CVE Vulnerability Catalog

Cisco 12000 devices with IOS 12.0 and line cards based on Engine 2 do not properly handle outbound ACLs when input ACLs are not configured on all interfaces of a multi-port line card. This could allow remote attackers to bypass intended access controls.

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the 'fragment' keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access.

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly handle the implicit 'deny ip any any' rule in an outgoing ACL when the ACL contains exactly 448 entries, which can allow some outgoing packets to bypass access restrictions.

The Terminal Services Manager MMC in Windows 2000 and XP trusts the Client Address (IP address) provided by the client instead of obtaining it from the packet headers, allowing clients to spoof their public IP address, e.g., through Network Address Translation (NAT).

CVE-2001-0857 describes a cross-site scripting vulnerability in status.php3 in Imp Webmail version 2.2.6 and earlier. It allows remote attackers to gain access to other users' emails by hijacking session cookies via the message parameter.

Buffer overflow in db_loader in ClearCase 4.2 and earlier allows local users to gain root privileges via a long TERM environment variable.

Buffer overflows in the send_status, kill_print, and chk_fhost functions in lpd in AIX 4.3 and 5.1 allow remote attackers to gain root privileges.

A buffer overflow in the '\s' console command in MDBMS 0.99b9 and earlier allows remote attackers to execute arbitrary commands by sending a large amount of data.

CVE-2001-0824 describes a cross-site scripting vulnerability in IBM WebSphere 3.02 and 3.5 FP2 that allows remote attackers to execute Javascript. Attackers can inject Javascript through requests to .JSP files or the webapp/examples directory, resulting in the injection of code into an error page.

Buffer overflows in lpsched in IRIX 6.5.13f and earlier allow remote attackers to execute arbitrary commands via a long argument.

lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.

A vulnerability in GNATS GnatsWeb versions 2.7 through 3.95 allows remote attackers to execute arbitrary commands via certain characters in the help_file parameter.

The lpstat program in IRIX 6.5.13f and earlier allows local users to gain root privileges by specifying a Trojan Horse nettype shared library.

Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands.

OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands.

Vulnerability in HP-UX line printer daemon (rlpdaemon) in HP-UX 10.01 through 11.11 allows remote attackers to modify arbitrary files and gain root privileges via a certain print request.

A buffer overflow in Linux fetchmail before version 5.8.6 allows remote attackers to execute arbitrary code via a large 'To:' field in an email header.

Buffer overflows in GazTek ghttpd version 1.4 allow a remote attacker to execute arbitrary code. This issue affects the Log function in util.c and serveconnection in protocol.c, which improperly handle long arguments.

Buffer overflow in internal string handling routines of xinetd before version 2.1.8.8 allows remote attackers to execute arbitrary commands via a length argument of zero or less, which disables the length check.

Cerberus FTP server versions 1.0 - 1.5 are vulnerable to a denial of service attack that can crash the server due to a large number of 'PASV' requests.