Oracle E-Business Suite Applications Utilities vulnerability

Overview An unspecified vulnerability in the Oracle Applications Utilities may allow a remote, unauthenticated attacker to compromise system confidentiality and integrity. Description Oracle Applications Utilities is a component of the Oracle E-Business Suite. There is an vulnerability in the...

Oracle E-Business Suite Applications Technology Stack vulnerability

Overview An unspecified vulnerability in the Oracle Applications Technology Stack may allow a remote, unauthenticated attacker to compromise system confidentiality and integrity. Description Oracle Applications Technology Stack is a collection of Oracle products bundled with the Oracle E-Business...

Oracle Application Server SQL*ReportWriter vulnerability

Overview An unspecified vulnerability in the Oracle SQLReportWriter may allow a remote, unauthenticated attacker to compromise system confidentiality and integrity. Description Oracle SQLReportWriter is a component of the Oracle Application Server. There is an vulnerability in the Oracle...

Oracle Application Server Internet Directory vulnerability

Overview An unspecified vulnerability in the Oracle Internet Directory may allow a remote, unauthenticated attacker to compromise system confidentiality and integrity. Description Oracle Internet Directory provides directory services, such as LDAP support, for the Oracle Application Server. There...

Oracle Database Server buffer overflow in Security Component

Overview The Oracle Database Server Security Component contains a buffer overflow. Exploitation may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. Description A lack of input validation in the Oracle Database Server Security Component may allow a buffer...

Oracle Enterprise Manager Oracle Agent contains a buffer overflow

Overview Oracle Enterprise Manager Oracle Agent contains a buffer overflow vulnerability. Exploitation may allow a remote, unauthenticated attacker to execute arbitrary code, possibly with elevated privileges. Description The Oracle Agent provides remote management services for Oracle Enterprise...

Oracle products contain multiple vulnerabilities

Overview Multiple vulnerabilities exist in numerous Oracle products. The severity and impacts of these vulnerabilities are varied and may include remote execution of arbitrary code, the disclosure of sensitive information, and denial-of-service conditions. Description Multiple vulnerabilities exi...

Snort Back Orifice preprocessor buffer overflow

Overview A buffer overflow exists in the Snort Back Orifice preprocessor that may allow a remote, unauthenticated attacker to execute arbitrary code, possibly with elevated privileges. Description Snort is an open-source intrusion detection system IDS. A lack of validation on attacker-controlled...

UW-IMAP vulnerable to a buffer overflow

Overview UW-IMAP contains a buffer overflow vulnerability that may allow a remote, authenticated attacker to execute arbitrary code on a vulnerable system. Description The University of Washington IMAP Server UW-IMAP is an email server that uses the Internet Message Access Protocol lMAP. A lack o...

Microsoft BlnMgr Proxy (blnmgrps.dll) COM object fails to implement required methods

Overview The Microsoft BlnMgr Proxy COM object fails to implement the methods required by the IDispatch interface, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable...

Microsoft Windows FTP client does not properly validate received file names

Overview An input validation error in the Microsoft Windows FTP Client may allow a remote attacker to write files to arbitrary locations and may allow the execution of arbitrary code. Description The Microsoft Windows FTP Client does not properly validate the names of received files. If a remote...

VERITAS NetBackup Java Administration Console contains a format string vulnerability in "bpjava-msvc"

Overview The VERITAS NetBackup Java Administration Console contains a format string vulnerability, which may allow an unauthenticated, remote attacker to execute arbitrary code with root or SYSTEM privileges. Description The Java Administration Console is an alternative administrative interface f...

Microsoft Distributed Transaction Coordinator vulnerable to buffer overflow via specially crafted network message

Overview Microsoft Distributed Transaction Coordinator MSDTC may be vulnerable to a flaw that allows remote unauthenticated attackers to execute arbitrary code. Description The Microsoft Distributed Transaction Coordinator MSDTC is described by Microsoft as "distributed transaction facility for...

Microsoft Plug and Play fails to properly validate user supplied data

Overview Microsoft Plug and Play contains a flaw in message buffer handling that may result in local or remote arbitrary code execution or a denial-of-service condition. Description The following is from the Microsoft Plug and Play description: Plug and Play PnP allows the operating system to...

Microsoft Windows Shell fails to handle shortcut files properly

Overview Microsoft Windows Shell does not properly handle some shortcut files and may permit arbitrary code execution when a specially-crafted file is opened. Description Microsoft Windows supports files that point to another file, called "shortcut" files. These files have the .lnk extension, and...

Microsoft DirectShow buffer overflow

Overview A buffer overflow in Microsoft DirectShow may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft DirectShow is a programming architecture for streaming multimedia on the Microsoft Windows platform. An input validation error in...

Microsoft Collaboration Data Objects buffer overflow

Overview A buffer overflow in Microsoft Collaboration Data Objects may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Collaboration Data Objects CDO is a scripting library used to develop applications that handle email. Note that C...

