CVE Vulnerability Catalog

CVE-2000-0969 describes a format string vulnerability in Half Life dedicated server build 3104 and earlier, allowing remote attackers to execute arbitrary commands by injecting format strings into the changelevel command via the system console or rcon.

Auction Weaver versions 1.0 through 1.04 do not properly validate form field names, allowing remote attackers to delete arbitrary files and directories via a .. (dot dot) attack.

The bbd server in Big Brother System and Network Monitor before version 1.5c2 allows remote attackers to execute arbitrary commands via the '&' shell metacharacter.

CVE-2000-0997 describes format string vulnerabilities in the eeprom program in OpenBSD, NetBSD, and possibly other operating systems, allowing local attackers to gain root privileges.

Internet Explorer versions prior to 5.5 forwards cached user credentials for a secure web site to insecure pages on the same site. This could allow remote attackers to obtain the credentials by monitoring connections to the web server.

Buffer overflow in Hilgraeve, Inc. HyperTerminal client on Windows 98, ME, and 2000 allows remote attackers to execute arbitrary commands via a long telnet URL.

CVE-2000-0995 describes a vulnerability in the yp_passwd program in OpenBSD that allows attackers to gain root privileges by providing a malformed name.

The fstat program in OpenBSD has a format string vulnerability that allows local users to gain root privileges via the PWD environmental variable.

A vulnerability in the pw_error function in the BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.

CVE-2000-0950 describes a format string vulnerability in x-gw in TIS Firewall Toolkit (FWTK) that allows local users to execute arbitrary commands via a malformed display name.

Buffer overflow in the IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command.

Buffer overflow in the web administration service for the HiNet LP5100 IP-phone allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.

CVE-2000-0996 describes a vulnerability in the su program in OpenBSD that allows local attackers to gain root privileges via a malformed shell.

WinU versions 1.0 through 5.1 has a backdoor password that allows remote attackers to gain access to its administrative interface and modify configuration.

Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, allowing an attacker who knows the community name to crack the password and gain privileges.

Heap overflow in the savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option.

The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.

Buffer overflow in the automatic mail checking component of Pine 4.21 and earlier allows remote attackers to execute arbitrary commands via a long From: header.

EServ 2.92 Build 2982 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long HELO and MAIL FROM commands.

GNU Groff uses the current working directory to find a device description file, allowing a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff.