Cisco IOS heap integrity checks are insufficient

Overview Cisco Internetwork Operating System IOS may allow a heap-based buffer overflow vulnerability to execute arbitrary code after bypassing heap integrity checks. Description Cisco IOS contains functionality for checking the integrity of the heap, which is a specific region in memory where da...

unace buffer overflow vulnerability

Overview A buffer overflow in the unace compression library may allow a remote attacker to execute arbitrary code. Description The unace compression library is used to decompress ace archives .ace file extension. A lack of input validation on filenames in an ace archive may allow a buffer overflo...

Reflection for Secure IT Windows Server can allow login to renamed built-in accounts

Overview WRQ Reflection for Secure IT Windows Server 6.0 can allow a user to login to a Windows built-in account with the default name Administrator and Guest after they are renamed. Description Microsoft Windows includes the built-in accounts Administrator and Guest. If those accounts are rename...

Computer Associates Message Queuing software vulnerable to buffer overflows

Overview Computer Associates Message Queuing software contains buffer overflow conditions, which may allow a remote attacker to execute arbitrary code with elevated privileges. Description Computer Associates Message Queuing CAM / CAFT is a software component that provides messaging services. CAM...

Microsoft MSN Messenger GIF processing buffer overflow

Overview MSN Messenger clients before version 7.0 will allow remote attackers to take control of a computer if malicious GIF files are processed. Description Microsoft MSN Messenger is an instant messaging application that allows users to collaborate with people using text messages, voice and vid...

WinAmp playlist handling may allow a remote buffer overflow and arbitrary code execution

Overview WinAmp contains a flaw which may allow a remote system compromise if a maliciously crafted playlist is loaded. Description Nullsoft's WinAmp is a multimedia system for Microsoft Windows. WinAmp allows users to create and use "playlists" to play their multimedia files in a customized...

Sun Java System Web Proxy Server vulnerable to buffer overflow

Overview Buffer overflow vulnerabilities in the Java System Web Proxy Server may allow remote attackers to execute arbitrary code or cause a denial-of-service condition. Description The Java System Web Proxy Server is a caching HTTP proxy server. A lack of bounds checking in the Java System Web...

Cisco IOS fails to properly handle malformed DHCP packets

Overview A denial-of-service vulnerability exists in Cisco's Internetwork Operating System IOS. This vulnerability may allow remote attackers to conduct denial-of-service attacks on an affected device. Description The Dynamic Host Configuration Protocol DHCP provides a means for distributing...

Microsoft Windows SMTP component vulnerable to remote code execution

Overview A vulnerability in the mail handling service in some versions of Microsoft Windows could allow a remote attacker to compromise the affected system. Description The Simple Mail Transfer Protocol SMTP is the most common protocol for the delivery of electronic mail between systems on the...

Mozilla Mail vulnerable to buffer overflow via "writeGroup()" function in "nsVCardObj.cpp"

Overview Mozilla Mail contains a vulnerability in the display routines for VCards. By sending an email message with a crafted VCard, a remote attacker may be able to execute arbitrary code on the victim's machine with the privileges of the current user. Description Mozilla Mail contains a stack...

Multiple memory leak vulnerabilities in isakmpd

Overview Multiple memory handling vulnerabilities exist in the isakmpd that could allow a remote attacker to cause a denial of service. Description The OpenBSD isakmpd establishes security associations for encrypted and authenticated IPsec network traffic. It implements the Internet Security...

MySQL fails to properly handle overly long "scramble" values

Overview There is a buffer overflow vulnerability in the way MySQL handles overly long "scramble" strings, which could allow an attacker to cause a denial of service or potentially execute arbitrary code. Description MySQL is an open-source database system available for Microsoft Windows, Linux,...

Gaim contains a buffer overflow vulnerability in the Extract Info Field function

Overview There is a buffer overflow vulnerability in the gaimmarkupextractinfofield function, which could allow an unauthenticated, remote attacker to cause a denial of service or execute arbitrary code. Description Gaim is a multi-protocol instant messenger client available for a number of...

BEA WebLogic Server fails to properly associate re-created groups

Overview WebLogic Server contains a vulnerability that could result in the creation of new groups inheriting the privileges of a previously deleted group if members of the deleted group still exist. Description BEA Systems describes WebLogic Server as "an industrial-strength application...

Sun Solaris contains a vulnerability in the tcsetattr() library function

Overview A vulnerability in the Sun Solaris tcsetattr library function could allow a unprivileged local user to cause the system to hang. Description Sun Solaris uses a tcsetattr library function to set the parameters associated with the terminal. There is an unspecified vulnerability in the...

Microsoft Windows Media Services fails to properly validate TCP requests

Overview Microsoft Windows Media Services fails to properly validate TCP requests which could allow a remote, unauthenticated attacker to cause the services to refuse new TCP connections. Description Microsoft Windows Media Services is an optional component that provides the ability to deliver...

Oracle9i Database contains buffer overflow in TIME_ZONE session parameter

Overview Oracle9i Database contains a buffer overflow in the TIMEZONE session parameter which could allow anyone who can query the server to execute arbitrary code or access data with the privileges of the vulnerable process. Description The TIMEZONE parameter is a session parameter that specifie...

