CVE Vulnerability Catalog

Buffer overflow in the ASP Server-Side Include Function in IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.

Funk Software Proxy Host 3.x uses weak encryption for the Proxy Host password, allowing local users to gain privileges by recovering passwords from the PHOST.INI file or the Windows registry.

Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code.

Buffer overflow in various Microsoft applications for Macintosh allows remote attackers to cause a denial of service (crash) or execute arbitrary code by invoking the file:// directive with a large number of / characters. Affects Internet Explorer 5.1, Outlook Express 5.0 through 5.0.2, Entourage v. X and 2001, PowerPoint v. X, 2001, and 98, and Excel v. X and 2001 for Macintosh.

Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.

Vulnerability in Imlib before version 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments passed to malloc, resulting in heap corruption.

Zope versions 2.2.0 through 2.5.1 do not properly verify access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, known as the 'Local Applescript Invocation' vulnerability.

Funk Software Proxy Host versions 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control. This allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.

Icecast versions 1.3.11 and earlier are vulnerable to buffer overflows that allow remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client.

Lotus Domino Servers 5.x, 4.6x, and 4.5x allow attackers to bypass the intended Reader and Author access list for a document's object via a Notes API call (NSFDbReadObject) that directly accesses the object.

Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code.

Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.

Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code.

Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.

Webalizer 2.01-06 has a buffer overflow when configured to use reverse DNS lookups. This allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.

Cross-site scripting vulnerability in IIS 4.0, 5.0 and 5.1. A remote attacker can execute arbitrary script as other web users via the error message used in a URL redirect ("302 Object Moved") message.

AOL Instant Messenger (AIM) version 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions.

Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.