ARC-001|FrontPage|2006-05-01|7.0|High|The FrontPage extensions provide a facility for the author and the administrator to manage the web server content.  However, author.dll and/or adin.dll were determined to accessible by the world.  This provides a clear vector for brute force password guessing attacks on the web server.||remote
ARC-002|Generic|2006-05-01|7.0|High|The HTTP PUT command is enabled which may allow an attacker to overwrite files on a web server|Juniper;www.juniper.net/security/auto/vulnerabilities/vuln2238.html;www.juniper.net/security/auto/vulnerabilities/vuln2238.html|remote
ARC-003|Generic|2006-05-01|10.0|High|Arbitrary files can be read and possibly executed.  This vulnerability is different than CVE-200-0884 or CVE-2000-0921.||remote
ARC-004|Generic|2006-05-01|6.0|Medium|An open WWW proxy can be used by an malicious user to to attack another system to hide the true source of the attack. It would appear that the open proxy was the source of the attack.||remote
ARC-005|Generic|2006-05-01|10.0|High|The service mentioned in the vulnerability can be accessed by the specified user with a weak password.  Services may include telnet, ssh, pop3, and imap. ||remote
ARC-006|Generic|2006-05-01|3.0|Low|The login service mentioned in the vulnerability does not have a restrictive login banner.  A restrictive login may provide some legal protection in litigation cases.||remote
ARC-007|Generic|2006-05-01|2.0|Low|The service mentioned in the vulnerability, in most cases, does not add to the functionality of the system but can assist a malicious user in attacking the system.||remote
ARC-008|Generic|2006-05-01|7.0|High|An open outgoing modem has been detected.  The modem could be used by a malicious user to attack other systems via war dialing attacks.||remote
ARC-009|Generic|2006-05-01|3.0|Low|A remote control service, such as VNC or Timbukto has been detected.  In many cases poor or blank passwords are used with these servers.  The administrator of the system should confirm that 'good' passwords protect these servers.||remote
ARC-010|Any MYSQL Server|2006-05-01|8.0|High|The 'mysql' user does not have a password on the MYSQL server.  A password should be assigned to this account.||remote
ARC-011|NIS|2006-05-01|7.0|High|The NIS password is accessible to the world.  A brute force cracker attack could yield passwords||remote
ARC-012|Any NFS Server|2006-05-01|8.0|High|The directory mentioned in the vulnerability is is available to everyone who can connect to the NFS server.  If the vulnerability indicates 'rw', then files in the mentioned directory can be overwritten.||remote
ARC-013|Any Oracle Server|2006-05-01|7.0|High|The Oracle Listener is not password protected.  Consequently, a specially crafted status request yielded account names. Arbitrary file overwrites may also be possible.  Security should be enabled on the Listener by adding a password.||remote
ARC-018|Oracle Servers|2006-05-01|6.9|Medium|The Oracle server is displaying a version number that is known to be vulnerable to one or more exploits.  Check the version number and apply the appropriate patch.||remote
ARC-019|POP3 and IMAP|2006-05-01|6.9|Medium|The version number displayed by the POP3 or IMAP server indicates that the server may be vulnerable.  Upgrade to the latest vendor version of the software.||remote
ARC-020|Backdoor|2006-05-01|9.0|High|A backdoor or worm was found on the system. The backdoor indicated in the vulnerability statement was detected on the specified port. If this backdoor is confirmed, then it should be assumed that the entire system has been compromised.||remote
ARC-021|Any SMB server|2006-05-01|3.0|Low|A SMB share name is visible to arbitrary users.  However, data in the share is not available.  Where possible, the displaying of share names should be blocked from arbitrary users.||remote
ARC-022|Sendmail|2006-05-01|6.0|Medium|The sendmail DEBUG command enabled.  Under certain circumstances, this command could assist the malicious user in compromising the system.  The sendmail VRFY and/or EXTN commands may be enabled.  These commands can assist the malicious user in guessing valid account names.||remote
ARC-023|TFTP|2006-05-01|5.0.|Medium|The trivial file transfer protocol is enabled.  This enables unauthenticated access to part or off of the filesystem.  Where possible, this service should be disabled.  If the service allows file writing, it must be disabled.||remote
ARC-024|HTTP|2006-09-01|6.0|Medium|The web server does not conform to HTTP 1.1 specifications.  Specifically, it acknolwedges that any file exists on the web server by sending a '200 OK' for any URL request.  As a result, many SARA probes have been disabled.||remote
ARC-025|HTTP|2007-02-13|9.0|High|The identifed URL path is vulnerable to SQL injection which can lead to arbitrary command execution on the backend SQL server.|OSAWP; https://www.owasp.org/index.php/SQL_Injection||remote
ARC-026|FTP|2007-02-25|6.0|Medium|The identified ftp path allows write access which could allow the malicious user to store illegal information on your system|||remote
CVE-2007-5398||2007-11-16|||Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.|NSO; http://secunia.com/secunia_research/2007-90/advisory/;http://secunia.com/secunia_research/2007-90/advisory/,NSO; http://us1.samba.org/samba/security/CVE-2007-5398.html;http://us1.samba.org/samba/security/CVE-2007-5398.html,SECUNIA; http://secunia.com/advisories/27450;27450|||
CVE-1999-0001|BSD/OS (BSDI), FreeBSD (FreeBSD), OpenBSD (OpenBSD)|1999-12-30|3.3|Low|ip_input.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service (crash or hang) via crafted packets.|CERT; http://www.cert.org/advisories/CA-1998-13.html;CA-1998-13,NSO; http://www.openbsd.org/errata23.html#tcpfix;http://www.openbsd.org/errata23.html#tcpfix,OSVDB; http://www.osvdb.org/5707;5707|remote||avail
CVE-1999-0039|IRIX (SGI)|1997-05-06|7|High|Arbitrary command execution using webdist CGI program in IRIX.|CERT; http://www.cert.org/advisories/CA-97.12.webdist.html;CA-97.12.webdist,Security Focus; http://securityfocus.com/bid/374;BID 374,ISS X-Force; http://xforce.iss.net/static/333.php;http-sgi-webdist(333)|local,remote|input|sec_prot user="1"
CVE-1999-0045|Apache (Apache Group), Communications Server (Netscape), Enterprise Server (Netscape), Commerce Server (Netscape)|1996-12-10|7|High|List of arbitrary files on Web host via nph-test-cgi script|CERT; http://www.cert.org/advisories/CA-97.07.nph-test-cgi_script.html;CA-97.07.nph-test-cgi_script,Security Focus; http://securityfocus.com/bid/686;BID 686,ISS X-Force; http://xforce.iss.net/static/289.php;http-cgi-nph(289)|remote|input,config|sec_prot
CVE-1999-0058|PHP/FI (PHP)|1997-04-17|7|High|Buffer overflow in PHP cgi program, php.cgi allows shell access.|Security Focus; http://securityfocus.com/bid/712;bugtraq id 712,ISS X-Force; http://xforce.iss.net/static/293.php;http-cgi-phpbo(293)|remote|input buffer="1"|sec_prot
CVE-1999-0067|Apache (Apache Group), httpd (NCSA)|1996-03-20|10|High|CGI phf program allows remote command execution through shell metacharacters.|Security Focus; http://securityfocus.com/bid/629;bugtraq id 629,CERT; http://www.cert.org/advisories/CA-96.06.cgi_example_code.html;CA-96.06.cgi_example_code,ISS X-Force; http://xforce.iss.net/static/148.php;http-cgi-phf(148)|remote|input|sec_prot admin="1"
CVE-1999-0068|PHP/FI (PHP)|1997-10-19|7|High|CGI PHP mylog script allows an attacker to read any file on the target server.|Security Focus; http://securityfocus.com/bid/713;bugtraq id 713,ISS X-Force; http://xforce.iss.net/static/1468.php;http-cgi-php-mylog(1468)|remote|config|sec_prot
CVE-1999-0103||1996-02-08|3.3|Low|Echo and chargen, or other combinations of UDP services, can be used in tandem to flood the server, a.k.a. UDP bomb or UDP packet storm.|CERT; http://www.cert.org/advisories/CA-96.01.UDP_service_denial.html;CA-96.01.UDP_service_denial|remote|input|avail
CVE-1999-0146|CGI (NCSA), Servers (NCSA)|1997-07-15|8|High|The campas CGI program provided with some NCSA web servers allows an attacker to read arbitrary files.|ISS X-Force; http://xforce.iss.net/static/298.php;http-cgi-campas(298)|remote|config|int,sec_prot user="1"
CVE-1999-0147|Glimpse HTTP (University of Arizona), WebGlimpse (University of Arizona)|1997-07-01|7|High|The aglimpse CGI program of the Glimpse package allows remote execution of arbitrary commands|ISS X-Force; http://xforce.iss.net/static/297.php;http-cgi-glimpse(297)|remote|config|sec_prot user="1"
CVE-1999-0148|IRIX (SGI)|1997-09-01|7|High|The handler CGI program in IRIX allows arbitrary command execution.|Security Focus; http://securityfocus.com/bid/380;bugtraq id 380,ISS X-Force; http://xforce.iss.net/static/340.php;http-sgi-handler(340)|remote|config|sec_prot user="1"
CVE-1999-0149|IRIX (SGI)|1997-04-19|8|High|The wrap CGI program in IRIX allows remote attackers to view arbitrary directory listings via a .. (dot dot) attack.|Security Focus; http://securityfocus.com/bid/373;bugtraq id 373,ISS X-Force; http://xforce.iss.net/static/290.php;http-sgi-wrap(290)|remote|input|int,sec_prot user="1"
CVE-1999-0168|SunOS (Sun)|1992-06-04|8|High|The portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, possibly bypassing authentication that would otherwise have taken place.  For example, NFS file systems could be mounted through the portmapper despite export restrictions.|Security Focus; http://securityfocus.com/bid/46;bugtraq id 46,ISS X-Force; http://www.iss.net/security_center/static/673.php;decod-portmap-call (673),ISS X-Force; http://www.iss.net/security_center/static/80.php;nfs-portmap (80)|remote|config|conf,sec_prot user="1"
CVE-1999-0176|WebGAIS (WebGAIS Development Team)|1997-07-10|7|High|The Webgais program allows a remote user to execute arbitrary commands.|ISS X-Force; http://xforce.iss.net/static/1467.php;http-webgais-query(1467)|remote|input,config|sec_prot user="1"
CVE-1999-0176|WebGAIS (WebGAIS Development Team)|1997-07-10|7|High|The Webgais program allows a remote user to execute arbitrary commands.|ISS X-Force; http://xforce.iss.net/static/1467.php;http-webgais-query(1467)|remote|input,config|sec_prot user="1"
CVE-1999-0176|WebGAIS (WebGAIS Development Team)|1997-07-10|7|High|The Webgais program allows a remote user to execute arbitrary commands.|ISS X-Force; http://xforce.iss.net/static/1467.php;http-webgais-query(1467)|remote|input,config|sec_prot user="1"
CVE-1999-0177|Website (OReilly Software)|1997-09-01|7|High|The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs.|ISS X-Force; http://xforce.iss.net/static/294.php;http-website-uploader(294)|remote|input,config|sec_prot user="1"
CVE-1999-0178|Website (OReilly Software)|1997-01-01|7|High|The win-c-sample program in the WebSite web server has a buffer overflow that allows remote execution of commands.|ISS X-Force; http://xforce.iss.net/static/295.php;http-website-winsample(295)|remote|input buffer="1"|sec_prot user="1"
CVE-1999-0191|IIS (Microsoft)|1997-09-01|6.7|Medium|IIS newdsn.exe CGI script allows remote users to overwrite files.|ISS X-Force; http://xforce.iss.net/static/1530.php;http-cgi-newdsn(1530)|remote|config|conf,int
CVE-1999-0262|faxsurvey (Renaud Deraison)|1998-08-04|7|High|faxsurvey CGI script on Linux allows remote command execution via shell metacharacters.|ISS X-Force; http://xforce.iss.net/static/1532.php;http-cgi-faxsurvey(1532)|remote|input|sec_prot user="1"