Multiple Real media players vulnerable to buffer overflow when parsing crafted media files

Overview Multiple Real media players vulnerable to buffer overflow when parsing certain media files which may permit an attacker to execute arbitrary code on the user's system. Description RealNetworks Real media players are multimedia applications that allow users to view local and remote...

OpenSSL accepts unsolicited client certificate messages

Overview OpenSSL accepts unsolicited client certificate messages. This could allow an attacker to exploit underlying vulnerabilities in client certificate handling. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols and includes a general-purpos...

WS_FTP Server vulnerable to buffer overflow when supplied overly long "STAT" command

Overview It has been reported that a vulnerability exists in the processing of a "STAT" command on WSFTP Servers versions 4.x and prior. Exploitation of this vulnerability may lead to an authenticated user executing arbitrary code with the elevated privileges of the server process. Description...

Sendmail fails to appropriately initialize data structures for DNS maps

Overview There is an uninitialized data structure in sendmail 8.12.x rrdomain = smstrduphost; \t\tif rr-rrdomain == NULL \t\t A fix for this condition was made in sendmail 8.12.9 in March 2003, but it was not known to be a security issue at that time. --- Impact A remote attacker may be able to...

Lotus Domino Web Server vulnerable to buffer overflow via non-existent "h_SetReturnURL" parameter with an overly long "Host Header" field

Overview Lotus Domino Web Server is an application that provides access to Lotus Notes databases via HTTP requests. A vulnerability exists that could permit a remote attacker to execute arbitrary code on the server. Description Lotus Domino Web Server contains a vulnerability in the nhttp.exe...

Lotus Notes and Domino COM Object Control Handler contains buffer overflow

Overview Lotus Notes is a client application that provides access to Lotus Domino servers. A vulnerability exists that could permit a remote attacker to cause a user to execute arbitrary code. Description A buffer overflow vulnerability exists in the in both Lotus Notes clients and Domino Servers...

Hyperseek 2000 hsx.cgi does not adequately filter user input disclosing directory listings and file contents

Overview iWeb Systems Hyperseek search engine may allow malformed URL requests to access files outside the document root of a vulnerable system. Description A specially crafted URL can disclose the directory listing and files of the target system with read permissions. --- Impact Remote attackers...

Multiple FTP clients contain directory traversal vulnerabilities

Overview Multiple File Transfer Protocol FTP clients contain directory traversal vulnerabilities that allow a malicious FTP server to overwrite files on the client host. Description In a typical file transfer operation, one participant the client requests a file while a second participant the...

Pine MUA contains buffer overflow in addr_list_string()

Overview Pine is a mail user agent MUA written and distributed by the University of Washington. Some versions contain a buffer overflow vulnerability in email address handling. Description Versions of Pine prior to 4.50 contain a remotely exploitable buffer overflow in the addrliststring function...

Multiple Sun RPC-based libc implementations fails to provide time-out mechanism when reading data from TCP connections

Overview A denial-of-service vulnerability exists in multiple vendor Sun RPC-based libc implementations. Description Multiple vendor Sun RPC-based libc implementations fail to properly read data from TCP connections. As a result, a remote attacker can deny service to system daemons. --- Impact A...

Savant Web Server has a buffer overflow vulnerability

Overview Savant Web Server has a buffer overflow vulnerability in handling of the HTTP 1.1 Host header. Description Savant Web Server has a buffer overflow vulnerability in handling of the HTTP 1.1 Host header. HTTP requests with long Host headers will cause Savant to crash. --- Impact Remote...

Apache mod_dav module vulnerable to DoS

Overview A denial-of-service vulnerability exists in Apache moddav. Description moddav is an Apache module. This module enables Apache web servers to provide users the ability to edit and manage files on a remote web server using the HTTP protocol. A vulnerability in moddav may allow an attacker ...

Easynews does not adequately validate user input thereby disclosing server installation path via crafted URL request

Overview Easynews does not adequately validate user input. Attackers may exploit this vulnerability to learn the filesystem path where the script is installed. Description Easynews is an open-source CGI script designed to create dynamic news story web pages and listings. Easynews does not properl...

Multiple vendors' email content/virus scanners do not adequately check "message/partial" MIME entities

Overview Email anti-virus scanners and content filters from multiple vendors do not adequately check messages containing "message/partial" MIME entities RFC 2046. As a result, viruses, malicious code, or other restricted content may not be detected. Description Section 5.2.2 of RFC 2046 defines t...

Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via HTTP Location header

Overview A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language PL/SQL module used by Oracle9i Application Server iAS. This vulnerability could allow an unauthenticated remote attacker to cause a denial of service or execute arbitrary code on the system...

AOL Instant Messenger buffer overflow in screename

Overview A buffer overflow exists in the AOL Instant Messenger AIM client versions 3.5.x and prior when accepting the screenname from the command line, or through the aim protocol. Description AIM installs a protocol on the machine that enables people to post links on their websites, or send them...