Microsoft COM+ contains a memory management flaw

Overview Microsoft COM+ contains a vulnerability due to a memory management flaw that may allow an attacker to take complete control of an affected system. Description Microsoft gives the following definition of COM+: COM+ is the next step in the evolution of the Microsoft Component Object Model...

Symantec AntiVirus Scan Engine administrative interface contains a buffer overflow vulnerability

Overview Symantec AntiVirus Scan Engine administrative interface contains a remotely exploitatble buffer overflow that may allow an attacker to execute arbitrary code. Description The Symantec AntiVirus Scan Engine provides a programming interface to Symantec content scanning and virus detection...

Ruby safe-level security model bypass

Overview Ruby contains a vulnerability that may allow arbitrary code to be run without the intended safe-level checks being applied. Description Ruby is a object-oriented scripting language that supports execution of untrusted code with two mechanisms: taint flagging and safe levels. Safe levels...

Microsoft Jet Database Engine fails to properly validate Access database files

Overview A vulnerability in the Microsoft Jet database engine could allow a remote attacker to execute code of their choice on a vulnerable system. Description The Microsoft Jet Database Engine Jet provides data access functionality to a number of other Microsoft and many third party applications...

Ruby library contains vulnerable default value

Overview Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Description Ruby is vulnerable to an attack on applications using the XML-RPC services via XMLRPC.iPIMethods, due to an insecure default value in utils.rb. Any program or...

AIX "getconf" contains buffer overflow vulnerability

Overview IBM AIX getconf contains a buffer overflow vulnerability that may lead to arbitrary code execution. Description IBM AIX contains the getconf command that provides information about system configuration. An unspecified buffer overflow condition has been identified in getconf and may lead ...

Helix Player format string vulnerability

Overview Helix Player, and media players based on the Helix Player, contain a format string vulnerability that may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Helix Player is used to play various types of media files on UNIX systems. The Helix Media Playe...

Apple Mac OS X ImageIO fails to properly handle corrupt GIF files

Overview The Apple Mac OS X ImageIO framework contains a buffer overflow that may allow a remote attacker to execute arbitrary code. Description Apple ImageIO is an image processing framework that was introduced in OS X 10.4 Tiger. ImageIO is used by several applications, including WebCore and...

Clam AntiVirus contains a buffer overflow vulnerability

Overview A buffer overflow in Clam AntiVirus ClamAV may allow a remote attacker to execute arbitrary code. Description Clam AntiVirus is a UNIX-based, anti-virus toolkit often deployed with mail servers to detect malicious attachments. A signedness error in ClamAV libclamav/upx.c may allow a buff...

Apple Mac OS X QuickDraw Manager fails to properly handle corrupt PICT files

Overview Apple Mac OS X QuickDraw Manager contains a buffer overflow that may allow a remote attacker to execute arbitrary code. Description Apple Mac OS X QuickDraw is a 2D graphics library. It is used by several applications, including Safari, Mail, and Finder. QuickDraw is used to render PICT...

VERITAS StorageCentral DCOM servers contain multiple buffer overflows

Overview VERITAS StorageCentral DCOM servers contains several buffer overflows, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description VERITAS StorageCentral is software package that performs storage management. Multiple DCOM server components provided by...

Mozilla Firefox fails to properly sanitize user-supplied URIs via shell script

Overview A lack of input validation in a supplemental shell script included with some Mozilla browsers may allow a remote, unauthenticated attacker to execute arbitrary commands. Description The Linux versions of the Mozilla Firefox and Mozilla Suite web browsers include a wrapper shell script fo...

VERITAS Storage Exec DCOM servers contain multiple buffer overflows

Overview VERITAS Storage Exec contains several buffer overflows, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description VERITAS Storage Exec is software package that performs storage management. Multiple DCOM server components provided by Storage Exec...

unace buffer overflow vulnerability

Overview A buffer overflow in the unace compression library may allow a remote attacker to execute arbitrary code. Description The unace compression library is used to decompress ace archives .ace file extension. A lack of input validation on filenames in an ace archive may allow a buffer overflo...

TWiki does not properly sanitize URI parameters

Overview A lack of input validation in the TWiki revision control function may allow a remote, unauthenticated attacker to execute arbitrary commands. Description TWiki is a web-based collaborative publishing environment. TWiki does not sanitize user-controlled URI parameters supplied to the...

Check Point Firewall rules may improperly handle network traffic

Overview Check Point Firewall CIFS service group may allow unintended traffic to pass through the firewall. Description Check Point Firewall contains a set of predefined service groups designed to handle different types of traffic associated with a service or collection of protocols. For instance...

Multiple X servers fail to properly allocate memory for large pixmaps

Overview Multiple X Window System servers contain a pixmap memory allocation flaw that may allow local users to execute code with elevated privileges. Description Multiple X Window System server applications share code that may contain a flaw in the memory allocation for large pixmaps. The affect...

