Lucene search
+L
CertMost viewed

3716 matches found

CERT
CERT
added 2005/04/20 12:0 a.m.30 views

sendfile() system call may leak sections of kernel memory

Overview The sendfile system call does not handle specially crafted files properly. Exploitation of this vulnerability may leak sensitive information to a local attacker. Description The sendfile system call is used to send a file through a socket without copying the file data into memory. A...

10CVSS5.5AI score0.02268EPSS
SaveExploits0References1
CERT
CERT
added 2005/04/13 12:0 a.m.30 views

Microsoft Object Management DoS Vulnerability

Overview Microsoft Object Management code has a buffer overflow vulnerability that can cause a system to reboot. Description A buffer overflow vulnerability in Microsoft Object Management code exists that could be attacked by sending specially crafted requests locally on an affected operating...

2.1CVSS6.4AI score0.02067EPSS
SaveExploits0References1
CERT
CERT
added 2005/02/08 12:0 a.m.30 views

Microsoft License Logging Service buffer overflow

Overview A vulnerability in a component of some server versions of Microsoft Windows could allow a remote attacker to execute code on a vulnerable system. Description Microsoft's License Logging Service LLS assists in the management of licenses for some Microsoft server products. An error in the...

10CVSS7.4AI score0.46691EPSS
SaveExploits1References1
CERT
CERT
added 2005/01/14 12:0 a.m.30 views

Veritas Backup Exec registration request buffer overflow

Overview Certain versions of Veritas Backup Exec 8.x and 9.x can be remotely exploited to allow execution of arbitrary code on affected servers. Description A buffer overflow exists in Veritas Backup Exec 8.x prior to 8.60.3878 Hotfix 68, and 9.x pritor to 9.1.4691 Hotfix 40. A stack-based buffer...

10CVSS7.5AI score0.81791EPSS
SaveExploits8References12
CERT
CERT
added 2004/11/23 12:0 a.m.30 views

Microsoft Windows Shell contains a buffer overflow

Overview A remotely exploitable buffer overflow vulnerability exists in the Microsoft Windows Shell. Description The Microsoft Windows Shell provides the basic human-computer interface for Windows systems. Microsoft describes the Shell as follows: The Windows Shell is responsible for providing th...

10CVSS7.5AI score0.46978EPSS
SaveExploits1References2
CERT
CERT
added 2004/11/12 12:0 a.m.30 views

Archive::Zip may not properly parse the file sizes of Zip archives

Overview Archive::Zip does not properly parse Zip files and may incorrectly interpret malformed zip archives to contain zero length/size files. As a a result, anti-virus software using Archive::Zip may fail to detect malicious content within a Zip archive. Description The Archive::Zip module allo...

7.9AI score
SaveExploits0References3
CERT
CERT
added 2004/11/03 12:0 a.m.30 views

Microsoft Internet Explorer vulnerable to buffer overflow via FRAME and IFRAME elements

Overview Microsoft Internet Explorer IE contains a buffer overflow vulnerability that can be exploited to execute arbitrary code with the privileges of the user running IE. Description A heap buffer overflow vulnerability exists in the way IE handles the SRC and NAME attributes of HTML elements...

10CVSS6.4AI score0.67061EPSS
SaveExploits5References12
CERT
CERT
added 2004/09/16 12:0 a.m.30 views

star fails to set proper permissions on programs specified in RSH environment variable

Overview Star can call external programs specified by the RSH environment variable. This may permit a malicious local user to gain elevated privileges. Description Star is a tape archiving program similar to tar. Star permits the use of storage devices on remote machines via an access program on...

7.2CVSS6.9AI score0.00433EPSS
SaveExploits0References2
CERT
CERT
added 2004/08/27 12:0 a.m.30 views

Integer underflow vulnerability in isakmpd "Certificate Request Payload" handling

Overview A vulnerability exists in the isakmpd that could allow a remote attacker to cause a denial of service. Description The OpenBSD isakmpd establishes security associations for encrypted and authenticated IPsec network traffic. It implements the Internet Security Association and Key Manageme...

10CVSS6.6AI score0.04604EPSS
SaveExploits0
CERT
CERT
added 2004/08/02 12:0 a.m.30 views

Check Point VPN-1 products contain boundary error in the ASN.1 decoding library

Overview A vulnerability exists in Check Point's VPN-1 Server, which is included in many Check Point products. This vulnerability may permit a remote attacker to compromise the gateway system. Description Check Point VPN-1 Server is a Virtual Private Network VPN application. A buffer overflow...

7.5CVSS6.6AI score0.05947EPSS
SaveExploits0References4
CERT
CERT
added 2004/06/16 12:0 a.m.30 views

BGP implementations do not adequately handle malformed BGP OPEN and UPDATE messages

Overview Multiple implementations of the Border Gateway Protocol BGP contain vulnerabilities related to the processing of UPDATE and OPEN messages. The impacts of these vulnerabilities appear to be limited to denial of service. Description BGP RFC 1771 is designed to exchange network reachability...

4.3CVSS7.2AI score0.0302EPSS
SaveExploits0References6
CERT
CERT
added 2004/06/09 12:0 a.m.30 views

Perl vulnerable to buffer overflow in win32_stat()

Overview A flaw in a standard function in some Perl distributions could allow an attacker to execute arbitrary code on the vulnerable system. Description The stat Perl function, similar to the standard C stat function, returns a list giving the status info for a file. Since the stat function is...

10CVSS7.3AI score0.0686EPSS
SaveExploits0References1
CERT
CERT
added 2004/05/03 12:0 a.m.30 views

Apple QuickTime contains an integer overflow in the "QuickTime.qts" extension

Overview Apple QuickTime contains an integer overflow vulnerability in the "QuickTime.qts" extension, which could result in arbitrary code execution. Description Apple's QuickTime Player is a player that allow users to view local and remote audio/video content. Other applications, such as web...

5.1CVSS7.3AI score0.03243EPSS
SaveExploits0References5
CERT
CERT
added 2004/03/25 12:0 a.m.30 views

Ethereal IrDA dissector plugin fails to properly parse IRCOM_PORT_NAME parameter

Overview Ethereal contains a vulnerability in the way the Infrared Data Association IrDA dissector plugin parses the IRCOMPORTNAME parameter. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing IrDA data. There is a vulnerability in the...

5CVSS7.4AI score0.67092EPSS
SaveExploits2References4
CERT
CERT
added 2003/12/10 12:0 a.m.30 views

Multiple web-based email services fail to filter malicious characters when the message contains cascading style sheet character escaping

Overview An attacker can send a specially crafted email message to a victim containing malicious scripting JavaScript, VBScript, JScript, etc., active content, or potentially HTML. When a victim views the message with scripting enabled, the victim's browser will then interpret this javascript whi...

6.3AI score
SaveExploits0References1
CERT
CERT
added 2003/10/10 12:0 a.m.30 views

Microsoft Windows fails to properly validate buffer size of incoming SMB packets

Overview Microsoft's implementation of Server Message Block SMB contains a buffer overflow vulnerability that could permit a remote attacker to execute arbitrary code or cause a denial of service. Description SMB and the Common Internet File System CIFS are closely related protocols used sharing...

7.5CVSS7.8AI score0.3465EPSS
SaveExploits0References6
CERT
CERT
added 2003/10/09 12:0 a.m.30 views

Hummingbird CyberDOCS sets insecure permissions on script source code files

Overview Hummingbird CyberDOCS running on Microsoft Internet Information Services IIS sets insecure permissions on script source code files. A remote attacker could read the contents of unprotected files. Description Hummingbird CyberDOCS Hummingbird DM is a web-based enterprise document manageme...

7.4AI score
SaveExploits0References1
CERT
CERT
added 2003/09/15 12:0 a.m.30 views

MySQL fails to validate length of password field

Overview A vulnerability in MySQL could permit a malicious user to execute arbitrary code on the system. Description MySQL is a database system. MySQL contains a buffer overflow vulnerability in the processing of the password field of the MySQL database, specifically "SET PASSWORD". A malicious...

9CVSS7.2AI score0.78367EPSS
SaveExploits3References2
CERT
CERT
added 2003/09/10 12:0 a.m.30 views

Microsoft Windows RPCSS Service contains heap overflow in DCOM activation routines

Overview There is a remote buffer overflow in many versions of Microsoft Windows that allows attackers to execute arbitrary code with system privileges. Description The Microsoft RPCSS Service is responsible for managing Remote Procedure Call RPC messages and is enabled by default on many version...

10CVSS8.1AI score0.40348EPSS
SaveExploits0References13
CERT
CERT
added 2003/08/21 12:0 a.m.30 views

Cisco Secure PIX Firewall TCP Reset Vulnerability

Overview A vulnerability in Cisco's Secure PIX Firewall may allow a remote attacker to reset arbitrary TCP sessions. Description Cisco describes the Secure PIX Firewall as, "an easy-to-install, integrated hardware/software firewall appliance". A vulnerability in the Secure PIX Firewall may allow ...

