The snprintf function in the db library 1.85.4 ignores the size parameter, which could allow attackers to exploit buffer overflows that would be prevented by a properly implemented snprintf.
AFFECTED_PRODUCTS:
Debian Debian Linux,
Red Hat Linux
Buffer overflow in SysVInit in Red Hat Linux 5.1 and earlier allows local users to gain privileges.
AFFECTED_PRODUCTS:
Red Hat Linux
linuxconf before 1.11.r11-rh3 on Red Hat Linux 5.1 allows local users to overwrite arbitrary files and gain root access via a symlink attack.
AFFECTED_PRODUCTS:
Red Hat Linux
Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable.
AFFECTED_PRODUCTS:
Red Hat Linux
SAS System 5.18 on VAX/VMS is installed with insecure permissions for its directories and startup file, which allows local users to gain privileges.
AFFECTED_PRODUCTS:
Vax Vms Sas System
VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts, which makes it easier for attackers to conduct brute force password guessing.
AFFECTED_PRODUCTS:
HP Openvms Vax
Vulnerability in Novell NetWare 3.x and earlier allows local users to gain privileges via packet spoofing.
AFFECTED_PRODUCTS:
Novell Netware
Windows NT 4.0 SP4 and earlier allows local users to gain privileges by modifying the symbolic link table in the \?? object folder using a different case letter (upper or lower) to point to a different device.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
Passfilt.dll in Windows NT SP2 allows users to create a password that contains the user's name, which could make it easier for an attacker to guess.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
Vulnerabilities in DECnet/OSI for OpenVMS before 5.8 on DEC Alpha AXP and VAX/VMS systems allow local users to gain privileges or cause a denial of service.
AFFECTED_PRODUCTS:
Dec Dec Openvms
Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.
AFFECTED_PRODUCTS:
Novell Unixware
Vulnerability in accton in Cray UNICOS 6.1 and 6.0 allows local users to read arbitrary files and modify system accounting configuration.
AFFECTED_PRODUCTS:
Cray Unicos,
Cray Unicos
Office Shortcut Bar (OSB) in Windows 3.51 enables backup and restore permissions, which are inherited by programs such as File Manager that are started from the Shortcut Bar, which could allow local users to read folders for which they do not have permission.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
AFFECTED_PRODUCTS:
Apache HTTP Server
Buffer overflow in nftp FTP client version 1.40 allows remote malicious FTP servers to cause a denial of service, and possibly execute arbitrary commands, via a long response string.
AFFECTED_PRODUCTS:
Chris Matthee Nftp
Vulnerability in Analog 3.0 and earlier allows remote attackers to read arbitrary files via the forms interface.
AFFECTED_PRODUCTS:
Stephen Turner Analog
An interaction between the AS/400 shared folders feature and Microsoft SNA Server 3.0 and earlier allows users to view each other's folders when the users share the same Local APPC LU.
AFFECTED_PRODUCTS:
Microsoft Sna Server,
Microsoft Sna Server
Microsoft Office 98, Macintosh Edition, does not properly initialize the disk space used by Office 98 files and effectively inserts data from previously deleted files into the Office file, which could allow attackers to obtain sensitive information.
AFFECTED_PRODUCTS:
Microsoft Office
Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure default permissions, allowing remote attackers to read the passwords and gain privileges.
AFFECTED_PRODUCTS:
Microsoft Site Server
IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain, aka the "Domain Resolution" vulnerability.
AFFECTED_PRODUCTS:
Microsoft Internet Information Server
IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (forward slash) characters.
AFFECTED_PRODUCTS:
Microsoft Internet Information Server
Netbt.sys in Windows NT 4.0 allows remote malicious DNS servers to cause a denial of service (crash) by returning 0.0.0.0 as the IP address for a DNS host name lookup.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
SystemSoft SystemWizard package in HP Pavilion PC with Windows 98, and possibly other platforms and operating systems, installs two ActiveX controls that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via a malicious web page that references (1) the Lau...
AFFECTED_PRODUCTS:
Systemsoft Systemwizard
Directory traversal vulnerability in nph-publish before 1.2 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the pathname for an upload operation.
AFFECTED_PRODUCTS:
Lincoln D. Stein Nph Publish
Web Cache Control Protocol (WCCP) in Cisco Cache Engine for Cisco IOS 11.2 and earlier does not use authentication, which allows remote attackers to redirect HTTP traffic to arbitrary hosts via WCCP packets to UDP port 2048.
AFFECTED_PRODUCTS:
Cisco IOS
Cross-site scripting vulnerability in Third Voice Web annotation utility allows remote users to read sensitive data and generate fake web pages for other Third Voice users by injecting malicious Javascript into an annotation.