Compaq Tru64 Unix inetd vulnerable to DoS

Overview The inetd service on Compaq's Tru64 UNIX is vulnerable to a denial-of-service. Description The inetd service on Compaq's Tru64 UNIX V5.1 all patch levels is vulnerable to a denial-of-service attack in which inetd will stop accepting new connections. In turn, this would disrupt the normal...

OpenSSH fails to properly apply source IP based access control restrictions

Overview OpenSSH is an implementation of the Secure Shell protocol. A user may be able to bypass the IP based access control restriction feature specified in a key when two keys of varying types are specified. Description Versions of OpenSSH between 2.5.x - 2.9.x may fail to enforce the IP based...

RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 do not properly handle URL encoded characters in URL

Overview RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 contain a vulnerability in which the ACE/Agent does not properly handle URL encoded characters contained in a URL. A specially crafted request may bypass authentication and expose the contents of...

Microsoft Windows 2000 Telnet Service fails to reject oversized username input values

Overview The Microsoft Windows 2000 Telnet Service contains a denial-of-service vulnerability that allows remote attackers to disrupt the telnet service on affected servers. Description The Microsoft Windows 2000 Telnet Service contains a vulnerability in the section of code that performs range...

Critical Path directory products contain multiple vulnerabilities in LDAP handling code

Overview Multiple Critical Path directory products contain vulnerabilities that may allow denial-of-service attacks, unauthorized privileged access, or both. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses th...

Dallas Semiconductor iButton DS1991 vulnerable to dictionary attack

Overview The Dallas Semiconductor iButton DS1991 is vulnerable to a dictionary attack, allowing an intruder to recover passwords. Description The Dallas Semiconductor iButton DS1911 stores 1 kilobyte of data in 3 separate password-protected areas. It includes functionality intended to prevent...

NewsDaemon does not adequately filter user input to $user_username

Overview NewsDaemon prior to version 0.21b contains a vulnerability allowing remote attackers to gain administrative access to the web site. Description NewsDaemon is a PHP-based tool used to allow readers to submit and comments on news items and stories over the web. It also allows for...

SystemWizard Launch ActiveX Control lacks authentication

Overview Description The SystemWizard "Launch" ActiveX Control may allow attackers to execute arbitrary commands on systems where the control is installed. This control was shipped on HP Pavilion computers running Windows 98, as part of a diagnostic application named "SystemWizard" produced by...

ADK flaw in recent versions of PGP

Overview Additional Decryption Keys ADKs is a feature introduced into PGP Pretty Good Privacy versions 5.5.x through 6.5.3 that allows authorized extra decryption keys to be added to a user's public key certificate. However, an implementation flaw in PGP allows unsigned ADKs which have been...

Microsoft WinRE allows for bypass of UEFI/BIOS password enforcement

Overview Microsoft Windows Recovery Environment WinRE provides a mechanism for recovering and repairing Windows systems using an alternate boot environment. Under certain platform implementations, access to WinRE may allow an attacker to bypass firmware security controls, including...

Collibra Agent contains improper authentication and path traversal vulnerabilities

Overview The Collibra Platform Agent contains vulnerabilities that can be chained by a remote, unauthenticated attacker to achieve remote code execution. An attacker can exploit these issues by uploading a crafted ZIP archive that writes attacker-controlled files to arbitrary locations on the...

Radware Alteon has a reflected XSS vulnerability that can execute JavaScript in the host browser

Overview Radware Alteon has a reflected Cross-Site Scripting XSS vulnerability in the parameter ReturnTo of the route /protected/login. This vulnerability allows an attacker to execute JavaScript in the host browser. Description CVE-2026-5754: Reflected Cross-Site Scripting XSS vulnerability in...

Little CMS 2 DefaultICCintents double-free vulnerability

Overview Little CMS 2 contains a double-free vulnerability in the DefaultICCintents function, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Little CMS is an open-source color management engine that supports the International Color...

AppsGeyser generates Android applications that fail to properly validate SSL certificates

Overview AppsGeyser generates applications that fail to properly validate SSL certificates. Description AppsGeyser is an online tool that generates Android applications. At the time of publication of this vulnerability note, the AppsGeyser website claims to have generated over 1.3 million Android...

Kaseya's agent driver contains NULL pointer dereference

Overview Kaseya's agent driver, kapfa.sys, is vulnerable to a NULL pointer dereference. Description CWE-476: NULL Pointer Dereference Kaseya's agent driver, kapfa.sys, is vulnerable to a NULL pointer dereference. --- Impact A local authenticated attacker may be able to cause a denial-of-service...

Webmin contains a cross-site scripting vulnerability

Overview Webmin 1.670, and possibly earlier versions, contains a cross-site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Webmin 1.670, and possibly earlier versions, contains a cross-site scripting vulnerability in...

DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust

Overview DomainKeys Identified Mail DKIM Verifiers may inappropriately convey message trust when messages are signed using keys that are too weak 1024 bits or that are marked as test keys. Description RFC 6376 states "DomainKeys Identified Mail DKIM permits a person, role, or organization to clai...