/csp directory with insecure permissions, allowing local users to execute arbitrary code by adding server-side scripts that are executed with root privileges.

Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll) in IIS 5.0 allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll.

Buffer overflow in search.cgi for mnoGoSearch 3.2.10 allows remote attackers to execute arbitrary code via a long tmplt parameter.

Buffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename.

The tvb_get_nstringz0 function in Ethereal 0.9.12 and earlier does not properly handle a zero-length buffer size, leading to unknown consequences.