AFFECTED_PRODUCTS:
Third Voice Third Voice Web
Tcpip.sys in Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service via an ICMP Subnet Mask Address Request packet, when certain multiple IP addresses are bound to the same network interface.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connections at the same time.
AFFECTED_PRODUCTS:
Microsoft Internet Information Server
Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as (1) a Routing Information Field (RIF) field with a hop count greater than 7, or (2) a list containing duplicate Token Ring IDs.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data, aka the "Named Pipes Over RPC" vulnerability.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
Cisco Resource Manager (CRM) 1.1 and earlier creates certain files with insecure permissions that allow local users to obtain sensitive configuration information including usernames, passwords, and SNMP community strings, from (1) swim_swd.log, (2) swim_debug.log, (3) dbi_debug.log, and (4) temporar...
AFFECTED_PRODUCTS:
Cisco Resource Manager
HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host.
AFFECTED_PRODUCTS:
Allaire Coldfusion
lquerypv in AIX 4.1 and 4.2 allows local users to read arbitrary files by specifying the file in the -h command line parameter.
AFFECTED_PRODUCTS:
IBM Aix,
IBM Aix
Windows 95, when Remote Administration and File Sharing for NetWare Networks is enabled, creates a share (C$) when an administrator logs in remotely, which allows remote attackers to read arbitrary files by mapping the network drive.
AFFECTED_PRODUCTS:
Microsoft Windows 95
Windows 95 uses weak encryption for the password list (.pwl) file used when password caching is enabled, which allows local users to gain privileges by decrypting the passwords.
AFFECTED_PRODUCTS:
Microsoft Windows 95
lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered after invoking lpr 1000 times.
AFFECTED_PRODUCTS:
BSD Bsd,
Sun Sunos,
Sgi Irix
... (+1)
Cisco PIX Private Link 4.1.6 and earlier does not properly process certain commands in the configuration file, which reduces the effective key length of the DES key to 48 bits instead of 56 bits, which makes it easier for an attacker to find the proper key via a brute force attack.
AFFECTED_PRODUCTS:
Cisco Pix Private Link
Buffer overflow in Internet Explorer 4.01 and earlier allows remote attackers to execute arbitrary commands via a long URL with the "mk:" protocol, aka the "MK Overrun security issue."
AFFECTED_PRODUCTS:
Microsoft Internet Explorer
Buffer overflow in the Window.External function in the JScript Scripting Engine in Internet Explorer 4.01 SP1 and earlier allows remote attackers to execute arbitrary commands via a malicious web page.
AFFECTED_PRODUCTS:
Microsoft Internet Explorer,
Microsoft Internet Explorer,
Microsoft Internet Explorer
Internet Explorer 4 treats a 32-bit number ("dotless IP address") in the a URL as the hostname instead of an IP address, which causes IE to apply Local Intranet Zone settings to the resulting web page, allowing remote malicious web servers to conduct unauthorized activities by using URLs that contai...
AFFECTED_PRODUCTS:
Microsoft Internet Explorer,
Microsoft Internet Explorer
The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which is automatically executed on a system crash.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking.
AFFECTED_PRODUCTS:
Webmin Webmin,
Webmin Webmin,
Webmin Webmin
... (+6)
Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, aka the Excel "CALL Vulnerability."
AFFECTED_PRODUCTS:
Microsoft Excel
Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote attackers to cause a denial of service (application error).
AFFECTED_PRODUCTS:
Microsoft Exchange Server,
Microsoft Exchange Server
Cisco Resource Manager (CRM) 1.0 and 1.1 creates world-readable log files and temporary files, which may expose sensitive information, to local users such as user IDs, passwords and SNMP community strings.
AFFECTED_PRODUCTS:
Cisco Resource Manager,
Cisco Resource Manager
IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request, aka the IIS "GET" vulnerability.
AFFECTED_PRODUCTS:
Microsoft Internet Information Server,
Microsoft Internet Information Server
Memory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a large number of queries.
AFFECTED_PRODUCTS:
Microsoft Windows Nt
Multiple buffer overflows in ISC DHCP Distribution server (dhcpd) 1.0 and 2.0 allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary commands via long options.
AFFECTED_PRODUCTS:
Isc Dhcp Client,
Isc Dhcp Client
IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL.
AFFECTED_PRODUCTS:
Microsoft Internet Information Services,
Microsoft Internet Information Server
nviboot boot script in the Debian nvi package allows local users to delete files via malformed entries in vi.recover.
AFFECTED_PRODUCTS:
Debian Debian Linux,
Berkeley Nvi