CVE-1999-0264|htmlscript (Miva Corporation)|1998-01-27|3.3|Low|htmlscript CGI program allows remote read access to files.|ISS X-Force; http://xforce.iss.net/static/1466.php;http-htmlscript-file-access(1466)|remote|config|conf
CVE-1999-0270|IRIX (SGI)|1998-04-03|3.3|Low|pfdispaly CGI program for SGI&amp;apos;s Performer API Search Tool allows read access to files.|CIAC; http://ciac.llnl.gov/ciac/bulletins/i-041.shtml;Performer API Search Tool 2.2 pfdispaly.cgi Vulnerability,ISS X-Force; http://xforce.iss.net/static/810.php;sgi-pfdispaly(810),Security Focus; http://www.securityfocus.com/templates/archive.pike?list=1&amp;amp;date=1998-03-15&amp;amp;msg=199803162306.AAA25015@gtc1.cps.unizar.es adv=1;http://www.securityfocus.com/templates/archive.pike?list=1&amp;amp;date=1998-03-15&amp;amp;msg=199803162306.AAA25015@gtc1.cps.unizar.es adv=1|remote|access|conf
CVE-1999-0455|ColdFusion Server (Allaire)|1999-12-25|9|High|The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly.|ISS X-Force; http://xforce.iss.net/static/1740.php;coldfusion-expression-evaluator(1740),Security Focus; http://www.securityfocus.com/bid/115;Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability|remote|access,design|conf,int,sec_prot other="1"
CVE-1999-0477|ColdFusion Server (Allaire)|1999-12-25|8|High|The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.|Security Focus; http://www.securityfocus.com/bid/115;Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability|local,remote|access,design|int,sec_prot other="1"
CVE-1999-0517|Solaris (Sun), HP-UX (HP)|1997-01-01|7|High|An SNMP community name is the default (e.g. public), null, or missing.|ISS X-Force; http://xforce.iss.net/static/1387.php;hpov-hidden-snmp-comm(1387),ISS X-Force; http://xforce.iss.net/static/133.php;snmp-comm(133)|local,remote|config|sec_prot
CVE-1999-0517|Solaris (Sun), HP-UX (HP)|1997-01-01|7|High|An SNMP community name is the default (e.g. public), null, or missing.|ISS X-Force; http://xforce.iss.net/static/1387.php;hpov-hidden-snmp-comm(1387),ISS X-Force; http://xforce.iss.net/static/133.php;snmp-comm(133)|local,remote|config|sec_prot
CVE-1999-0517|Solaris (Sun), HP-UX (HP)|1997-01-01|7|High|An SNMP community name is the default (e.g. public), null, or missing.|ISS X-Force; http://xforce.iss.net/static/1387.php;hpov-hidden-snmp-comm(1387),ISS X-Force; http://xforce.iss.net/static/133.php;snmp-comm(133)|local,remote|config|sec_prot
CVE-1999-0518|Windows 95 (Microsoft)|1997-01-01|7|High|A NETBIOS/SMB share password is guessable.|ISS X-Force; http://xforce.iss.net/static/182.php;nt-netbios-perm(182)|remote|design,config|sec_prot
CVE-1999-0518|Windows 95 (Microsoft)|1997-01-01|7|High|A NETBIOS/SMB share password is guessable.|ISS X-Force; http://xforce.iss.net/static/182.php;nt-netbios-perm(182)|remote|design,config|sec_prot
CVE-1999-0519|Windows 95 (Microsoft), Windows 2000 (Microsoft), Windows NT (Microsoft), Outlook (Microsoft)|1997-01-01|7|High|A NETBIOS/SMB share password is the default, null, or missing.|ISS X-Force; http://xforce.iss.net/static/1.php;nt-netbios-everyoneaccess(1),ISS X-Force; http://xforce.iss.net/static/2.php;nt-netbios-guestaccess(2),ISS X-Force; http://xforce.iss.net/static/19.php;nt-netbios-write(19),ISS X-Force; http://xforce.iss.net/static/12.php;nt-netbios-share(12),ISS X-Force; http://xforce.iss.net/static/20.php;nt-netbios-shareguest(20)|remote|design,config|sec_prot other="1"
CVE-1999-0519|Windows 95 (Microsoft), Windows 2000 (Microsoft), Windows NT (Microsoft), Outlook (Microsoft)|1997-01-01|7|High|A NETBIOS/SMB share password is the default, null, or missing.|ISS X-Force; http://xforce.iss.net/static/1.php;nt-netbios-everyoneaccess(1),ISS X-Force; http://xforce.iss.net/static/2.php;nt-netbios-guestaccess(2),ISS X-Force; http://xforce.iss.net/static/19.php;nt-netbios-write(19),ISS X-Force; http://xforce.iss.net/static/12.php;nt-netbios-share(12),ISS X-Force; http://xforce.iss.net/static/20.php;nt-netbios-shareguest(20)|remote|design,config|sec_prot other="1"
CVE-1999-0612|Finger Service (GNU), Windows 2000 (Microsoft), fingerd (GNU), Windows NT (Microsoft)|1997-03-01|3.3|Low|A version of finger is running that exposes valid user information to any entity on the network.|ISS X-Force; http://xforce.iss.net/static/46.php;finger-running(46)|remote|config|conf
CVE-1999-0627|AIX (IBM)|1992-03-01|7|High|The rexd service is running, which uses weak authentication that can allow an attacker to execute commands.|Security Focus; http://securityfocus.com/bid/37;bugtraq id 37,CERT; http://www.cert.org/advisories/CA-92.05.AIX.REXD.Daemon.vulnerability.html;CA-92.05,IBM; http://service.software.ibm.com/rs6k/fixes.html patch=1;http://service.software.ibm.com/rs6k/fixes.html patch=1|remote|input,env|sec_prot user="1"
CVE-1999-0682|Exchange (Microsoft)|1999-08-06|3.3|Low|Microsoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled.|Security Focus; http://securityfocus.com/bid/567;BID 567,Microsoft; http://www.microsoft.com/TechNet/security/bulletin/ms99-027.asp;MS99-027,Microsoft; http://www.microsoft.com/technet/security/bulletin/fq99-027.asp;MS99-027,ISS X-Force; http://xforce.iss.net/static/3107.php;exchange-relay(3107)|remote|input bound="1",env|avail
CVE-1999-0696|SunOS (Sun), Solaris (Sun), HP-UX (HP)|1999-07-01|10|High|Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd)|ISS X-Force; http://xforce.iss.net/static/2345.php;sun-cmsd-bo(2345),CERT; http://www.cert.org/advisories/CA-99-08-cmsd.html;CA-99-08-cmsd|remote|input buffer="1"|sec_prot admin="1"
CVE-1999-0736|IIS (Microsoft)|1999-05-07|3.3|Low|The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.|Microsoft; http://www.microsoft.com/technet/security/bulletin/ms99-013.asp;Microsoft Security Bulletin (MS99-013),ISS X-Force; http://xforce.iss.net/static/2381.php;iis-samples-showcode(2381),lOpht; http://www.l0pht.com/advisories/showcode.txt;L0pht Security Advisory,OVAL; http://oval.mitre.org/oval/definitions/data/oval932.html;OVAL932|remote|access|conf
CVE-1999-0738|IIS (Microsoft)|1999-05-07|3.3|Low|The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.|ISS X-Force; http://xforce.iss.net/static/2381.php;iis-samples-showcode(2381),lOpht; http://www.l0pht.com/advisories/showcode.txt;L0pht Security Advisory,MS; http://www.microsoft.com/technet/security/bulletin/ms99-013.asp;MS99-013|remote|access|conf
CVE-1999-0739|IIS (Microsoft)|1999-05-07|3.3|Low|The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.|ISS X-Force; http://xforce.iss.net/static/2381.php;iis-samples-showcode(2381),lOpht; http://www.l0pht.com/advisories/showcode.txt;L0pht Security Advisory,MS; http://www.microsoft.com/technet/security/bulletin/ms99-013.asp;MS99-013|remote|access|conf
CVE-1999-0739|IIS (Microsoft)|1999-05-07|3.3|Low|The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.|ISS X-Force; http://xforce.iss.net/static/2381.php;iis-samples-showcode(2381),lOpht; http://www.l0pht.com/advisories/showcode.txt;L0pht Security Advisory,MS; http://www.microsoft.com/technet/security/bulletin/ms99-013.asp;MS99-013|remote|access|conf
CVE-1999-0853|Enterprise Server (Netscape), FastTrack (Netscape)|1999-12-01|10|High|Buffer overflow in Netscape Enterprise Server and Netscape FastTrack Server allows remote attackers to gain privileges via the HTTP Basic Authentication procedure.|ISS X-Force; http://xforce.iss.net/static/3586.php;netscape-fasttrack-auth-bo(3586),Security Focus; http://securityfocus.com/bid/847;BID 847|remote|input buffer="1"|sec_prot admin="1"
CVE-1999-0853|Enterprise Server (Netscape), FastTrack (Netscape)|1999-12-01|10|High|Buffer overflow in Netscape Enterprise Server and Netscape FastTrack Server allows remote attackers to gain privileges via the HTTP Basic Authentication procedure.|ISS X-Force; http://xforce.iss.net/static/3586.php;netscape-fasttrack-auth-bo(3586),Security Focus; http://securityfocus.com/bid/847;BID 847|remote|input buffer="1"|sec_prot admin="1"
CVE-1999-0911|ProFTPD (ProFTPD Project)|1999-08-27|10|High|Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.|Security Focus; http://www.securityfocus.com/vdb/bottom.html?vid=612;ProFTPD Remote Buffer Overflow,ISS X-Force; http://xforce.iss.net/static/3399.php;proftpd-long-dir-bo(3399),Bugtraq; http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3DPine.LNX.4.10.9909071813590.3522-200000@prof.fr.nessus.org;ProFTP-1.2.0pre4 buffer overflow -- once more,DEBIAN; http://www.debian.org/security/1999/19990210;19990210,BID; http://www.securityfocus.com/bid/612;612|remote|input buffer="1"|sec_prot admin="1"
CVE-1999-1011|IIS (Microsoft), MDAC (Microsoft), Index Server (Microsoft), Site Server (Microsoft)|1999-07-19|10|High|The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.|ISS X-Force; http://xforce.iss.net/static/1212.php;nt-iis-rds(1212),Security Focus; http://securityfocus.com/bid/529;BID 529,Microsoft; http://www.microsoft.com/TechNet/security/bulletin/ms98-004.asp;MS98-004,Microsoft; http://www.microsoft.com/TechNet/security/bulletin/ms99-025.asp;MS99-025,Microsoft; http://www.microsoft.com/TechNet/security/bulletin/fq99-025.asp;MS99-025|remote|access,design|sec_prot admin="1"
CVE-1999-1011|IIS (Microsoft), MDAC (Microsoft), Index Server (Microsoft), Site Server (Microsoft)|1999-07-19|10|High|The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.|ISS X-Force; http://xforce.iss.net/static/1212.php;nt-iis-rds(1212),Security Focus; http://securityfocus.com/bid/529;BID 529,Microsoft; http://www.microsoft.com/TechNet/security/bulletin/ms98-004.asp;MS98-004,Microsoft; http://www.microsoft.com/TechNet/security/bulletin/ms99-025.asp;MS99-025,Microsoft; http://www.microsoft.com/TechNet/security/bulletin/fq99-025.asp;MS99-025|remote|access,design|sec_prot admin="1"
CVE-1999-1067|IRIX (SGI)|1997-05-07|3.3|Low|SGI MachineInfo CGI program, installed by default on some web servers, prints potentially sensitive system status information, which could be used by remote attackers for information gathering activities.|ISS X-Force; http://xforce.iss.net/static/1730.php;sgi-machineinfo (1730),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=87602167420919&amp;amp;w=2;19970507 Re: SGI Security Advisory 19970501-01-A - Vulnerability in webdist.cgi|remote|design|conf
CVE-1999-1508|Phaser Network Printer (Tektronix)|1999-11-16|10|High|Web server in Tektronix PhaserLink Printer 840.0 and earlier allows a remote attacker to gain administrator access by directly calling undocumented URLs such as ncl_items.html and ncl_subjects.html.|TheAimsGroup; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=94286041430870&amp;amp;w=2 adv=1 patch=1;http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=94286041430870&amp;amp;w=2 adv=1 patch=1,Security Focus; http://www.securityfocus.com/bid/806;bid806|remote|access|sec_prot admin="1"
CVE-2000-0087|Navigator (Netscape), Communicator (Netscape)|2000-01-12|3.3|Low|Netscape Mail Notification (nsnotify) utility in Netscape Communicator uses IMAP without SSL, even if the user has set a preference for Communicator to use an SSL connection, allowing a remote attacker to sniff usernames and passwords in plaintext.|ISS X-Force; http://xforce.iss.net/static/4385.php;netscape-mail-notify-plaintext,Bugtraq; http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26date%3D2000-01-15%26msg%3D387E245C.F279E367%40digsigtrust.com;Misleading sense of security in Netscape|remote|design|conf
CVE-2000-0188|EZShopper (Alex Heiphetz Group)|2000-02-27|7|High|EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters.|ISS X-Force; http://xforce.iss.net/static/4044.php;ezshopper-loadpage-cgi(4044),Bugtraq; http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3D200002270932.UAA19852@jawa.chilli.net.au;EZ Shopper 3.0 shopping cart CGI remote command execution,BUGTRAQ; http://archives.neohapsis.com/archives/bugtraq/2000-02/0356.html;20000227 EZ Shopper 3.0 shopping cart CGI remote command execution,BID; http://www.securityfocus.com/bid/1014;1014|remote|input|sec_prot other="1"
CVE-2000-0188|EZShopper (Alex Heiphetz Group)|2000-02-27|7|High|EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters.|ISS X-Force; http://xforce.iss.net/static/4044.php;ezshopper-loadpage-cgi(4044),Bugtraq; http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3D200002270932.UAA19852@jawa.chilli.net.au;EZ Shopper 3.0 shopping cart CGI remote command execution,BUGTRAQ; http://archives.neohapsis.com/archives/bugtraq/2000-02/0356.html;20000227 EZ Shopper 3.0 shopping cart CGI remote command execution,BID; http://www.securityfocus.com/bid/1014;1014|remote|input|sec_prot other="1"
CVE-2000-0248|Red Hat Linux (Red Hat)|2000-04-24|10|High|The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor passowrd that allows remote attackers to execute arbitrary commands.|ISS X-Force; http://xforce.iss.net/alerts/advise46.php3;Backdoor Password in Red Hat Linux Virtual Server Package,Security Focus; http://www.securityfocus.com/bid/1148;BID1148,Bugtraq; http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3DEnip.BSO.23.0004241601140.28851-100000@www.whitehats.com;piranha default password/exploit|remote|config|sec_prot admin="1"
CVE-2000-0308|Enterprise Server (Netscape), UnixWare (SCO), FastTrack (Netscape), Proxy Server (Netscape)|2001-03-12|7|High|Insecure file permissions for Netscape FastTrack Server 2.x, Enterprise Server 2.0, and Proxy Server 2.5 in SCO UnixWare 7.0.x and 2.1.3 allow an attacker to gain root privileges.|SCO; ftp://ftp.sco.com/SSE/security_bulletins/SB-99.08a adv=1 patch=1;ftp://ftp.sco.com/SSE/security_bulletins/SB-99.08a adv=1 patch=1||access|sec_prot admin="1"
CVE-2000-0401|PDG Shopping Cart (PDGSoft)|2000-05-01|7|High|Buffer overflows in redirect.exe and changepw.exe in PDGSoft shopping cart allow remote attackers to execute arbitrary commands via a long query string.|ISS X-Force; http://xforce.iss.net/static/4546.php;pdgsoft-changepw-bo(4546),ISS X-Force; http://xforce.iss.net/static/4545.php;pdgsoft-redirect-bo(4545),CONFIRM; http://www.pdgsoft.com/Security/security2.html;http://www.pdgsoft.com/Security/security2.html,BID; http://www.securityfocus.com/bid/1256;1256,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=95928319715983&amp;amp;w=2;20000525 Alert: PDG Cart Overflows,NTBUGTRAQ; http://marc.theaimsgroup.com/?l=ntbugtraq&amp;amp;m=95928667119963&amp;amp;w=2;20000525 Alert: PDG Cart Overflows|remote|input buffer="1"|sec_prot other="1"
CVE-2000-0401|PDG Shopping Cart (PDGSoft)|2000-05-01|7|High|Buffer overflows in redirect.exe and changepw.exe in PDGSoft shopping cart allow remote attackers to execute arbitrary commands via a long query string.|ISS X-Force; http://xforce.iss.net/static/4546.php;pdgsoft-changepw-bo(4546),ISS X-Force; http://xforce.iss.net/static/4545.php;pdgsoft-redirect-bo(4545),CONFIRM; http://www.pdgsoft.com/Security/security2.html;http://www.pdgsoft.com/Security/security2.html,BID; http://www.securityfocus.com/bid/1256;1256,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=95928319715983&amp;amp;w=2;20000525 Alert: PDG Cart Overflows,NTBUGTRAQ; http://marc.theaimsgroup.com/?l=ntbugtraq&amp;amp;m=95928667119963&amp;amp;w=2;20000525 Alert: PDG Cart Overflows|remote|input buffer="1"|sec_prot other="1"
CVE-2000-0432|Calendar Script (Matt Kruse)|2000-05-16|7|High|The calender.pl and the calendar_admin.pl calendar scripts by Matt Kruse allow remote attackers to execute arbitrary commands via shell metacharacters.|Security Focus; http://securityfocus.com/bid/1215;BID 1215,Matt Kruse; http://mkruse.netexpress.net/scripts/calendar/bugfix.html patch=1;http://mkruse.netexpress.net/scripts/calendar/bugfix.html patch=1,Bugtraq; http://www.securityfocus.com/archive/1/60376;Vuln in calender.pl (Matt Kruse calender script)|remote|input|sec_prot user="1"
CVE-2000-0443|JetAdmin (HP)|2000-05-24|8|High|The web interface server in HP Web JetAdmin 5.6 allows remote attackers to read arbitrary files via a .. (dot dot) attack.|Security Focus; http://www.securityfocus.net/bid/1243;HP Web JetAdmin Directory Traversal Vulnerability,ISS X-Force; http://xforce.iss.net/static/4525.php;hp-jetadmin-directory-traversal(4525)|local,remote|access|conf,sec_prot other="1"
CVE-2000-0472|INN (ISC)|2000-02-06|4.7|Medium|Buffer overflow in innd 2.2.2 allows remote attackers to execute arbitrary commands via a cancel request containing a long message ID.|CERT; http://www.cert.org/advisories/CA-97.08.innd.html;CERT* Advisory CA-97.08,ISS X-Force; http://xforce.iss.net/static/4615.php;innd-cancel-overflow,Security Focus; http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3DPine.LNX.4.10.10006061557230.30518-100000@squirrel.tpi.pl;innd 2.2.2 remote buffer overflow|local|input buffer="1"|conf,int
CVE-2000-0590|Poll It (CGI-World)|2000-07-04|8|High|Poll It 2.0 CGI script allows remote attackers to read arbitrary files by specifying the file name in the data_dir parameter.|Security Focus; http://www.securityfocus.com/bid/1431;BID 1431,ISS X-Force; http://xforce.iss.net/static/4878.php;http-cgi-pollit-variable-overwrite(4878),Bugtraq; http://archives.neohapsis.com/archives/bugtraq/2000-07/0076.html;Vulnerability in Poll_It cgi v2.0|remote|design|conf,sec_prot other="1"
CVE-2000-0623|Website Professional (OReilly Software)|2000-07-17|10|High|Buffer overflow in O&amp;apos;Reilly WebSite Professional web server 2.4 and earlier allows remote attackers to execute arbitrary commands via a long GET request or Referrer header.|Security Focus; http://www.securityfocus.com/bid/1492;BID 1492,ISS X-Force; http://xforce.iss.net/static/4970.php;O&amp;apos;Reilly WebSite GET Buffer Overflow Vulnerability,NT Bugtraq; http://www.ntbugtraq.com/default.asp?pid=36&amp;amp;sid=1&amp;amp;A2=ind0007&amp;amp;L=ntbugtraq&amp;amp;F=&amp;amp;S=&amp;amp;P=5946;Alert: Buffer Overrun is O&amp;apos;Reilly WebsitePro httpd32.exe              (CISADV000717|remote|input buffer="1"|sec_prot admin="1"
CVE-2000-0628|Apache::ASP (Joshua Chamas)|2000-07-11|8|High|The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files.|Security Focus; http://www.securityfocus.com/bid/1457;BID 1457,ISS X-Force; http://xforce.iss.net/static/4931.php;apache-source-asp-file-write(4931),Bugtraq; http://archives.neohapsis.com/archives/bugtraq/2000-07/0142.html;ANNOUNCE Apache::ASP v1.95 - Security Hole Fixed,CONFIRM; http://www.nodeworks.com/asp/changes.html;http://www.nodeworks.com/asp/changes.html|remote|access|int,sec_prot user="1" other="1"
CVE-2000-0638|Big Brother (Sean MacGuire)|2000-07-11|4.9|Medium|Big Brother 1.4h1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack.|Bugtraq; http://archives.neohapsis.com/archives/bugtraq/2000-07/0167.html;Re: BIG BROTHER EXPLOIT,CONFIRM; http://bb4.com/README.CHANGES;http://bb4.com/README.CHANGES|||
CVE-2000-0733|IRIX (SGI)|2000-10-20|10|High|Telnetd telnet server in IRIX 5.2 through 6.1 does not properly cleans user-injected format strings, which allows remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.|Bugtraq; http://archives.neohapsis.com/archives/bugtraq/2000-08/0154.html;20000814,Security Focus; http://www.securityfocus.com/bid/1572;BID 1572|remote|access|sec_prot admin="1"
CVE-2000-0733|IRIX (SGI)|2000-10-20|10|High|Telnetd telnet server in IRIX 5.2 through 6.1 does not properly cleans user-injected format strings, which allows remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.|Bugtraq; http://archives.neohapsis.com/archives/bugtraq/2000-08/0154.html;20000814,Security Focus; http://www.securityfocus.com/bid/1572;BID 1572|remote|access|sec_prot admin="1"
CVE-2000-0782|Netauth (NetWin)|2000-10-20|3.3|Low|netauth.cgi program in Netwin Netauth 4.2e and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack.|Bugtraq; http://www.securityfocus.com/templates/archive.pike?list=1&amp;amp;msg=NEBBJCLKGNOGCOIOBJNAGEHLCPAA.marc@eeye.com;BUGTRAQ:20000817 Netauth: Web Based Email Management System,Security Focus; http://www.securityfocus.com/bid/1587;BID 1587,CONFIRM; http://netwinsite.com/netauth/updates.htm;http://netwinsite.com/netauth/updates.htm|remote|access|conf
CVE-2000-0818|listener (Oracle)|2000-12-19|10|High|The default installation for the Oracle listener program 7.3.4, 8.0.6, and 8.1.6 allows an attacker to cause logging information to be appended to arbitrary files and execute commands via the SET TRC_FILE or SET LOG_FILE commands.|ISS X-Force; http://xforce.iss.net/alerts/advise66.php adv=1;http://xforce.iss.net/alerts/advise66.php adv=1,Oracle; http://otn.oracle.com/deploy/security/pdf/listener_alert.pdf adv=1 patch=1;http://otn.oracle.com/deploy/security/pdf/listener_alert.pdf adv=1 patch=1|local,remote|design|sec_prot admin="1"
CVE-2000-0818|listener (Oracle)|2000-12-19|10|High|The default installation for the Oracle listener program 7.3.4, 8.0.6, and 8.1.6 allows an attacker to cause logging information to be appended to arbitrary files and execute commands via the SET TRC_FILE or SET LOG_FILE commands.|ISS X-Force; http://xforce.iss.net/alerts/advise66.php adv=1;http://xforce.iss.net/alerts/advise66.php adv=1,Oracle; http://otn.oracle.com/deploy/security/pdf/listener_alert.pdf adv=1 patch=1;http://otn.oracle.com/deploy/security/pdf/listener_alert.pdf adv=1 patch=1|local,remote|design|sec_prot admin="1"
CVE-2000-0853|YaBB (YaBB)|2000-11-14|3.3|Low|YaBB Bulletin Board 9.1.2000 allows remote attackers to read arbitrary files via a .. (dot dot) attack.|Security Focus; http://www.securityfocus.com/bid/1668;BID 1668,Neohapsis; http://archives.neohapsis.com/archives/bugtraq/2000-09/0072.html;BUGTRAQ:20000909 YaBB 1.9.2000 Vulnerabilitie,ISS X-Force; http://xforce.iss.net/static/5254.php;XF:yabb-file-access|remote|input|conf
CVE-2000-0872|phpPhotoAlbum (Nathan Purciful)|2000-11-14|3.3|Low|explorer.php in PhotoAlbum 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) attack.|Security Focus; http://www.securityfocus.com/bid/1650;BID 1650,Neohapsis; http://archives.neohapsis.com/archives/bugtraq/2000-09/0015.html;BUGTRAQ:20000906 PhotoAlbum 0.9.9 explorer.php Vulnerability,XF; http://xforce.iss.net/static/5198.php;phpphoto-dir-traverse|local,remote|access,input|conf
CVE-2000-0884|IIS (Microsoft)|2000-12-19|8|High|IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the &amp;quot;Web Server Folder Traversal&amp;quot; vulnerability.|Security Focus; http://securityfocus.com/bid/1806;bugtraq id 1806,Microsoft; http://www.microsoft.com/technet/security/bulletin/ms00-078.asp;MS00-078|remote|input|conf,sec_prot
CVE-2000-0886|IIS (Microsoft)|2000-12-19|7|High|IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the &amp;quot;Web Server File Request Parsing&amp;quot; vulnerability.|Security Focus; http://www.securityfocus.com/vdb/bottom.html?vid=1912;BID 1912,Microsoft; http://www.microsoft.com/technet/security/bulletin/MS00-086.asp;MS:MS00-086,Security Focus; http://www.securityfocus.com/templates/archive.pike?mid=143604&amp;amp;list=1&amp;amp;fromthread=0&amp;amp;end=2000-11-11&amp;amp;threads=0&amp;amp;start=2000-11-05&amp;amp;;BUGTRAQ:20001107 NSFOCUS SA2000-07 : Microsoft IIS 4.0/5.0 CGI File Name Inspection Vulnerability|local,remote|input|sec_prot other="1"
CVE-2000-0921|Shopping Cart (Hassan Consulting)|2000-12-19|3.3|Low|Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. (dot dot) attack on the page parameter.|ISS X-Force; http://xforce.iss.net/static/5342.php;XF:hassan-shopping-cart-dir-traversal,Security Focus; http://www.securityfocus.com/bid/1777;BID 1777|remote|input|conf
CVE-2000-0945|Catalyst 3500 (Cisco)|2000-12-19|10|High|The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.|ISS X-Force; http://xforce.iss.net/static/5415.php;XF:cisco-catalyst-remote-commands,Neohapsis; http://archives.neohapsis.com/archives/bugtraq/2000-10/0380.html;BUGTRAQ:20001026 Advisory def-2000-02: Cisco Catalyst remote command execution,Security Focus; http://www.securityfocus.com/bid/1846;BID 1846|remote|input|conf,sec_prot admin="1"
CVE-2000-1092|EZShopper (Alex Heiphetz Group)|2001-01-09|3.3|Low|loadpage.cgi CGI program in EZshopper 3.0 and 2.0 allows remote attackers to list and read files in the EZshopper data directory by inserting a &amp;quot;/&amp;quot; in front of the target filename in the &amp;quot;file&amp;quot; parameter.|Security Focus; http://www.securityfocus.com/bid/2109;BID 2109,BID; http://online.securityfocus.com/bid/2109;2109,XF; http://xforce.iss.net/static/5740.php;ezshopper-cgi-file-disclosure(5740),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=97676270729984&amp;amp;w=2;20001213 NSFOCUS SA2000-09 : AHG EZshopper Loadpage.cgi File List|remote|input|conf
CVE-2000-1200|Windows NT (Microsoft)|2001-08-31|3.3|Low|Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.|Security Focus; http://www.securityfocus.com/archive/1/44430 adv=1;http://www.securityfocus.com/archive/1/44430 adv=1,ISS X-Force; http://xforce.iss.net/static/4015.php;nt-lsa-domain-sid(4015),Security Focus; http://www.securityfocus.com/bid/959;bid959|remote|access|conf
CVE-2000-1200|Windows NT (Microsoft)|2001-08-31|3.3|Low|Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.|Security Focus; http://www.securityfocus.com/archive/1/44430 adv=1;http://www.securityfocus.com/archive/1/44430 adv=1,ISS X-Force; http://xforce.iss.net/static/4015.php;nt-lsa-domain-sid(4015),Security Focus; http://www.securityfocus.com/bid/959;bid959|remote|access|conf
CVE-2000-1200|Windows NT (Microsoft)|2001-08-31|3.3|Low|Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.|Security Focus; http://www.securityfocus.com/archive/1/44430 adv=1;http://www.securityfocus.com/archive/1/44430 adv=1,ISS X-Force; http://xforce.iss.net/static/4015.php;nt-lsa-domain-sid(4015),Security Focus; http://www.securityfocus.com/bid/959;bid959|remote|access|conf
CVE-2000-1209|MSDE (Microsoft), SQL Server Desktop Engine (Microsoft), Insight Manager XE (Compaq), Insight Manager (Compaq)|2002-08-12|10|High|The &amp;quot;sa&amp;quot; account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.|CERT; http://www.kb.cert.org/vuls/id/635463;Microsoft SQL Server and Microsoft Data Engine (MSDE) ship with a null default password,Security Focus; http://online.securityfocus.com/bid/4797;bid 4797,ISS X-Force; http://www.iss.net/security_center/static/1459.php;mssql-no-sapassword(1459),BUGTRAQ; http://security-archive.merton.ox.ac.uk/bugtraq-200008/0233.html;20000815 MS-SQL &amp;apos;sa&amp;apos; user exploit code,MSKB; http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q313418;Q313418,MSKB; http://support.microsoft.com/default.aspx?scid=kb;EN-US;q321081;Q321081,CONFIRM; http://www.microsoft.com/security/security_bulletins/ms02020_sql.asp;http://www.microsoft.com/security/security_bulletins/ms02020_sql.asp,BID; http://www.securityfocus.com/bid/4797;4797,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=96333895000350&amp;amp;w=2;20000710 MSDE / Re: Default Password Database,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=96593218804850&amp;amp;w=2;20000810 Tumbleweed Worldsecure (MMS) BLANK &amp;apos;sa&amp;apos; account password,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=96644570412692&amp;amp;w=2;20000816 Released Patch: Tumbleweed Worldsecure (MMS) BLANK &amp;apos;sa&amp;apos; account password,BUGTRAQ; http://online.securityfocus.com/archive/1/273639;20020522 Opty-Way Enterprise includes MSDE with sa &amp;lt;blank&amp;gt;|remote|config|sec_prot admin="1"
CVE-2001-0042|Apache (Apache Group)|2001-02-16|3.3|Low|PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing &amp;quot;%5c&amp;quot; (encoded backslash) sequences.|Security Focus; http://www.securityfocus.com/bid/2060;bid 2060,ISS X-Force; http://xforce.iss.net/static/5659.php;apache-php-disclose-files(5659),Bugtraq; http://www.securityfocus.com/archive/1/149210;BUGTRAQ:20001206 CHINANSL Security Advisory(CSA-200011)|remote|access|conf
CVE-2001-0053|OpenBSD (OpenBSD), ftpd-BSD (David Madore), NetBSD (NetBSD)|2001-02-12|10|High|One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.|Security Focus; http://www.securityfocus.com/bid/2124;bid 2124,ISS X-Force; http://xforce.iss.net/static/5776.php;bsd-ftpd-replydirname-bo(5776),Bugtraq; http://archives.neohapsis.com/archives/bugtraq/2000-12/0275.html;BUGTRAQ:20001218 Trustix Security Advisory - ed, tcsh, and ftpd-BSD,OpenBSD; http://www.openbsd.org/advisories/ftpd_replydirname.txt;OPENBSD:20001218|remote|input buffer="1"|sec_prot admin="1"
CVE-2001-0098|Weblogic Server (BEA Systems)|2001-02-12|10|High|Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a &amp;quot;..&amp;quot;  string.|Bugtraq; http://archives.neohapsis.com/archives/bugtraq/2000-12/0331.html;BUGTRAQ:20001219 def-2000-04: Bea WebLogic Server dotdot-overflow,Security Focus; http://www.securityfocus.com/bid/2138;bid 2138,ISS X-Force; http://xforce.iss.net/static/5782.php;weblogic-dot-bo|remote|input buffer="1"|sec_prot admin="1"
CVE-2001-0187|wu-ftpd (University of Washington)|2001-03-26|10|High|Format string vulnerability in wu-ftp 2.6.1 and earlier, when running with debug mode enabled, allows remote attackers to execute arbitrary commands via a malformed argument that is recorded in a PASV port assignment.|Security Focus; http://www.securityfocus.com/bid/2296;bid 2296,ISS X-Force; http://xforce.iss.net/static/6020.php;wuftp-debug-format-string(6020),Debian; http://www.debian.org/security/2001/dsa-016;DSA-016-3 wu-ftpd: temp file creation and format string,CONFIRM; ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_current/missing_format_strings.patch;ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_current/missing_format_strings.patch|remote|exception,env|sec_prot admin="1"
CVE-2001-0236|Solaris (Sun)|2001-05-03|10|High|Buffer overflow in Solaris snmpXdmid SNMP to DMI mapper daemon allows remote attackers to execute arbitrary commands via a long &amp;quot;indication&amp;quot; event.|Security Focus; http://www.securityfocus.com/bid/2417;BID:2417,CERT; http://www.cert.org/advisories/CA-2001-05.html;http://www.cert.org/advisories/CA-2001-05.html,NSO; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=98462536724454&amp;amp;w=2 adv=1;http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=98462536724454&amp;amp;w=2 adv=1|remote|input buffer="1"|sec_prot admin="1"
CVE-2001-0248|HP-UX (HP)|2001-06-18|10|High|Buffer overflow in FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings.|Network Associates; http://www.pgp.com/research/covert/advisories/048.asp;NAI:20010409 Globbing Vulnerabilities in Multiple FTP Daemons,CERT; http://www.cert.org/advisories/CA-2001-07.html;CERT:CA-2001-07,Security Focus; http://www.securityfocus.com/bid/2552;BID:2552,NAI; http://www.nai.com/research/covert/advisories/048.asp;20010409 Globbing Vulnerabilities in Multiple FTP Daemons,XF; http://xforce.iss.net/static/6332.php;ftp-glob-expansion(6332)|remote|input bound="1"|sec_prot admin="1"
CVE-2001-0341|FrontPage 2000 Server Extensions (Microsoft), Windows 2000 (Microsoft), Windows NT (Microsoft)|2001-07-21|7|High|Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.|Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=99348216322147&amp;amp;w=2;SA2001-03,Microsoft; http://www.microsoft.com/technet/security/bulletin/MS01-035.asp;MS01-035,Security Focus; http://www.securityfocus.com/bid/2906;bid2906|remote|input buffer="1"|sec_prot
CVE-2001-0341|FrontPage 2000 Server Extensions (Microsoft), Windows 2000 (Microsoft), Windows NT (Microsoft)|2001-07-21|7|High|Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.|Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=99348216322147&amp;amp;w=2;SA2001-03,Microsoft; http://www.microsoft.com/technet/security/bulletin/MS01-035.asp;MS01-035,Security Focus; http://www.securityfocus.com/bid/2906;bid2906|remote|input buffer="1"|sec_prot
CVE-2001-0500|IIS (Microsoft), Index Server (Microsoft), Indexing Service (Microsoft)|2001-07-21|10|High|Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.|Microsoft; http://www.microsoft.com/technet/security/bulletin/MS01-033.asp;MS01-033,CERT; http://www.cert.org/advisories/CA-2001-13.html;CA-2001-13|remote|input buffer="1"|sec_prot admin="1"
CVE-2001-0500|IIS (Microsoft), Index Server (Microsoft), Indexing Service (Microsoft)|2001-07-21|10|High|Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.|Microsoft; http://www.microsoft.com/technet/security/bulletin/MS01-033.asp;MS01-033,CERT; http://www.cert.org/advisories/CA-2001-13.html;CA-2001-13|remote|input buffer="1"|sec_prot admin="1"
CVE-2001-0504|Windows 2000 (Microsoft)|2001-08-14|7|High|Vulnerability in authentication process for SMTP service in Microsoft Windows 2000 allows remote attackers to use incorrect credentials to gain privileges and conduct activites such as mail relaying.|Microsoft TechNet; http://www.microsoft.com/technet/security/bulletin/ms01-037.asp;MS01-037|remote|design|sec_prot other="1"
CVE-2001-0535|ColdFusion Server (Macromedia)|2001-10-30|9|High|Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host&amp;apos;s domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the &amp;quot;HTTP Host&amp;quot; (CGI.Host) variable in (1) the &amp;quot;Web Publish&amp;quot; example script, and (2) the &amp;quot;Email&amp;quot; example script.|ISS X-Force; http://xforce.iss.net/alerts/advise92.php adv=1;http://xforce.iss.net/alerts/advise92.php adv=1,Allaire; http://www.allaire.com/Handlers/index.cfm?ID=21700;MPSB01-08|remote|access,design|conf,int,sec_prot other="1"
CVE-2001-0554|Solaris (Sun), Linux Netkit (Netkit), AIX (IBM), Kerberos 5 (MIT), IRIX (SGI), FreeBSD (FreeBSD), OpenBSD (OpenBSD), NetBSD (NetBSD)|2001-08-14|10|High|Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.|Security Focus; http://www.securityfocus.com/archive/1/197804 adv=1;http://www.securityfocus.com/archive/1/197804 adv=1,CERT; http://www.cert.org/advisories/CA-2001-21.html;CA-2001-21,FreeBSD; ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:49.telnetd.asc;FreeBSD-SA-01:49,Security Focus; http://www.securityfocus.com/bid/3064;bugtraq id 3064|remote|input buffer="1"|sec_prot admin="1"
CVE-2001-0779|Solaris (Sun)|2001-10-18|10|High|Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username.|Security Focus; http://www.securityfocus.com/archive/1/187086 adv=1 patch=1;http://www.securityfocus.com/archive/1/187086 adv=1 patch=1,Security Focus; http://www.securityfocus.com/archive/1/200110041632.JAA28125@dim.ucsd.edu adv=1 patch=1;http://www.securityfocus.com/archive/1/200110041632.JAA28125@dim.ucsd.edu adv=1 patch=1,ISS X-Force; http://xforce.iss.net/static/6629.php;solaris-yppasswd-bo(6629),Security Focus; http://www.securityfocus.com/bid/2763;bid2763|remote|input buffer="1"|sec_prot admin="1"