5CVSS6.5AI score0.09181EPSS
SaveExploits1References2
CERT
CERT
added 2003/08/19 12:0 a.m.30 views

Hewlett-Packard Company MPE/iX FTPSRVR does not properly validate certain commands

Overview A vulnerability in the FTP server included with the MPE/iX operating system may allow a remote attacker to gain unauthorized access. Description MPE/iX is an operating system produced by Hewlett-Packard Company. The FTP server included with MPE/iX FTPSRVR contains a vulnerability which m...

7.5CVSS6.5AI score0.02818EPSS
SaveExploits0References2
CERT
CERT
added 2003/07/24 12:0 a.m.30 views

Microsoft SQL Server vulnerable to buffer overflow

Overview Microsoft SQL Server contains a buffer overflow vulnerability. A local attacker could leverage this vulnerability to gain elevated privileges and/or execute arbitrary code. Description Quoting from Microsoft Security Bulletin MS03-031:A flaw exists in a specific Windows function that may...

7.2CVSS7.7AI score0.04126EPSS
SaveExploits1References12
CERT
CERT
added 2003/04/16 12:0 a.m.30 views

Heap overflow in Snort "stream4" preprocessor

Overview The Snort "stream4" preprocessor module contains a vulnerability that allows remote attackers to execute arbitrary code with the privileges of the user running Snort, typically root. Description Researchers at CORE Security Technologies have discovered a remotely exploitable heap overflo...

7.9AI score
SaveExploits0References4
CERT
CERT
added 2003/03/21 12:0 a.m.30 views

Buffer Overflow in SGI IRIX syslogd

Overview A remotely exploitable buffer overflow in SGI IRIX syslogd may allow an attacker to crash syslogd or execute arbitrary code. Description There is a remotely exploitable buffer overflow in SGI IRIX syslogd. For more detailed information please see SGI Security Advisory 20020405-01-I. ---...

5CVSS7.6AI score0.01348EPSS
SaveExploits0References2
CERT
CERT
added 2002/10/11 12:0 a.m.30 views

Microsoft Java implementation JDBC classes do not properly validate DLL requests

Overview The Java Database Connectivity JDBC classes of Microsoft's Java virtual machine VM do not properly validate DLL requests, allowing a malicious applet to load and execute any DLL on the client system. Description Microsoft's Java VM is installed on Windows 98, NT, 2000, and XP. It is used...

7.5CVSS6.3AI score0.41356EPSS
SaveExploits1References2
CERT
CERT
added 2002/09/27 12:0 a.m.30 views

Microsoft Windows 2000 Indexing Services enumerates local file locations via ixsso.query ActiveX object

Overview Index Server 2.0 and the Indexing Service 3.0 contain a vulnerability that may allow remote intruders to gain information about files on the local computer. Description Index Server 2.0 and Indexing Service 3.0 are services that allow information about local files to be queried via a web...

4.3CVSS6.3AI score0.10849EPSS
SaveExploits2References3
CERT
CERT
added 2002/09/27 12:0 a.m.30 views

Microsoft Windows Media Player buffer overflow in Active Stream Redirector (.asx) file parser

Overview There is a buffer overflow in the parsing of Active Stream Redirector .ASX files. This buffer overflow may allow a remote attacker to execute arbitrary code when a user views a malicious web page. Description There is a buffer overflow in the processing of Active Stream Redirector .ASX...

7.5CVSS7.6AI score0.30017EPSS
SaveExploits1References3
CERT
CERT
added 2002/09/18 12:0 a.m.30 views

Entrust GetAccess does not validate user input thereby allowing users to read arbitrary files

Overview Entrust GetAccess does not properly validate the CGI variable "LOCALE" and may be exploited to read arbitrary files on the server. Description Entrust GetAccess is a web software product for identifying users of a web site. Entrust GetAccess takes a CGI variable named "LOCALE" specifying...

7AI score
SaveExploits0References1
CERT
CERT
added 2002/08/15 12:0 a.m.30 views

OpenBSD contains buffer overflow in "select" call

Overview A locally exploitable buffer overflow exists in all versions of OpenBSD. Description The buffer overflow exists in the select2 system call. The overflow occurs if select is supplied with arbitrary negative values. --- Impact Local users can gain system privileges and execute code in the...

7.2CVSS7AI score0.0033EPSS
SaveExploits0References2
CERT
CERT
added 2002/07/27 12:0 a.m.30 views

Microsoft SQL Server installation process leaves sensitive information on system

Overview Microsoft SQL server versions 7.0 and 2000, as well as MSDE 1.0, may leave installation and log files on the server after the installation process is complete. These files may contain senstitive information such as passwords used during the install. Users with authenticated access to the...

