CVE Vulnerability Catalog

Buffer overflow in All-Mail 1.1 allows remote attackers to execute arbitrary commands via a long 'MAIL FROM' or 'RCPT TO' command.

Buffer overflow in bftp daemon (bftpd) version 1.0.11 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER command.

PHP versions 3 and 4 do not properly cleanse user-injected format strings, allowing remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.

IIS versions 4.0 and 5.0 have an issue with session cookies being sent identically for both secure and insecure web sessions. This could allow remote attackers to hijack a user's secure session if that user switches to an insecure session.

Avirt Mail versions 4.0 and 4.2 are vulnerable to a denial of service attack that may also allow remote execution of arbitrary commands via long 'RCPT TO' or 'MAIL FROM' commands.

The global.cgi CGI program in version 3.55 and earlier on NetBSD allows remote attackers to execute arbitrary commands via shell metacharacters.

GnuPG (gpg) version 1.0.3 does not properly check all signatures of a file containing multiple documents, allowing an attacker to modify the contents of all documents except the first without detection.

The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.

Buffer overflow in the automatic mail checking component of Pine 4.21 and earlier allows remote attackers to execute arbitrary commands via a long From: header.

CVE-2000-0996 describes a vulnerability in the su program in OpenBSD that allows local attackers to gain root privileges via a malformed shell.

EServ 2.92 Build 2982 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long HELO and MAIL FROM commands.

WinU versions 1.0 through 5.1 has a backdoor password that allows remote attackers to gain access to its administrative interface and modify configuration.

Heap overflow in the savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option.

Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, allowing an attacker who knows the community name to crack the password and gain privileges.

Buffer overflow in the web administration service for the HiNet LP5100 IP-phone allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.

CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, allowing remote attackers to modify the password without knowing the original password.

Zope versions 2.2.0 through 2.2.4 improperly perform security registration for legacy names of object constructors, which could allow attackers to perform unauthorized activities.

Buffer overflow in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large TACACS+ packet.

The csstart program in iCal 2.1 Patch 2 uses relative pathnames to install the libsocket and libnsl libraries, which could allow the icsuser account to gain root privileges by creating a Trojan Horse library in the current or parent directory.

The csstart program in iCal 2.1 Patch 2 searches the current working directory for the cshttpd program, allowing local users to gain root privileges by creating a Trojan Horse cshttpd program in that directory and calling csstart from there.