CVE-2001-1039|JetAdmin (HP)|2001-08-31|8|High|The JetAdmin web interface for HP JetDirect does not set a password for the telnet interface when the admin password is changed, which allows remote attackers to gain access to the printer.|Security Focus; http://www.securityfocus.com/archive/1/201160 adv=1;http://www.securityfocus.com/archive/1/201160 adv=1,Security Focus; http://www.securityfocus.com/bid/3132;bid3132|remote|design|avail,sec_prot
CVE-2001-1371|Oracle9i Application Server (Oracle)|2002-02-06|10|High|The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=101301813117562&amp;amp;w=2;0020206 Hackproofing Oracle Application Server paper,CERT; http://www.kb.cert.org/vuls/id/736923;VU#736923,Security Focus; http://www.securityfocus.com/bid/4289;BID:4289,CERT; http://www.cert.org/advisories/CA-2002-08.html;CA-2002-08,MISC; http://www.nextgenss.com/papers/hpoas.pdf;http://www.nextgenss.com/papers/hpoas.pdf,CONFIRM; http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf;http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf|remote|config,race|int,sec_prot admin="1"
CVE-2001-1495|Network Query Tool adapted for PHPNuke (shaun@shat.net), Network Query Tool (shaun@shat.net)|2001-12-31|7|High|network_query.php in Network Query Tool 1.0 allows remote attackers execute arbitrary commands via shell metacharacters in the target parameter.|BID; http://www.securityfocus.com/bid/3455;3455,XF; http://xforce.iss.net/xforce/xfdb/7322;nqt-php-command-execution(7322),BUGTRAQ; http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-10/0179.html;20011022 [Advisory iSecureLabs] Network Query Tool remote command execution|remote|input|sec_prot user="1"
CVE-2001-1557|AIX (IBM)|2001-12-31|7|High|Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges.|AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;amp;q=IY23674&amp;amp;apar=only;IY23674,AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;amp;q=IY20486&amp;amp;apar=only;IY20486|remote|input buffer="1"|sec_prot user="1"
CVE-2002-0150|IIS (Microsoft)|2002-04-22|8|High|Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.|Microsoft; http://www.microsoft.com/technet/security/bulletin/ms02-018.asp;Cumulative Patch for Internet Information Services,Security Focus; http://online.securityfocus.com/cgi-bin/vulns-item.pl?section=info&amp;amp;id=4476;bid 4476|remote|input buffer="1"|avail,sec_prot other="1"
CVE-2002-0364|IIS (Microsoft)|2002-07-03|7|High|Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka &amp;quot;Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise.&amp;quot;|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=102392069305962&amp;amp;w=2;Windows 2000 and NT4 IIS .HTR Remote Buffer Overflow,Security Focus; http://online.securityfocus.com/bid/4855;bid 4855,Microsoft; http://www.microsoft.com/technet/security/bulletin/ms02-028.asp;Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (Q321599)|remote|input buffer="1"|sec_prot other="1"
CVE-2002-0364|IIS (Microsoft)|2002-07-03|7|High|Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka &amp;quot;Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise.&amp;quot;|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=102392069305962&amp;amp;w=2;Windows 2000 and NT4 IIS .HTR Remote Buffer Overflow,Security Focus; http://online.securityfocus.com/bid/4855;bid 4855,Microsoft; http://www.microsoft.com/technet/security/bulletin/ms02-028.asp;Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (Q321599)|remote|input buffer="1"|sec_prot other="1"
CVE-2002-0378|LPRng (Patrick Powell)|2002-07-03|7|High|The default configuration of LPRng print spooler in Red Hat Linux 7.0 through 7.3, Mandrake 8.1 and 8.2, and other operating systems, accepts print jobs from arbitrary remote hosts.|Red Hat; http://www.redhat.com/support/errata/RHSA-2002-089.html;Relaxed LPRng job submission policy,Security Focus; http://online.securityfocus.com/bid/4980;bid 4980,MANDRAKE; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-042.php;MDKSA-2002:042,HP; http://online.securityfocus.com/advisories/4205;HPSBTL0206-048,XF; http://www.iss.net/security_center/static/9322.php;lprng-remote-jobs-dos(9322),BID; http://www.securityfocus.com/bid/4980;4980|remote|config|sec_prot
CVE-2002-0563|Oracle8i (Oracle), Oracle9i Application Server (Oracle), Oracle9iAS Web Cache (Oracle), Oracle9i (Oracle)|2002-07-03|3.3|Low|The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=101301813117562&amp;amp;w=2;Hackproofing Oracle Application Server paper,CERT; http://www.cert.org/advisories/CA-2002-08.html;CERT Advisory CA-2002-08 Multiple Vulnerabilities in Oracle Servers,Oracle; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf adv=1 patch=1;http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf adv=1 patch=1,Security Focus; http://www.securityfocus.com/bid/4293;bid 4293,CERT-VN; http://www.kb.cert.org/vuls/id/168795;VU#168795,MISC; http://www.nextgenss.com/papers/hpoas.pdf;http://www.nextgenss.com/papers/hpoas.pdf|remote|config|conf
CVE-2002-0563|Oracle8i (Oracle), Oracle9i Application Server (Oracle), Oracle9iAS Web Cache (Oracle), Oracle9i (Oracle)|2002-07-03|3.3|Low|The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=101301813117562&amp;amp;w=2;Hackproofing Oracle Application Server paper,CERT; http://www.cert.org/advisories/CA-2002-08.html;CERT Advisory CA-2002-08 Multiple Vulnerabilities in Oracle Servers,Oracle; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf adv=1 patch=1;http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf adv=1 patch=1,Security Focus; http://www.securityfocus.com/bid/4293;bid 4293,CERT-VN; http://www.kb.cert.org/vuls/id/168795;VU#168795,MISC; http://www.nextgenss.com/papers/hpoas.pdf;http://www.nextgenss.com/papers/hpoas.pdf|remote|config|conf
CVE-2002-0678|Tru64 (Compaq), AIX (IBM), OpenUnix (Caldera), HP-UX (HP), IRIX (SGI), Solaris (Sun), UnixWare (Caldera), DeXtop (Xi Graphics)|2002-07-23|7|High|CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=102635906423617&amp;amp;w=2;Multiple vulnerabilities in ToolTalk Database server,CERT; http://www.cert.org/advisories/CA-2002-20.html;CERT Advisory CA-2002-20 Multiple Vulnerabilities in CDE ToolTalk,CERT; http://www.kb.cert.org/vuls/id/299816;Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) does not adequately validate file operations,Security Focus; http://online.securityfocus.com/bid/5082;bid 5082|local|input|sec_prot admin="1" other="1"
CVE-2002-0684|glibc (Gnu), BIND (ISC)|2002-08-12|7|High|Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.|Red Hat; http://rhn.redhat.com/errata/RHSA-2002-139.html;Updated glibc packages fix vulnerabilities in resolver,The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=102581482511612&amp;amp;w=2;Re: Remote buffer overflow in resolver code of libc,CERT-VN; http://www.kb.cert.org/vuls/id/542971;VU#542971,MANDRAKE; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-050.php;MDKSA-2002:050,CONECTIVA; http://distro.conectiva.com/atualizacoes/?id=a&amp;amp;anuncio=000507;CLSA-2002:507|remote|input buffer="1"|sec_prot other="1"
CVE-2002-0684|glibc (Gnu), BIND (ISC)|2002-08-12|7|High|Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.|Red Hat; http://rhn.redhat.com/errata/RHSA-2002-139.html;Updated glibc packages fix vulnerabilities in resolver,The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=102581482511612&amp;amp;w=2;Re: Remote buffer overflow in resolver code of libc,CERT-VN; http://www.kb.cert.org/vuls/id/542971;VU#542971,MANDRAKE; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-050.php;MDKSA-2002:050,CONECTIVA; http://distro.conectiva.com/atualizacoes/?id=a&amp;amp;anuncio=000507;CLSA-2002:507|remote|input buffer="1"|sec_prot other="1"
CVE-2002-0717|PHP (PHP)|2002-07-26|8|High|PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=102734515923277&amp;amp;w=2;PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1,The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=102734516023281&amp;amp;w=2;Advisory 02/2002: PHP remote vulnerability,CERT; http://www.cert.org/advisories/CA-2002-21.html;CA-2002-21,CERT-VN; http://www.kb.cert.org/vuls/id/929115;VU#929115,XF; http://www.iss.net/security_center/static/9635.php;php-multipart-handler-bo(9635)|remote|design|avail,sec_prot other="1"
CVE-2002-1278|Linuxconf (Jacques Gelinas)|2002-11-12|7|High|The mailconf module in Linuxconf 1.24, and other versions before 1.28, on Conectiva Linux 6.0 through 8, and possibly other distributions, generates the Sendmail configuration file (sendmail.cf) in a way that configures Sendmail to run as an open mail relay, which allows remote attackers to send Spam email.|ISS X-Force; http://www.iss.net/security_center/static/10554.php;Linuxconf sendmail.cf file allows mail relaying,Security Focus; http://online.securityfocus.com/bid/6118;bid 6118|remote|input,config|sec_prot other="1"
CVE-2002-1278|Linuxconf (Jacques Gelinas)|2002-11-12|7|High|The mailconf module in Linuxconf 1.24, and other versions before 1.28, on Conectiva Linux 6.0 through 8, and possibly other distributions, generates the Sendmail configuration file (sendmail.cf) in a way that configures Sendmail to run as an open mail relay, which allows remote attackers to send Spam email.|ISS X-Force; http://www.iss.net/security_center/static/10554.php;Linuxconf sendmail.cf file allows mail relaying,Security Focus; http://online.securityfocus.com/bid/6118;bid 6118|remote|input,config|sec_prot other="1"
CVE-2002-1345|NcFTP (NcFTP Software), Solaris (Sun), OpenBSD (OpenBSD)|2002-12-23|3.3|Low|Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=103962838628940&amp;amp;w=2;Directory Traversal Vulnerabilities in FTP Clients,CERT; http://www.kb.cert.org/vuls/id/210409;Multiple FTP clients contain directory traversal vulnerabilities,Security Focus; http://online.securityfocus.com/bid/6360;bid 6360,SGI; ftp://patches.sgi.com/support/free/security/advisories/20021205-01-A;20021205-01-A,VULNWATCH; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0102.html;20021210 Directory Traversal Vulnerabilities in FTP Clients,BID; http://www.securityfocus.com/bid/6360;6360,XF; http://www.iss.net/security_center/static/10821.php;ftp-client-filename-traversal(10821)|remote|input|int
CVE-2002-1357|Shellguard SSH (NetComposite), SecureNetTerm (InterSoft), IOS (Cisco), SSH Client (FiSSH), SecureShell (Pragma Systems), PuTTY (Simon Tatham), WinSCP (WinSCP)|2002-12-23|8|High|Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.|Security Focus; http://online.securityfocus.com/bid/6405;bid 6405,CERT; http://www.cert.org/advisories/CA-2002-36.html;CERT Advisory CA-2002-36 Multiple Vulnerabilities in SSH Implementations,VULNWATCH; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0110.html;20021216 R7-0009: Vulnerabilities in SSH2 Implementations from Multiple Vendors,CERT-VN; http://www.kb.cert.org/vuls/id/389665;VU#389665|remote|design|avail,sec_prot other="1"
CVE-2002-1374|MySQL (MySQL), NetBackup Global Data Manager (Symantec Veritas), NetBackup Advanced Reporter (Symantec Veritas)|2002-12-23|7|High|The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.|Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=103971644013961&amp;amp;w=2;Advisory 04/2002: Multiple MySQL vulnerabilities,Linux Security; http://www.linuxsecurity.com/advisories/engarde_advisory-2660.html;Several MySQL vulnerabilities.,Security Focus; http://www.securityfocus.com/bid/6373;MySQL COM_CHANGE_USER Password Length Account Compromise Vulnerability,ISS X-Force; http://xforce.iss.net/xforce/xfdb/10847;MySQL COM_CHANGE_USER command password authentication bypass,MISC; http://security.e-matters.de/advisories/042002.html;http://security.e-matters.de/advisories/042002.html|remote|design|sec_prot user="1"
CVE-2002-1632|Oracle9i Application Server (Oracle)|2002-12-31|6.7|Medium|Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.|MISC; http://www.nextgenss.com/papers/hpoas.pdf;http://www.nextgenss.com/papers/hpoas.pdf,CONFIRM; http://www.kb.cert.org/vuls/id/SVIM-576QLZ;http://www.kb.cert.org/vuls/id/SVIM-576QLZ,CONFIRM; http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf;http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf,CERT-VN; http://www.kb.cert.org/vuls/id/717827;VU#717827,BID; http://www.securityfocus.com/bid/6556;6556,XF; http://xforce.iss.net/xforce/xfdb/8665;oracle-appserver-info-sample(8665)|remote|config|conf,int
CVE-2002-1632|Oracle9i Application Server (Oracle)|2002-12-31|6.7|Medium|Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.|MISC; http://www.nextgenss.com/papers/hpoas.pdf;http://www.nextgenss.com/papers/hpoas.pdf,CONFIRM; http://www.kb.cert.org/vuls/id/SVIM-576QLZ;http://www.kb.cert.org/vuls/id/SVIM-576QLZ,CONFIRM; http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf;http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf,CERT-VN; http://www.kb.cert.org/vuls/id/717827;VU#717827,BID; http://www.securityfocus.com/bid/6556;6556,XF; http://xforce.iss.net/xforce/xfdb/8665;oracle-appserver-info-sample(8665)|remote|config|conf,int
CVE-2002-1654|Enterprise Server (Netscape), Web Server Enterprise Edition (iPlanet), Web Server (iPlanet)|2002-12-31|7|High|iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection.|VULNWATCH; http://lists.virus.org/vulnwatch-0201/msg00008.html;20020109 Netscape publishing wp-force-auth command,CERT-VN; http://www.kb.cert.org/vuls/id/985347;VU#985347,MISC; http://www.securiteam.com/securitynews/5IP0G0060Q.html;http://www.securiteam.com/securitynews/5IP0G0060Q.html,MISC; http://securitytracker.com/id?1003157;http://securitytracker.com/id?1003157,BID; http://www.securityfocus.com/bid/3831;3831,XF; http://xforce.iss.net/xforce/xfdb/7845;netscape-enterprise-http-brute-force(7845),NSO; http://www.kb.cert.org/vuls/id/AAMN-567NFX;http://www.kb.cert.org/vuls/id/AAMN-567NFX|remote|access|sec_prot other="1"
CVE-2002-1798|Midicart PHP (Coxco Support)|2002-12-31|6.7|Medium|MidiCart PHP 1 allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.|BUGTRAQ; http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html;20021002 Multiple Web Security Holes,BID; http://www.securityfocus.com/bid/5851;5851,BID; http://www.securityfocus.com/bid/5855;5855,XF; http://www.iss.net/security_center/static/10306.php;midicart-php-access-upload(10306)|remote|access|conf,int
CVE-2002-2010|ht://Dig (ht://Dig Group)|2002-12-31|3.3|Low|Cross-site scripting (XSS) vulnerability in htsearch.cgi in htdig (ht://Dig) 3.1.5, 3.1.6, and 3.2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.|BUGTRAQ; http://archives.neohapsis.com/archives/bugtraq/2002-06/0321.html;20020626 XSS in HTDIG,BID; http://www.securityfocus.com/bid/5091;5091,XF; http://www.iss.net/security_center/static/9433.php;htdig-htsearch-xss(9433)|remote|input|int
CVE-2002-2010|ht://Dig (ht://Dig Group)|2002-12-31|3.3|Low|Cross-site scripting (XSS) vulnerability in htsearch.cgi in htdig (ht://Dig) 3.1.5, 3.1.6, and 3.2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.|BUGTRAQ; http://archives.neohapsis.com/archives/bugtraq/2002-06/0321.html;20020626 XSS in HTDIG,BID; http://www.securityfocus.com/bid/5091;5091,XF; http://www.iss.net/security_center/static/9433.php;htdig-htsearch-xss(9433)|remote|input|int
CVE-2002-2010|ht://Dig (ht://Dig Group)|2002-12-31|3.3|Low|Cross-site scripting (XSS) vulnerability in htsearch.cgi in htdig (ht://Dig) 3.1.5, 3.1.6, and 3.2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.|BUGTRAQ; http://archives.neohapsis.com/archives/bugtraq/2002-06/0321.html;20020626 XSS in HTDIG,BID; http://www.securityfocus.com/bid/5091;5091,XF; http://www.iss.net/security_center/static/9433.php;htdig-htsearch-xss(9433)|remote|input|int
CVE-2002-2151|Search97 (Verity)|2002-12-31|4.7|Medium|Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients, possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions.|CERT-VN; http://www.kb.cert.org/vuls/id/636431;VU#636431,BID; http://www.securityfocus.com/bid/5102;5102,XF; http://www.iss.net/security_center/static/9441.php;verity-search97-xss(9441)|remote|input|conf,int
CVE-2003-0109|Windows 2000 (Microsoft)|2003-03-31|7|High|Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.|ISS X-Force; http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=22029;Microsoft IIS WebDAV Remote Compromise Vulnerability,Microsoft; http://www.microsoft.com/technet/security/bulletin/ms03-007.asp;Unchecked Buffer In Windows Component Could Cause Web Server Compromise (815021),CERT; http://www.cert.org/advisories/CA-2003-09.html;CERT Advisory CA-2003-09 Buffer Overflow in Core Microsoft Windows DLL,ISS X-Force; http://www.iss.net/security_center/static/11533.php;Microsoft IIS WebDAV long request buffer overflow,Security Focus; http://www.securityfocus.com/bid/7116;bid 7116,CONFIRM; http://microsoft.com/downloads/details.aspx?FamilyId=C9A38D45-5145-4844-B62E-C69D32AC929B&amp;amp;displaylang=en;http://microsoft.com/downloads/details.aspx?FamilyId=C9A38D45-5145-4844-B62E-C69D32AC929B&amp;amp;displaylang=en,MSKB; http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q815021;Q815021,MISC; http://www.nextgenss.com/papers/ms03-007-ntdll.pdf;http://www.nextgenss.com/papers/ms03-007-ntdll.pdf,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104826476427372&amp;amp;w=2;20030321 New attack vectors and a vulnerability dissection of MS03-007,NTBUGTRAQ; http://marc.theaimsgroup.com/?l=ntbugtraq&amp;amp;m=104826785731151&amp;amp;w=2;20030321 New attack vectors and a vulnerability dissection of MS03-007,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104861839130254&amp;amp;w=2;20030325 IIS 5.0 WebDAV -Proof of concept-. Fully documented.,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104869293619064&amp;amp;w=2;20030326 WebDAV exploit: using wide character decoder scheme,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104887148323552&amp;amp;w=2;20030328 Fate Research Labs Presents: Analysis of the NTDLL.DLL Exploit,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=105768156625699&amp;amp;w=2;20030708 WDAV exploit without netcat and with pretty magic number,OVAL; http://oval.mitre.org/oval/definitions/data/oval109.html;OVAL109,CERT-VN; http://www.kb.cert.org/vuls/id/117394;VU#117394|remote|input buffer="1"|sec_prot other="1"
CVE-2003-0131|OpenSSL (OpenSSL Project)|2003-03-24|8|High|The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=104811162730834&amp;w=2;Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding,ePrint.iacr.org; http://eprint.iacr.org/2003/052/;Attacking RSA-based Sessions in SSL/TLS,Security Focus; http://www.securityfocus.com/bid/7148;bid 7148,ISS X-Force; http://xforce.iss.net/xforce/xfdb/11586 adv=1;http://xforce.iss.net/xforce/xfdb/11586 adv=1,CERT; http://www.kb.cert.org/vuls/id/888801;SSL/TLS implementations disclose side channel information via PKCS #1 v1.5 version number extension,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104811162730834&amp;amp;w=2;20030319 [OpenSSL Advisory] Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104852637112330&amp;amp;w=2;20030324 GLSA:  openssl (200303-20),MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:035;MDKSA-2003:035,NETBSD; ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc;NetBSD-SA2003-007,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-101.html;RHSA-2003:101,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-102.html;RHSA-2003:102,CONECTIVA; http://distro.conectiva.com.br/atualizacoes/?id=a&amp;amp;anuncio=000625;CLA-2003:625,DEBIAN; http://www.debian.org/security/2003/dsa-288;DSA-288,SGI; ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I;20030501-01-I,TRUSTIX; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104878215721135&amp;amp;w=2;2003-0013,CONFIRM; http://lists.apple.com/mhonarc/security-announce/msg00028.html;http://lists.apple.com/mhonarc/security-announce/msg00028.html,CONFIRM; http://www.openssl.org/news/secadv_20030319.txt;http://www.openssl.org/news/secadv_20030319.txt,IMMUNIX; http://www.linuxsecurity.com/advisories/immunix_advisory-3066.html;IMNX-2003-7+-001-01,SUSE; http://www.novell.com/linux/security/advisories/2003_024_openssl.html;SuSE-SA:2003:024,OVAL; http://oval.mitre.org/oval/definitions/data/oval461.html;OVAL461|remote|design|int,sec_prot other="1"
CVE-2003-0201|Samba-TNG (Samba-TNG), Tru64 (Compaq), Mac OS X (Apple), Samba (Samba), Solaris (Sun), HP-UX (HP), CIFS/9000 Server (HP)|2003-05-05|10|High|Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=104972664226781&amp;w=2;Buffer Overflow in Samba allows remote root compromise,Debian; http://www.debian.org/security/2003/dsa-280;samba -- buffer overflow,Security Focus; http://www.securityfocus.com/bid/7294;bid 7294,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104972664226781&amp;amp;w=2;20030407 [DDI-1013] Buffer Overflow in Samba allows remote root compromise,MISC; http://www.digitaldefense.net/labs/advisories/DDI-1013.txt;http://www.digitaldefense.net/labs/advisories/DDI-1013.txt,SUSE; http://www.novell.com/linux/security/advisories/2003_025_samba.html;SuSE-SA:2003:025,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:044;MDKSA-2003:044,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-137.html;RHSA-2003:137,CONECTIVA; http://distro.conectiva.com.br/atualizacoes/?id=a&amp;amp;anuncio=000624;CLA-2003:624,SGI; ftp://patches.sgi.com/support/free/security/advisories/20030403-01-P;20030403-01-P,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104994564212488&amp;amp;w=2;20030409 GLSA:  samba (200304-02),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104974612519064&amp;amp;w=2;20030407 Immunix Secured OS 7+ samba update,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=104981682014565&amp;amp;w=2;20030408 [Sorcerer-spells] SAMBA--SORCERER2003-04-08,OVAL; http://oval.mitre.org/oval/definitions/data/oval567.html;OVAL567,OVAL; http://oval.mitre.org/oval/definitions/data/oval2163.html;OVAL2163,CERT-VN; http://www.kb.cert.org/vuls/id/267873;VU#267873|remote|input buffer="1"|sec_prot admin="1"
CVE-2003-0222|Oracle8i (Oracle), Oracle9i Release 2 (Oracle), Oracle7 (Oracle), Oracle8 (Oracle), Oracle9i (Oracle)|2003-05-12|7|High|Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter.|Oracle; http://otn.oracle.com/deploy/security/pdf/2003alert54.pdf;Buffer Overflow in Oracle Net Services for Oracle Database Server,Security Focus; http://www.securityfocus.com/bid/7453;bid 7453,NTBUGTRAQ; http://marc.theaimsgroup.com/?l=ntbugtraq&amp;m=105163376015735&amp;w=2;20030429 Oracle Database Server Buffer Overflow Vulnerability (#NISR29042003),CIAC; http://www.ciac.org/ciac/bulletins/n-085.shtml;N-085,XF; http://xforce.iss.net/xforce/xfdb/11885;oracle-database-link-bo(11885),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=105162831008176&amp;amp;w=2;20030429 Oracle Database Server Buffer Overflow Vulnerability (#NISR29042003),NTBUGTRAQ; http://marc.theaimsgroup.com/?l=ntbugtraq&amp;amp;m=105163376015735&amp;amp;w=2;20030429 Oracle Database Server Buffer Overflow Vulnerability (#NISR29042003)|remote|input bound="1"|sec_prot other="1"
CVE-2003-0253|Apache (Apache Software Foundation)|2003-08-18|3.3|Low|The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.|Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=105776593602600&amp;w=2;20030709 [ANNOUNCE][SECURITY] Apache 2.0.47 released,Red Hat; http://www.redhat.com/support/errata/RHSA-2003-240.html;Updated httpd packages fix Apache security vulnerabilities,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=105776593602600&amp;amp;w=2;20030709 [ANNOUNCE][SECURITY] Apache 2.0.47 released,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:075;MDKSA-2003:075,OVAL; http://oval.mitre.org/oval/definitions/data/oval173.html;OVAL173|remote|exception|avail
CVE-2003-0253|Apache (Apache Software Foundation)|2003-08-18|3.3|Low|The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.|Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=105776593602600&amp;w=2;20030709 [ANNOUNCE][SECURITY] Apache 2.0.47 released,Red Hat; http://www.redhat.com/support/errata/RHSA-2003-240.html;Updated httpd packages fix Apache security vulnerabilities,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=105776593602600&amp;amp;w=2;20030709 [ANNOUNCE][SECURITY] Apache 2.0.47 released,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:075;MDKSA-2003:075,OVAL; http://oval.mitre.org/oval/definitions/data/oval173.html;OVAL173|remote|exception|avail
CVE-2003-0533|Windows XP (Microsoft), Windows 98 (Microsoft), Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), NetMeeting (Microsoft), Windows NT (Microsoft), Windows ME (Microsoft)|2004-06-01|7|High|Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.|Full-Disclosure; http://lists.netsys.com/pipermail/full-disclosure/2004-April/020069.html;20040413 EEYE: Windows Local Security Authority Service Remote Buffer Overflow,Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108325860431471&amp;w=2;20040429 MS04011 Lsasrv.dll RPC buffer overflow remote exploit (PoC),Microsoft; http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx;MS04-011,CERT; http://www.us-cert.gov/cas/techalerts/TA04-104A.html;TA04-104A,CERT; http://www.kb.cert.org/vuls/id/753212;VU#753212,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020069.html;20040413 EEYE: Windows Local Security Authority Service Remote Buffer Overflow,EEYE; http://www.eeye.com/html/Research/Advisories/AD20040413C.html;AD20040413C,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=108325860431471&amp;amp;w=2;20040429 MS04011 Lsasrv.dll RPC buffer overflow remote exploit (PoC),OVAL; http://oval.mitre.org/oval/definitions/data/oval883.html;OVAL883,OVAL; http://oval.mitre.org/oval/definitions/data/oval898.html;OVAL898,OVAL; http://oval.mitre.org/oval/definitions/data/oval919.html;OVAL919,CIAC; http://www.ciac.org/ciac/bulletins/o-114.shtml;O-114,BID; http://www.securityfocus.com/bid/10108;10108,XF; http://xforce.iss.net/xforce/xfdb/15699;win-lsass-bo(15699)|remote|input buffer="1"|sec_prot other="1"
CVE-2003-0649|xpcd (xpcd)|2003-08-27|7|High|Buffer overflow in xpcd-svga for xpcd 2.08 and earlier allows local users to execute arbitrary code via a long HOME environment variable.|Security Focus; http://www.securityfocus.com/bid/8370;BID: 8370,Debian; http://www.debian.org/security/2003/dsa-368;DSA-368,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:053;MDKSA-2004:053|local|input buffer="1"|sec_prot admin="1" other="1"
CVE-2003-0693|OpenSSH (OpenSSH)|2003-09-22|10|High|A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.|The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106373247528528&amp;w=2;OpenSSH Buffer Management Bug Advisory,netsys.com; http://lists.netsys.com/pipermail/full-disclosure/2003-September/010154.html;[Full-Disclosure] openssh remote exploit,netsys.com; http://lists.netsys.com/pipermail/full-disclosure/2003-September/010146.html;[Full-Disclosure] The lowdown on SSH vulnerability,CERT; http://www.kb.cert.org/vuls/id/333628;Buffer Management Vulnerability in OpenSSH,ISS X-Force; http://xforce.iss.net/xforce/xfdb/13191;OpenSSH large packet buffer overflow,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106373247528528&amp;amp;w=2;20030916 OpenSSH Buffer Management Bug Advisory,CONFIRM; http://www.openssh.com/txt/buffer.adv;http://www.openssh.com/txt/buffer.adv,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010135.html;20030915 openssh remote exploit,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010146.html;20030916 The lowdown on SSH vulnerability,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010103.html;20030915 new ssh exploit?,REDHAT; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106373546332230&amp;amp;w=2;RHSA-2003:279,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-280.html;RHSA-2003:280,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:090;MDKSA-2003:090,DEBIAN; http://www.debian.org/security/2003/dsa-382;DSA-382,DEBIAN; http://www.debian.org/security/2003/dsa-383;DSA-383,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106374466212309&amp;amp;w=2;20030916 [slackware-security]  OpenSSH Security Advisory (SSA:2003-259-01),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106381409220492&amp;amp;w=2;20030917 [OpenPKG-SA-2003.040] OpenPKG Security Advisory (openssh),TRUSTIX; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106381396120332&amp;amp;w=2;2003-0033,CERT; http://www.cert.org/advisories/CA-2003-24.html;CA-2003-24,OVAL; http://oval.mitre.org/oval/definitions/data/oval2719.html;OVAL2719,OVAL; http://oval.mitre.org/oval/definitions/data/oval447.html;OVAL447|remote|input bound="1"|sec_prot admin="1" user="1" other="1"
CVE-2003-0694|TurboLinux Workstation (TurboLinux), AIX (IBM), Mac OS X (Apple), Tru64 (Compaq), Gentoo Linux (Gentoo), Solaris (Sun), Sendmail Pro (Sendmail Inc), Sendmail (Sendmail Consortium), IRIX (SGI), HP-UX (HP), TurboLinux Server (TurboLinux), NetBSD (NetBSD), Sendmail Advanced Message Server (Sendmail Inc), Mac OS X Server (Apple), Sendmail (Sendmail Inc), TurboLinux Advanced Server (TurboLinux), FreeBSD (FreeBSD), Sendmail Switch (Sendmail Inc)|2003-10-06|10|High|The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.|Sendmail; http://www.sendmail.org/8.12.10.html;Sendmail 8.12.10,CERT; http://www.cert.org/advisories/CA-2003-25.html;Buffer Overflow in Sendmail,Security Focus; http://www.securityfocus.com/bid/8641;bid 8641,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106381604923204&amp;w=2;20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694],VULNWATCH; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0113.html;20030917 Zalewski Advisory - Sendmail 8.12.9 prescan bug,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-283.html;RHSA-2003:283,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-284.html;RHSA-2003:284,CONECTIVA; http://distro.conectiva.com.br/atualizacoes/?id=a&amp;anuncio=000742;CLA-2003:742,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:092;MDKSA-2003:092,DEBIAN; http://www.debian.org/security/2003/dsa-384;DSA-384,SCO; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt;SCOSA-2004.11,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106382859407683&amp;w=2;20030917 [slackware-security]  Sendmail vulnerabilities fixed (SSA:2003-260-02),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106398718909274&amp;w=2;20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail),OVAL; http://oval.mitre.org/oval/definitions/data/oval572.html;OVAL572,OVAL; http://oval.mitre.org/oval/definitions/data/oval603.html;OVAL603,OVAL; http://oval.mitre.org/oval/definitions/data/oval2975.html;OVAL2975,FULLDISC; http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4119.html;20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694],CERT-VN; http://www.kb.cert.org/vuls/id/784980;VU#784980,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106381604923204&amp;amp;w=2;20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694],CONECTIVA; http://distro.conectiva.com.br/atualizacoes/?id=a&amp;amp;anuncio=000742;CLA-2003:742,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106383437615742&amp;amp;w=2;20030917 GLSA:  sendmail (200309-13),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106382859407683&amp;amp;w=2;20030917 [slackware-security]  Sendmail vulnerabilities fixed (SSA:2003-260-02),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106398718909274&amp;amp;w=2;20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail)|remote|input buffer="1"|sec_prot admin="1"
CVE-2003-0694|TurboLinux Workstation (TurboLinux), AIX (IBM), Mac OS X (Apple), Tru64 (Compaq), Gentoo Linux (Gentoo), Solaris (Sun), Sendmail Pro (Sendmail Inc), Sendmail (Sendmail Consortium), IRIX (SGI), HP-UX (HP), TurboLinux Server (TurboLinux), NetBSD (NetBSD), Sendmail Advanced Message Server (Sendmail Inc), Mac OS X Server (Apple), Sendmail (Sendmail Inc), TurboLinux Advanced Server (TurboLinux), FreeBSD (FreeBSD), Sendmail Switch (Sendmail Inc)|2003-10-06|10|High|The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.|Sendmail; http://www.sendmail.org/8.12.10.html;Sendmail 8.12.10,CERT; http://www.cert.org/advisories/CA-2003-25.html;Buffer Overflow in Sendmail,Security Focus; http://www.securityfocus.com/bid/8641;bid 8641,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106381604923204&amp;w=2;20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694],VULNWATCH; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0113.html;20030917 Zalewski Advisory - Sendmail 8.12.9 prescan bug,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-283.html;RHSA-2003:283,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-284.html;RHSA-2003:284,CONECTIVA; http://distro.conectiva.com.br/atualizacoes/?id=a&amp;anuncio=000742;CLA-2003:742,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:092;MDKSA-2003:092,DEBIAN; http://www.debian.org/security/2003/dsa-384;DSA-384,SCO; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt;SCOSA-2004.11,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106382859407683&amp;w=2;20030917 [slackware-security]  Sendmail vulnerabilities fixed (SSA:2003-260-02),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106398718909274&amp;w=2;20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail),OVAL; http://oval.mitre.org/oval/definitions/data/oval572.html;OVAL572,OVAL; http://oval.mitre.org/oval/definitions/data/oval603.html;OVAL603,OVAL; http://oval.mitre.org/oval/definitions/data/oval2975.html;OVAL2975,FULLDISC; http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4119.html;20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694],CERT-VN; http://www.kb.cert.org/vuls/id/784980;VU#784980,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106381604923204&amp;amp;w=2;20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694],CONECTIVA; http://distro.conectiva.com.br/atualizacoes/?id=a&amp;amp;anuncio=000742;CLA-2003:742,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106383437615742&amp;amp;w=2;20030917 GLSA:  sendmail (200309-13),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106382859407683&amp;amp;w=2;20030917 [slackware-security]  Sendmail vulnerabilities fixed (SSA:2003-260-02),BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106398718909274&amp;amp;w=2;20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail)|remote|input buffer="1"|sec_prot admin="1"
