CVE-2004-0884

The 1 libsasl and 2 libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASLPATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASLPATH to point to malicious programs...

CVE-2005-0020

Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code...

CVE-2005-0004

The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files...

CVE-2005-0117

Buffer overflow in XShisen before 1.36 allows local users to execute arbitrary code via a long GECOS field...

CVE-2003-0014

gsinterf.c in bmv 1.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files...

CVE-2005-0113

inpview in SGI IRIX allows local users to execute arbitrary commands via the SUNTTSESSIONCMD environment variable, which is executed by inpview without dropping privileges...

CVE-2004-1377

The 1 fixps aka fixps.in and 2 psmandup aka psmandup.in scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files...

CVE-2004-1016

The scmsend function in the scm layer for Linux kernel 2.4.x up to 2.4.28, and 2.6.x up to 2.6.9, allows local users to cause a denial of service system hang via crafted auxiliary messages that are passed to the sendmsg function, which causes a deadlock condition...

CVE-2004-1224

Off-by-one error in the mtrcurseskeyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated using the "s" keybinding, which leaves a buffer without a NULL terminator...

CVE-2004-1076

Multiple buffer overflows in the RtConfigLoad function in rt-config.c for Atari800 before 1.3.4 allow local users to execute arbitrary code via large values in the configuration file...

CVE-2004-1066

The cmdline pseudofiles in 1 procfs on FreeBSD 4.8 through 5.3, and 2 linprocfs on FreeBSD 5.x through 5.3, do not properly validate a process argument vector, which allows local users to cause a denial of service panic or read portions of kernel memory. NOTE: this candidate might be SPLIT into 2...

CVE-2004-1329

Untrusted execution path vulnerability in the diag commands 1 lsmcode, 2 diagexec, 3 invscout, and 4 invscoutd in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program...

CVE-2004-1328

Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges...

CVE-2004-1336

The xdvizilla script in tetex-bin 2.0.2 creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2004-0919

The syscons CONSSCRSHOT ioctl in FreeBSD 5.x allows local users to read arbitrary kernel memory via 1 negative coordinates or 2 large coordinates...

CVE-2004-1382

The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968...

CVE-2004-1781

Info Touch Surfnet kiosk allows local users to crash Surfnet and access the underlying operating system via the CMDCREDITCARDCHARGE command...

CVE-2004-1296

The 1 eqn2graph and 2 pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files...

CVE-2004-2605

aStats 1.6.5 allows local users to overwrite arbitrary files via a symlink attack on 1 the aStats-Graphic-Signature-Generation file and 2 certain PNG image files...

CVE-2004-2686

Directory traversal vulnerability in the vfsgetvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted 1 mount or 2 sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure...