Format string

Format string vulnerability in the incputerror function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws Claws Mail 1.9.100 and 2.10.0, allows remote POP3 servers to execute arbitrary code via format string specifiers in crafted replies...

CVE-2007-2958

Format string vulnerability in the incputerror function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws Claws Mail 1.9.100 and 2.10.0, allows remote POP3 servers to execute arbitrary code via format string specifiers in crafted replies...

CVE-2007-4411

ircu 2.10.12.05 and earlier allows remote attackers to discover the hidden IP address of arbitrary +x users via a series of /silence commands with 1 CIDR mask arguments or 2 certain other arguments that represent groups of IP addresses, then monitoring CTCP ping replies...

CVE-2007-4411

ircu 2.10.12.05 and earlier allows remote attackers to discover the hidden IP address of arbitrary +x users via a series of /silence commands with 1 CIDR mask arguments or 2 certain other arguments that represent groups of IP addresses, then monitoring CTCP ping replies...

CVE-2006-6538

D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause 1 a denial of service device reset via a flood of ARP replies on the wired or wireless radio link and 2 a denial of service device crash via a flood of ARP requests on the wireless link...

DEBIAN-CVE-2005-2302

PowerDNS before 2.9.18, when allowing recursion to a restricted range of IP addresses, does not properly handle questions from clients that are denied recursion, which could cause a "blank out" of answers to those clients that are allowed to use recursion...

Broadcast format string and buffer-overflow in Race Driver 1.20

Luigi Auriemma Application: Race Driver http://www.codemasters.com/tocaracedriver/ Versions: = 1.20 Platforms: Windows Bugs: A broadcast format string B broadcast buffer-overflow Exploitation: remote, versus any user in the public chat or through malformed server replies broadcast Date: 18 Jul 20...

DEBIAN-CVE-2005-0490

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by 1 the Curlinputntlm functio...

CVE-2000-1215

The CVE-2000-1215 entry concerns Lotus Domino server 5.0.8 in its default configuration, which exposes system information (version, operating system, and build date) in HTTP response headers. This represents an information-disclosure vulnerability that can allow remote attackers to glean sensitiv...

Buffer overflow in multiple IMAP clients

Buffer overflows on long replies, large message sizes, etc...

CVE-2005-0108

Apache modauthradius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service crash via a RADIUSREPLYMESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument...

CuteFTP 6.0 Professional Remote Buffer Overflow Vulnerability

Author: Hongzhen ZhouFortinet, Inc felixzhou at hotmail dot com DATE: 24/11/2004 PRODUCTS: CuteFTP Professional - FTP client for Windows. AFFECTED VERSION: Versions verified to be vulnerable: CuteFTP Professional 6.0 latest verson Other versions are not tested. DETAILS: When CuteFTP Professional...

Gearbox Software Halo Game 1.x - Client Remote Denial of Service

Gearbox Software Halo Game 1.x - Client Remote Denial of Service source: https://www.securityfocus.com/bid/11724/info The Halo game client is reported prone to a remote denial of service vulnerability. It is reported that when using the in game browser to view a server list, a malicious reply fro...

mysql -- mysql_real_connect buffer overflow vulnerability

The mysqlrealconnect function doesn't properly handle DNS replies by copying the IP address into a buffer without any length checking. A specially crafted DNS reply may therefore be used to cause a buffer overflow on affected systems. Note that whether this issue can be exploitable depends on the...

Linksys information leak

Replies to BOOTP packets contain data from kernel space...

Outlook Express HTML file writing

During reply to a message with HTML file attached this file is saved to known location...

squid -- HTTP response splitting cache pollution attack

According to a whitepaper published by Sanctum, Inc., it is possible to mount cache poisoning attacks against, among others, squid proxies by inserting false replies into the HTTP stream. The squid patches page notes: This patch additionally strengthens Squid from the HTTP response attack describ...

BSD arp DoS

By sending spoofed arp-replies it's possible to cause memory starvation with arp table leading to system crash...

DEBIAN-CVE-2003-0324

Buffer overflows in EPIC IRC Client EPIC4 1.0.1 allows remote malicious IRC servers to cause a denial of service crash and possibly execute arbitrary code via long replies that are not properly handled by the 1 userhostcmdreturned function, or 2 Statusbar capability...

CVE-2002-0910

Buffer overflows in netstd 3.07-17 package allows remote DNS servers to execute arbitrary code via a long FQDN reply, as observed in the utilities 1 linux-ftpd, 2 pcnfsd, 3 tftp, 4 traceroute, or 5 from/to...