176 matches found
CVE-2005-0015
The CVE-2005-0015 issue concerns diatheke.pl in Sword 1.5.7a, where missing input sanitising enables remote attackers to execute arbitrary commands via shell metacharacters in a URL. Public sources (Debian DSA-650-1, OpenVAS DSAs) confirm a remote command-execution vulnerability in Sword’s CGI sc...
Debian DSA-650-1 : sword - missing input sanitising
Ulf Harnhammar discovered that due to missing input sanitising in diatheke, a CGI script for making and browsing a bible website, it is possible to execute arbitrary commands via a specially crafted URL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...
CVE-2003-0015
CVE-2003-0015 describes a double-free in CVS
CVE-2003-0015
Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands...
CVE-2003-0015
Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands...
CVE-2004-0015
vbox3 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, which allows local users to gain privileges...
CVE-2004-0015
The CVE concerns vbox3:0.1.8 and earlier where root privileges were not properly relinquished before executing a user-supplied TCL script, enabling a local user to gain privileges. Affected: vbox3 (ISDN4Linux vocal system); root privilege leak via privilege drop failure. Debian DSAs confirm fixes...
CVE-2004-0015
vbox3 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, which allows local users to gain privileges...
CVE-2003-0015
...
CVE-2003-0015
Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands...
CVE-2001-0015
Network Dynamic Data Exchange DDE in Windows 2000 allows local users to gain SYSTEM privileges via a "WMCOPYDATA" message to an invisible window that is running with the privileges of the WINLOGON process...
CVE-2001-0015
CVE-2001-0015 affects Windows 2000 via the Network Dynamic Data Exchange (DDE) component. The vulnerability allows a local attacker to elevate privileges to Local System by sending a WM_COPYDATA message to an invisible DDE window that runs with WINLOGON privileges, enabling arbitrary command exec...
CVE-2001-0015
Network Dynamic Data Exchange DDE in Windows 2000 allows local users to gain SYSTEM privileges via a "WMCOPYDATA" message to an invisible window that is running with the privileges of the WINLOGON process...
CVE-1999-0015
CVE-1999-0015 is a Teardrop IP fragmentation denial-of-service vulnerability. The connected sources describe a flaw in IP fragment reassembly that can crash or disrupt a remote server, enabling a DoS condition without authentication. The nessus entry explicitly notes the attack payload (“teardrop...