CVE Vulnerability Catalog

The dvips converter for Postscript files in the tetex package calls the system() function insecurely, allowing remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.

A vulnerability in the WebBrowser control used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via a script that accesses the Document property, bypassing <frame> and <iframe> domain restrictions.

JFS (JFS3.1 and OnlineJFS) in HP-UX 10.20, 11.00, and 11.04 does not properly implement the sticky bit functionality, which could allow attackers to bypass intended restrictions on filesystems.

Konqueror in versions 3.0 through 3.0.2 does not properly detect the 'secure' flag in HTTP cookies, which may lead to cookies being sent over an unencrypted channel.

Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it. This allows attackers to overwrite system files.

A class that supports XML in Microsoft Virtual Machine 5.0.3805 and earlier exposes unsafe methods, allowing remote attackers to execute unsafe code via a Java applet.

Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL terminated by a null string.

Buffer overflows in the ApacheBench benchmark support program (ab.c) before version 1.3.27 and Apache 2.x before version 2.0.43 can be exploited by a malicious web server. This may lead to denial of service and potentially allow arbitrary code execution via a long response.

The shared memory in the HTTP daemon for Apache 1.3.x before 1.3.27 allows users running as the Apache UID to send a SIGUSR1 signal to any process running as root. This can lead to denial of service or other unauthorized actions.

The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16 does not authenticate requests to reset the device, allowing remote attackers to cause a denial of service via a direct request to the device_reset CGI program.

Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.

Buffer overflow in John Franks WN Server versions 1.18.2 through 2.0.0 allows remote attackers to execute arbitrary code via a long GET request.

The cross-site scripting protection for Konqueror in KDE versions 2.2.2 and 3.0 through 3.0.3 does not properly initialize domains on sub-frames and sub-iframes. This can allow remote attackers to execute scripts and steal cookies from subframes that are in other domains.

Buffer overflow in the Database Console Command (DBCC) in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a 'non-SQL OLEDB data source' such as FoxPro.

Buffer overflow in MySQL daemon (mysqld) before version 3.23.50 and 4.0 beta before 4.02 on the Win32 platform allows local users to execute arbitrary code via a long 'datadir' parameter in the my.ini initialization file.

UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, allowing remote attackers to decrypt the administrative password using a hard-coded key in a Javascript function.

Buffer overflow in SmartHTML Interpreter (shtml.dll) in Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to cause a denial of service (CPU consumption) or run arbitrary code via a certain type of web file request.

The Web Reports Server for SurfControl SuperScout WebFilter stores the 'scwebusers' username and password file in a web-accessible directory, allowing remote attackers to obtain valid usernames and crack passwords.

Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames.

CVE-2002-0709 describes SQL injection vulnerabilities in the Web Reports Server for SurfControl SuperScout WebFilter that allow remote attackers to execute arbitrary SQL queries via the RunReport option to SimpleBar.dll, and possibly other DLLs.