4.6CVSS6.2AI score0.01697EPSS
SaveExploits0References6
CERT
CERT
added 2002/07/13 12:0 a.m.30 views

Microsoft Windows 2000 Network Dynamic Data Exchange (DDE) executes code as Local System

Overview The Windows 2000 Network DDE agent permits local users to execute commands with system privileges. Description Dynamic Data Exchange DDE is an interprocess communication mechanism used in Microsoft Windows. A DDE share is an area of memory which is used to store and retrieve data. Networ...

7.2CVSS6.8AI score0.03182EPSS
SaveExploits1References5
CERT
CERT
added 2002/06/27 12:0 a.m.30 views

Multiple Cisco products consume excessive CPU resources in response to large SSH packets

Overview Multiple Cisco networking products contain a denial-of-service vulnerability. Description Multiple Cisco networking products contain a vulnerability that allows large SSH packets to cause excessive consumption of CPU resources. In some circumstances, this resource consumption may cause t...

7.1CVSS6.5AI score0.03297EPSS
SaveExploits0References5
CERT
CERT
added 2002/05/29 12:0 a.m.30 views

Quake II Server performs console variable expansion on client-supplied input values

Overview The Quake II Server contains an information leakage vulnerability that allows remote attackers to gain control of the game server process. Description The Quake II Server responds to console commands from Quake II clients to perform a variety of game and server management functions. Both...

5CVSS7AI score0.05526EPSS
SaveExploits1References3
CERT
CERT
added 2002/03/15 12:0 a.m.30 views

XDMCP leaks sensitive information by default configuration

Overview An information leakage vulnerability exists in the default configuration of the X Display Management Console Protocol XDMCP daemon. Description On some operating systems, the X Display Manager Control Protocol XDMCP daemon is set to permit remote access to the local machine from any host...

10CVSS6.2AI score0.04197EPSS
SaveExploits0References5
CERT
CERT
added 2002/02/26 12:0 a.m.30 views

Oracle 9i Database Server PL/SQL module allows remote command execution without authentication

Overview Oracle Database Server allows remote users to execute system commands without authenticating. Description Oracle Database Server provides extended functionality through the use of Procedural Language/Structured Query Language PL/SQL libraries. PL/SQL includes commands to load arbitrary...

7.5CVSS7.2AI score0.08739EPSS
SaveExploits0References4
CERT
CERT
added 2001/12/13 12:0 a.m.30 views

Hot Standby Router Protocol (HSRP) uses weak authentication

Overview A denial-of-service vulnerability exists in the Hot Standby Router Protocol HSRP . Description HSRP is a protocol designed to provide transparent recovery of routing services when failures occur. Quoting from RFC2281 the RFC describing the Hot Standby Router Protocol:The Hot Standby Rout...

2.1CVSS6.2AI score0.01326EPSS
SaveExploits2References6
CERT
CERT
added 2001/12/08 12:0 a.m.30 views

Oracle Database Server vulnerable to DoS via repeated requests to Oracle listener without connecting to redirected port

Overview Oracle Database Server may consume all available memory and crash if clients do not connect completely in the expected manner. Description When a connection request is made to Oracle for Windows NT, Oracle Database Server creates a new thread listening on a new port and redirects the...

5CVSS5.9AI score0.03463EPSS
SaveExploits0References3
CERT
CERT
added 2001/11/15 12:0 a.m.30 views

BSCW vulnerable to arbitrary file overwriting via symlink redirection of temporary file

Overview BSCW is a groupware system that runs on a web server. BSCW follows symbolic links in tar files that it extracts into a user's local area. Accessing those links may allow the user to view arbitrary files viewable by the web server, and to overwrite files writable by the web server...

6.4CVSS6.2AI score0.02025EPSS
SaveExploits0References5
CERT
CERT
added 2001/11/15 12:0 a.m.30 views

Cisco IOS and CatOS fail to properly validate ARP packets thereby overwriting device's MAC address in ARP table

Overview There is a denial-of-service vulnerability in specific versions of Cisco IOS or CatOS. Description A denial-of-service vulnerability exists in specific versions of Cisco IOS or CatOS. This vulnerability can cause the device to crash or become unavailable if specially crafted arp packets...

6.7AI score
SaveExploits0References2
CERT
CERT
added 2001/11/08 12:0 a.m.30 views

shadow-utils useradd creates temporary files insecurely

Overview Shadow-utils is an encryption and account management package freely distributed for many Linux implementations. The useradd program in this package creates insecure temporary files with predictable names in a write-protected directory. If this directory is changed to be writable, an...

