CVE Vulnerability Catalog

There is an off-by-one buffer overflow in the Basic Authentication mechanism in thttpd from Acme Labs versions 1.95 through 2.20. This can lead to denial of service and potentially allow remote attackers to execute arbitrary code.

Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, allowing remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.

Knox Arkeia server version 4.2, and possibly other versions, uses a constant salt when encrypting passwords with the crypt() function, making it easier for attackers to conduct brute force password guessing.

TCP Wrappers in FreeBSD versions 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing.

CVE-2001-0609 describes a format string vulnerability in Infodrom cfingerd version 1.4.3 and earlier, allowing a remote attacker to gain additional privileges via a malformed ident reply passed to the syslog function.

The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, making it easier to break into the server via brute force password guessing.

Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing.

Buffer overflow in the FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings.

Heap overflow in the FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to generate long strings.

The Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users when bad passwords are entered, making it easier for remote attackers to conduct brute force password guessing attacks.

CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, allowing remote attackers to modify the password without knowing the original password.

The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, allowing Windows to accept DNS updates from hosts that it did not query. This enables remote attackers to poison the DNS cache.

Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka System V listener) port, TCP port 2766.

VAXstations running Open VMS versions 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts. This makes it easier for attackers to conduct brute force password guessing.

The default permissions of /dev/kmem in Linux versions before 2.0.36 allow IP spoofing.

Buffer overflow in POP servers based on BSD/Qualcomm's qpopper allows remote attackers to gain root access using a long PASS command.

IP forwarding is enabled on a machine that is not a router or firewall, which may lead to unauthorized access to the network.

The INN daemon (innd) version 1.5 has a vulnerability that allows command execution via shell metachars in 'newgroup' and 'rmgroup' control messages, among others.

CVE-1999-0066 vulnerability concerns remote code execution in the AnyForm CGI script. This allows attackers to execute arbitrary commands on the server.