CVE Vulnerability Catalog

The SystemSoft SystemWizard package on HP Pavilion PCs with Windows 98, and possibly other platforms, installs two ActiveX controls marked as safe for scripting. This allows remote attackers to execute arbitrary commands via a malicious web page that references the Launch control or the RegObj control.

Vulnerability in Cisco IOS versions 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical subinterface.

Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.

Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabled.

When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies.

The BMC Patrol component, when installed with Compaq Insight Management Agent 4.23 and earlier, or Management Agents for Servers 4.40 and earlier, creates a PFCUser account with a default password and potentially dangerous privileges.

netcfg 2.16-1 in Red Hat Linux 4.2 allows users to control the Ethernet interface on reboot when an option is set, enabling local users to cause a denial of service by shutting down the interface.

Vulnerability in accton in Cray UNICOS 6.1 and 6.0 allows local users to read arbitrary files and modify system accounting configuration.

Windows NT 3.51 and 4.0 allow local users to cause a denial of service (crash) by running a program that creates a large number of locks on a file, which exhausts the NonPagedPool.

Cisco Resource Manager (CRM) versions 1.0 and 1.1 create world-readable log files and temporary files, which may expose sensitive information such as user IDs, passwords, and SNMP community strings to local users.

The vulnerability in lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack triggered after invoking lpr 1000 times.

The snmpd server in the cmu-snmp package before version 3.3-1 in Red Hat Linux 4.0 is configured to allow remote attackers to read and write sensitive information.

Windows NT 4.0 allows local users to cause a denial of service via a user mode application that closes a handle that was opened in kernel mode, which causes a crash when the kernel attempts to close the handle.

IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request, known as the IIS 'GET' vulnerability.

Buffer overflow in SysVInit in Red Hat Linux 5.1 and earlier allows local users to gain privileges.

The gzexe program in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file.

Perl 5.004_04 and earlier follows symbolic links when running with the -e option, allowing local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.

Windows NT 4.0 allows local users to cause a denial of service (crash) via an illegal kernel mode address to the functions GetThreadContext or SetThreadContext.

The HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host.

Cisco PIX Private Link version 4.1.6 and earlier improperly processes certain commands in the configuration file, reducing the effective key length of the DES key to 48 bits instead of 56 bits.