1.2CVSS6.3AI score0.00298EPSS
SaveExploits0References3
CERT
CERT
added 2001/10/08 12:0 a.m.30 views

Redhat Linux diskcheck.pl creates predictable temporary file and fails to check for existing symbolic link of same name

Overview Diskcheck.pl is a PERL script, part of Red Hat's powertools suite, that alerts a system administrator if any file system approaches capacity. In creating email alerts, diskcheck.pl creates insecure temporary files in a world-writable directory, which may permit an attacker to corrupt any...

2.1CVSS6AI score0.00414EPSS
SaveExploits0References2
CERT
CERT
added 2001/05/30 12:0 a.m.30 views

KDE KFM creates temporary files insecurely

Overview KDE's kfm creates and uses temporary cache directories insecurely. Description kfm, the KDE File Manager, creates a cache directory for each user. This directory is placed in /tmp and predictably named, based on the UID. These directories are created without checking for correct ownershi...

4.6CVSS6.6AI score0.00562EPSS
SaveExploits1References1
CERT
CERT
added 2001/05/04 12:0 a.m.30 views

Sun Solaris mailx contains buffer overflow via -F option

Overview A buffer overflow in the mailx program on Solaris systems can allow an intruder to execute code with the privileges of the mail group. Description A buffer overflow in the -F option of the mailx program on Solaris systems may allow an intruder to execute code with the privileges of the...

4.6CVSS7AI score0.01282EPSS
SaveExploits3
CERT
CERT
added 2001/03/27 12:0 a.m.30 views

Unauthentic "Microsoft Corporation" certificates issued by Verisign to an unidentifed person

Overview On January 29 and 30, 2001, VeriSign, Inc. issued two certificates to an individual fraudulently claiming to be an employee of Microsoft Corporation. Any code signed by these certificates will appear to be legitimately signed by Microsoft when, in fact, it is not. Although users who try ...

7AI score
SaveExploits0References4
CERT
CERT
added 2001/01/29 12:0 a.m.30 views

ISC BIND 4 contains input validation error in nslookupComplain()

Overview The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS by the Internet Software Consortium ISC. There is a format string vulnerability in BIND 4.9.4 that may allow remote intruders to gain access to systems running BIND. Although BIND 4.9.x is no longer...

10CVSS7.4AI score0.10751EPSS
SaveExploits0References3
CERT
CERT
added 2001/01/18 12:0 a.m.30 views

HP-UX kermit contains local buffer overflow that allows denial-of-service

Overview The HP-UX version of kermit contains a buffer overflow that allows local users to prevent other users from running kermit. Description Kermit is a file transfer protocol that has been implemented by Hewlett-Packard for use on their systems. On December 21, 2000, HP released a security...

7.2CVSS6.6AI score0.00619EPSS
SaveExploits0References1
CERT
CERT
added 2000/12/12 12:0 a.m.30 views

Sun Microsystems Keys exposed and revoked

Overview Sun Microsystems uses a variety of X.509 keys signed by VeriSign to securevarious web sites. Among these certificates are two that were revoked on October 19, 2000. The certificate IDs for these revoked certificates are 3181 B12D C422 5DAC A340 CF86 2710 ABE6 and 1705 FB13 A22F 9AF3 C130...

5.1CVSS6.7AI score0.00866EPSS
SaveExploits0References1
CERT
CERT
added 2000/10/31 12:0 a.m.30 views

Wang/Kodak Image Scan ActiveX Control

Overview Description The Image Admin control is incorrectly marked safe for scripting. This control is sometimes identified as from "Kodak" and other times as from "Wang". The Image Admin control is one of several controls used to provide image editting services through a web site. Because the...

10CVSS6.2AI score0.24429EPSS
SaveExploits1References2
CERT
CERT
added 2025/12/17 12:0 a.m.29 views

Vulnerability in UEFI firmware modules prevents IOMMU initialization on some UEFI-based motherboards

Overview A newly identified vulnerability in some UEFI-supported motherboard models leaves systems vulnerable to early-boot DMA attacks across architectures that implement UEFI and IOMMU. Although the firmware indicates that DMA protection is active, it fails to correctly initialize the IOMMU...

7CVSS7.1AI score0.0033EPSS
SaveExploits0References7
CERT
CERT
added 2016/06/23 12:0 a.m.29 views

Alertus Desktop Notification for OS X sets insecure permissions for configuration and other files

Overview Alertus Desktop Notification for OS X, version 2.9.30.1700 and earlier, sets insecure permissions for configuration and other files, which may enable an unprivileged attacker to disable notifications and modify content locally. Description CWE-276: Incorrect Default Permissions -...

4.4CVSS4.7AI score0.00621EPSS
SaveExploits0References2
Total number of security vulnerabilities3716