CVE Vulnerability Catalog

Various Intrusion Detection Systems (IDS), including Cisco Secure IDS and Snort, allow remote attackers to evade detection of HTTP attacks via non-standard '%u' Unicode encoding of ASCII characters in the requested URL.

Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix (SFU) 2.0, allows remote attackers to execute commands by spawning Telnet with a log file option on the command line and writing arbitrary code into an executable file which is later executed.

Example applications in ColdFusion Server 4.x do not properly restrict access from outside the local host's domain, allowing remote attackers to upload, read, or execute files by spoofing the 'HTTP Host' variable.

Vulnerability in Microsoft Excel 2002 and earlier and Microsoft PowerPoint 2002 and earlier allows attackers to bypass macro restrictions and execute arbitrary commands by modifying the data stream in the document.

Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable.

RPM Package Manager versions 4.0.x through 4.0.2.x allows an attacker to execute arbitrary code via corrupted data in the RPM file when queried.

WebID in RSA Security SecurID 5.0, as used by ACE/Agent for Windows, Windows NT and Windows 2000, allows attackers to cause the WebID agent to enter debug mode via a URL containing null characters, which may allow attackers to obtain sensitive information.

Directory traversal vulnerability in WebID in RSA Security SecurID 5.0 allows attackers to access restricted resources via URL-encoded (1) /.. or (2) \.. sequences.

Buffer overflow in GuildFTPd Server 0.97 allows remote attacker to execute arbitrary code via a long SITE command.

Linux kernel versions 2.2.x through 2.2.19 and 2.4.x through 2.4.9 contain a vulnerability in the ptrace function that allows local users to gain root privileges. This can be achieved by running ptrace on a setuid or setgid program that calls an unprivileged program, such as newgrp.

CVE-2001-0792 in XChat 1.2.x has a format string vulnerability that allows remote attackers to execute arbitrary code via a malformed nickname.

CatalogMgr.pl in VirtualCatalog allows remote attackers to execute arbitrary code via the template parameter.

Directory traversal vulnerability in Shambala 4.5 allows remote attackers to escape the FTP root directory via 'CWD ...' command.

Perception LiteServe version 1.25 allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as upper case letters or 8.3 file names.

Spytech SpyAnywhere version 1.50 allows remote attackers to gain administrator access by entering a single character in the 'loginpass' field.

KDE ktvision version 0.1.1-271 and earlier allows local attackers to gain root privileges via a symlink attack on a user configuration file.

The Cisco 6400 Access Concentrator Node Route Processor 2 (NRP2) 12.1DC card does not properly disable access when a password has not been set for vtys, allowing remote attackers to gain access via telnet.

Buffer overflow in HttpSave.dll in Trend Micro InterScan WebManager 1.2 allows remote attackers to execute arbitrary code via a long value to a certain parameter.

Hitachi Super-H architecture in NetBSD 1.5 and 1.4.1 allows a local user to gain privileges via modified Status Register contents, which are not properly handled by the sigreturn system call or the process_write_regs kernel routine.

Cisco CBOS version 2.3.8 and earlier stores passwords for (1) exec and (2) enable in cleartext in NVRAM and a configuration file. This could allow unauthorized users to obtain the passwords and gain privileges.