CVE Vulnerability Catalog

The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address.

Bajie HTTP JServer version 0.78 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request for a non-existent CGI program.

The orderdspc.d2w macro in IBM Net.Commerce 3.x allows remote attackers to execute arbitrary SQL queries by inserting them into the order_rn option of the report capability.

Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5 allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using an IFRAME tag. This issue may be due to a vulnerability in Windows Scripting Host (WSH).

Masquerading code for Linux kernel before 2.2.19 does not fully check packet lengths in certain cases, which may lead to a vulnerability.

mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.

Alcatel Speed Touch ADSL modem with specific firmware versions has a blank default password, allowing remote attackers to gain unauthorized access.

CVE-2001-1425 affects the challenge-response authentication for the EXPERT user on Alcatel Speed Touch devices running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134. Remote attackers can gain privileges by directly computing the response based on information provided by the device during login.

Alcatel Speed Touch devices running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 have a TFTP server running without a password, allowing remote attackers to change firmware versions or the device's configurations.

CVE-2001-0181 describes a vulnerability in the error logging code of the DHCP server and client in Caldera Linux that allows remote attackers to execute arbitrary commands.

Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file.

Buffer overflow in wwwwais allows remote attackers to execute arbitrary commands via a long QUERY_STRING (HTTP GET request).

The Watchguard Firebox II firewall allows users with read-only access to gain read-write access and administrative privileges by accessing a file that contains hashed passphrases.

Buffer overflow in micq client 0.4.6 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long Description field.

Buffer overflow in bing allows remote attackers to execute arbitrary commands via a long hostname, which is copied to a small buffer after a reverse DNS lookup using the gethostbyaddr function.

CVE-2001-0197 describes a format string vulnerability in the print_client function in icecast version 1.3.8beta2 and earlier, allowing remote attackers to execute arbitrary commands.

Buffer overflow in /usr/bin/cu in Solaris 2.8 and earlier, and possibly other operating systems, allows local users to gain privileges by executing cu with a long program name (arg0).

The setuid doroot program in Voyant Sonata 3.x executes arbitrary command line arguments, allowing local users to gain root privileges.

ipfw and ip6fw in FreeBSD 4.2 and earlier allow remote attackers to bypass access restrictions by setting the ECE flag in a TCP packet, which makes the packet appear to be part of an established connection.

Buffer overflow in ReiserFS 3.5.28 in SuSE Linux allows local users to cause a denial of service and possibly execute arbitrary commands by via a long directory name.