CVE Vulnerability Catalog

The rcS and mountall programs in Sun Solaris 2.x, possibly before 2.4, start a privileged shell on the system console if fsck fails while the system is booting.

The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.

Buffer overflow in AnalogX SimpleServer:WWW HTTP server allows remote attackers to execute commands via a long GET request.

Internet Explorer 4 treats a 32-bit number ("dotless IP address") in a URL as the hostname instead of an IP address, causing Local Intranet Zone settings to be applied to the resulting web page.

Cisco PIX Private Link version 4.1.6 and earlier improperly processes certain commands in the configuration file, reducing the effective key length of the DES key to 48 bits instead of 56 bits.

The HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host.

NetWare NFS mode 1 and 2 implements the 'Read Only' flag in Unix by changing the ownership of a file to root, allowing local users to gain root privileges by creating a setuid program and setting it to 'Read Only.'

Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable.

The soundplayer program in IRIX allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program.

The SystemSoft SystemWizard package on HP Pavilion PCs with Windows 98, and possibly other platforms, installs two ActiveX controls marked as safe for scripting. This allows remote attackers to execute arbitrary commands via a malicious web page that references the Launch control or the RegObj control.

Directory traversal vulnerability in nph-publish before version 1.2 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the pathname for an upload operation.

Netbt.sys in Windows NT 4.0 allows remote malicious DNS servers to cause a denial of service (crash) by returning 0.0.0.0 as the IP address for a DNS host name lookup.

GINA in Windows NT 4.0 allows attackers with physical access to display a portion of the clipboard of the user who has locked the workstation by pasting (CTRL-V) the contents into the username prompt.

Vulnerability in Novell NetWare 3.x and earlier allows local users to gain privileges via packet spoofing.

Cisco Resource Manager (CRM) versions 1.0 and 1.1 create world-readable log files and temporary files, which may expose sensitive information such as user IDs, passwords, and SNMP community strings to local users.

Microsoft Office 98 for Macintosh does not properly initialize the disk space used by Office 98 files, effectively inserting data from previously deleted files into the Office file. This could allow attackers to obtain sensitive information.

Office Shortcut Bar (OSB) in Windows 3.51 enables backup and restore permissions, which could allow local users to read folders for which they do not have permission.

The vulnerability in lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack triggered after invoking lpr 1000 times.

Windows NT 4.0 allows local users to cause a denial of service (crash) via an illegal kernel mode address to the functions GetThreadContext or SetThreadContext.

netcfg 2.16-1 in Red Hat Linux 4.2 allows users to control the Ethernet interface on reboot when an option is set, enabling local users to cause a denial of service by shutting down the interface.