Mozilla-based browsers contain a buffer overflow in handling URIs containing a malformed IDN hostname

Overview A vulnerability in the way Mozilla products and derivative programs handle certain malformed URIs could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Mozilla products, including the Mozilla Suite, and Mozilla Firefox are vulnerable to a buffer...

mod_ssl fails to properly enforce client certificates authentication

Overview modssl, the Apache web server module for Secure Socket Layer SSL communications, may not properly authenticate client certificates. Description modssl provides Secure Socket Layer SSL communications for the Apache web server. SSL is designed to provide the ability to encrypt and...

Cisco IOS Firewall Authentication Proxy vulnerable to buffer overflow via specially crafted user authentication credentials

Overview A buffer overflow vulnerability in Cisco IOS Firewall Authentication Proxy may allow a remote unauthenticated attacker to execute arbitrary code or cause a denial of service. Description Cisco IOS Firewall Authentication Proxy is a feature that allows network administrators to apply...

DameWare Mini Remote Control vulnerable to buffer overflow via specially crafted authentication requests

Overview A vulnerability in DameWare Mini Remote Control may permit an unauthenticated attacker to execute arbitrary code on the system. Description DameWare Mini Remote Control is a lightweight remote control program intended primarily for administrators and help desks to manage desktop systems....

simpleproxy format string vulnerability

Overview A format string vulnerability in the simpleproxy TCP proxy may allow a remote attacker to execute arbitrary code on a vulnerable system. Description simpleproxy, a basic open source TCP proxy, contains a format string vulnerability in an unspecified HTTP proxy request handling routine. I...

UMN Gopher vulnerable to buffer overflow via overly long "+VIEWS:"

Overview The University of Minnesota Gopher client may be vulnerable to a buffer overflow when handling overly long "+VIEWS:" reply messages sent from a malicious server. Description The UMN Gopher suite includes a Gopher client for navigating Gopherspace. However, the Gopher client may incorrect...

Reflection for Secure IT Windows Server 6.0 changed case sensitivity of allow and deny lists

Overview Reflection for Secure IT Windows Server version 6.0 uses different case-sensitivity in evaluating the allow and deny lists as previous versions, potentionally allowing unintended access. Description Reflection for Secure IT Windows Server version 6.0, an SSH server from WRQ formerly know...

Reflection for Secure IT Windows Server can allow login to renamed built-in accounts

Overview WRQ Reflection for Secure IT Windows Server 6.0 can allow a user to login to a Windows built-in account with the default name Administrator and Guest after they are renamed. Description Microsoft Windows includes the built-in accounts Administrator and Guest. If those accounts are rename...

pam_ldap authentication bypass vulnerability

Overview An error in the pamldap password policy control may allow a remote attacker to gain access to a system. Description pamldap provides LDAP authentication services for UNIX-based systems. A vulnerability in pamldap may allow a remote attacker to bypass the authentication mechanism. If a...

Computer Associates Message Queuing software vulnerable to buffer overflows

Overview Computer Associates Message Queuing software contains buffer overflow conditions, which may allow a remote attacker to execute arbitrary code with elevated privileges. Description Computer Associates Message Queuing CAM / CAFT is a software component that provides messaging services. CAM...

Microsoft Internet Explorer can use any COM object

Overview Microsoft Internet Explorer IE will attempt to use COM objects that were not intended to be used in the web browser. This can cause a variety of impacts, such as causing IE to crash. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable softwar...

Microsoft DDS Library Shape Control (msdds.dll) COM object contains an unspecified vulnerability

Overview Microsoft DDS Library Shape Control COM object contains an unspecified vulnerability, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable software components...

Apple Mac OS X Server servermgrd authentication vulnerable to buffer overflow

Overview Apple Mac OS X Server servermgrd contains an unspecified buffer overflow vulnerability in the authentication handling routines. This vulnerability may lead to remote execution of arbitrary code. Description Mac OS X Server contains the servermgrd application for back-end management...

Apple Safari fails to perform security checks on links in rich text content

Overview Apple Safari fails to perform security checks on hyperlinks in rich text content, which may allow an attacker to execute arbitrary commands on a vulnerable system. Description Mac OS X includes the Safari web browser, which can display rich text RTF files directly. When Safari opens a ri...

Apple Mac OS X AppKit vulnerable to buffer overflow via the handling of maliciously crafted rich text files

Overview A buffer overflow vulnerability exists in a component of Apple's Mac OS X operating system that handles rich text files. Description The Cocoa Application Framework also referred to as the Application Kit, or AppKit is one of the core Cocoa frameworks supplied with Apple's Mac OS X...

Apple Mac OS X AppKit vulnerable to buffer overflow via maliciously crafted Microsoft Word files

Overview A buffer overflow vulnerability exists in a component of Apple's Mac OS X operating system that handles Microsoft Word files. Description The Cocoa Application Framework also referred to as the Application Kit, or AppKit is one of the core Cocoa frameworks supplied with Apple's Mac OS X...