CVE-2003-0715|Windows XP (Microsoft), Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), Windows NT (Microsoft)|2003-09-17|10|High|Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.|Microsoft; http://www.microsoft.com/technet/security/bulletin/MS03-039.asp;Buffer Overrun In RPCSS Service Could Allow Code Execution (824146),Security Focus; http://www.securityfocus.com/bid/8458;bid 8458,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106322856608909&amp;amp;w=2;20030910 EEYE: Microsoft RPC Heap Corruption Vulnerability - Part II,CERT; http://www.cert.org/advisories/CA-2003-23.html;CA-2003-23,CERT-VN; http://www.kb.cert.org/vuls/id/483492;VU#483492,OVAL; http://oval.mitre.org/oval/definitions/data/oval264.html;OVAL264,OVAL; http://oval.mitre.org/oval/definitions/data/oval1202.html;OVAL1202,OVAL; http://oval.mitre.org/oval/definitions/data/oval1813.html;OVAL1813,OVAL; http://oval.mitre.org/oval/definitions/data/oval20.html;OVAL20,OVAL; http://oval.mitre.org/oval/definitions/data/oval4224.html;OVAL4224|remote|input bound="1"|sec_prot admin="1"
CVE-2003-0715|Windows XP (Microsoft), Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), Windows NT (Microsoft)|2003-09-17|10|High|Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.|Microsoft; http://www.microsoft.com/technet/security/bulletin/MS03-039.asp;Buffer Overrun In RPCSS Service Could Allow Code Execution (824146),Security Focus; http://www.securityfocus.com/bid/8458;bid 8458,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106322856608909&amp;amp;w=2;20030910 EEYE: Microsoft RPC Heap Corruption Vulnerability - Part II,CERT; http://www.cert.org/advisories/CA-2003-23.html;CA-2003-23,CERT-VN; http://www.kb.cert.org/vuls/id/483492;VU#483492,OVAL; http://oval.mitre.org/oval/definitions/data/oval264.html;OVAL264,OVAL; http://oval.mitre.org/oval/definitions/data/oval1202.html;OVAL1202,OVAL; http://oval.mitre.org/oval/definitions/data/oval1813.html;OVAL1813,OVAL; http://oval.mitre.org/oval/definitions/data/oval20.html;OVAL20,OVAL; http://oval.mitre.org/oval/definitions/data/oval4224.html;OVAL4224|remote|input bound="1"|sec_prot admin="1"
CVE-2003-0722|Solaris (Sun)|2003-09-22|10|High|The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets.|MISC; http://www.idefense.com/advisory/09.16.03.txt;http://www.idefense.com/advisory/09.16.03.txt,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106391959014331&amp;amp;w=2;20030918 Solaris SADMIND Exploitation,VULNWATCH; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0115.html;20030918 Solaris SADMIND Exploitation,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-56740-1&amp;amp;searchclause=security;56740,CERT-VN; http://www.kb.cert.org/vuls/id/41870;VU#41870,CIAC; http://www.ciac.org/ciac/bulletins/n-148.shtml;N-148,BID; http://www.securityfocus.com/bid/8615;8615,OVAL; http://oval.mitre.org/oval/definitions/data/oval1273.html;OVAL1273,SECUNIA; http://secunia.com/advisories/9742;9742|local,remote|design|sec_prot admin="1"
CVE-2003-0780|MySQL (MySQL AB), Conectiva Linux (Conectiva)|2003-09-22|10|High|Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.|Security Focus; http://www.securityfocus.com/archive/1/337012;Buffer overflow in MySQL,lists.netsys.com; http://lists.netsys.com/pipermail/full-disclosure/2003-September/009819.html;[Full-Disclosure] Buffer overflow in MySQL,The Aims group; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106364207129993&amp;w=2;exploit for mysql -- [get_salt_from_password] problem,debian; http://www.debian.org/security/2003/dsa-381;DSA-381-1 mysql -- buffer overflow,Red Hat; http://www.redhat.com/support/errata/RHSA-2003-281.html;Updated MySQL packages fix vulnerability,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009819.html;20030910 Buffer overflow in MySQL,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106364207129993&amp;amp;w=2;20030913 exploit for mysql -- [get_salt_from_password] problem,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:094;MDKSA-2003:094,CONECTIVA; http://distro.conectiva.com.br/atualizacoes/?id=a&amp;amp;anuncio=000743;CLA-2003:743,REDHAT; http://www.redhat.com/support/errata/RHSA-2003-282.html;RHSA-2003:282,TRUSTIX; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106381424420775&amp;amp;w=2;2003-0034,CERT-VN; http://www.kb.cert.org/vuls/id/516492;VU#516492,SECUNIA; http://secunia.com/advisories/9709;9709|remote|input buffer="1"|sec_prot admin="1"
CVE-2003-0813|Windows XP (Microsoft), Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), Windows NT (Microsoft)|2003-11-17|8|High|A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.|CERT; http://www.kb.cert.org/vuls/id/547820;Microsoft Windows DCOM/RPC vulnerability,ISS X-Force; http://xforce.iss.net/xforce/alerts/id/155;Microsoft RPC Race Condition Denial of Service,Netsys.com; http://lists.netsys.com/pipermail/full-disclosure/2003-October/011870.html;BAD news on RPC DCOM Exploit,Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106579825211708&amp;w=2;Bad news on RPC DCOM vulnerability,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106579825211708&amp;amp;w=2;20031010 Bad news on RPC DCOM vulnerability,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106588827513795&amp;amp;w=2;20031011 RE: Bad news on RPC DCOM vulnerability,NTBUGTRAQ; http://marc.theaimsgroup.com/?l=ntbugtraq&amp;amp;m=106580303918155&amp;amp;w=2;20031010 Bad news on RPC DCOM vulnerability,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011870.html;20031010 Re : [VERY] BAD news on RPC DCOM Exploit,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011886.html;20031010 Re: Bad news on RPC DCOM vulnerability,MISC; http://www.securitylab.ru/_exploits/rpc2.c.txt;http://www.securitylab.ru/_exploits/rpc2.c.txt,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011901.html;20031011 Bad news on RPC DCOM2 vulnerability,CERT; http://www.us-cert.gov/cas/techalerts/TA04-104A.html;TA04-104A,OVAL; http://oval.mitre.org/oval/definitions/data/oval893.html;OVAL893,OVAL; http://oval.mitre.org/oval/definitions/data/oval894.html;OVAL894,OVAL; http://oval.mitre.org/oval/definitions/data/oval900.html;OVAL900,BID; http://www.securityfocus.com/bid/8811;8811|remote|race|avail,sec_prot other="1"
CVE-2003-0813|Windows XP (Microsoft), Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), Windows NT (Microsoft)|2003-11-17|8|High|A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.|CERT; http://www.kb.cert.org/vuls/id/547820;Microsoft Windows DCOM/RPC vulnerability,ISS X-Force; http://xforce.iss.net/xforce/alerts/id/155;Microsoft RPC Race Condition Denial of Service,Netsys.com; http://lists.netsys.com/pipermail/full-disclosure/2003-October/011870.html;BAD news on RPC DCOM Exploit,Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106579825211708&amp;w=2;Bad news on RPC DCOM vulnerability,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106579825211708&amp;amp;w=2;20031010 Bad news on RPC DCOM vulnerability,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106588827513795&amp;amp;w=2;20031011 RE: Bad news on RPC DCOM vulnerability,NTBUGTRAQ; http://marc.theaimsgroup.com/?l=ntbugtraq&amp;amp;m=106580303918155&amp;amp;w=2;20031010 Bad news on RPC DCOM vulnerability,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011870.html;20031010 Re : [VERY] BAD news on RPC DCOM Exploit,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011886.html;20031010 Re: Bad news on RPC DCOM vulnerability,MISC; http://www.securitylab.ru/_exploits/rpc2.c.txt;http://www.securitylab.ru/_exploits/rpc2.c.txt,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011901.html;20031011 Bad news on RPC DCOM2 vulnerability,CERT; http://www.us-cert.gov/cas/techalerts/TA04-104A.html;TA04-104A,OVAL; http://oval.mitre.org/oval/definitions/data/oval893.html;OVAL893,OVAL; http://oval.mitre.org/oval/definitions/data/oval894.html;OVAL894,OVAL; http://oval.mitre.org/oval/definitions/data/oval900.html;OVAL900,BID; http://www.securityfocus.com/bid/8811;8811|remote|race|avail,sec_prot other="1"
CVE-2003-0845|JBoss (JBoss Group)|2003-11-17|10|High|Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to (1) TCP port 1701 in JBoss 3.2.1, and (2) port 1476 in JBoss 3.0.8.|Security Focus; http://www.securityfocus.com/bid/8773;BID:8773,The Aims Group; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106546044416498&amp;w=2;20031005 JBoss 3.2.1: Remote Command Injection,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106546044416498&amp;amp;w=2;20031005 JBoss 3.2.1: Remote Command Injection,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=106547728803252&amp;amp;w=2;20031006 Update JBoss 308 &amp;amp; 321: Remote Command Injection,CONFIRM; http://sourceforge.net/docman/display_doc.php?docid=19314&amp;amp;group_id=22866;http://sourceforge.net/docman/display_doc.php?docid=19314&amp;amp;group_id=22866|remote|other|avail,conf,int,sec_prot other="1"
CVE-2004-0400|Exim (University of Cambridge)|2004-07-07|8|High|Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.|Full-Disclosure; http://lists.netsys.com/pipermail/full-disclosure/2004-May/021015.html;20040506 Buffer overflows in exim, yet still exim much better than windows,Quininski; http://www.guninski.com/exim1.html;Georgi Guninski security advisory #68,Debian; http://www.debian.org/security/2004/dsa-501;DSA-501,Debian; http://www.debian.org/security/2004/dsa-502;DSA-502,ISS X-Force; http://xforce.iss.net/xforce/xfdb/16077;exim-headerschecksyntax-bo(16077),FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021015.html;20040506 Buffer overflows in exim, yet still exim much better than windows|remote|input buffer="1"|avail,sec_prot other="1"
CVE-2004-0627|MySQL (MySQL AB)|2004-12-06|10|High|The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled string.|Vulnwatch; http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0001.html;20040705 MySQL Authentication Bypass,Bugtraq; http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108904917528205&amp;w=2;20040705 MySQL Authentication Bypass,CERT; http://www.kb.cert.org/vuls/id/184030;VU#184030,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=108904917528205&amp;amp;w=2;20040705 MySQL Authentication Bypass|remote|access,exception|sec_prot admin="1" user="1" other="1"
CVE-2004-1019|Ubuntu Linux (Ubuntu), PHP (PHP), Secure Linux (Trustix), Secure Enterprise Linux (Trustix), OpenPKG (OpenPKG)|2005-01-10|10|High|The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double free and negative reference index array underflow" results.|Security Focus; http://www.securityfocus.com/bid/11964;PHP Multiple Local And Remote Vulnerabilities,RedHat; http://www.redhat.com/support/errata/RHSA-2004-687.html;Updated php packages fix security issues and bugs,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=110314318531298&amp;amp;w=2;20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5,MISC; http://www.hardened-php.net/advisories/012004.txt;http://www.hardened-php.net/advisories/012004.txt,CONFIRM; http://www.php.net/release_4_3_10.php;http://www.php.net/release_4_3_10.php,BUGTRAQ; http://msgs.securepoint.com/cgi-bin/get/bugtraq0412/157.html;20041216 [OpenPKG-SA-2004.053] OpenPKG Security Advisory (php),FEDORA; https://bugzilla.fedora.us/show_bug.cgi?id=2344;FLSA:2344,MANDRAKE; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:151;MDKSA-2004:151,REDHAT; http://www.redhat.com/support/errata/RHSA-2005-032.html;RHSA-2005:032,SUSE; http://www.novell.com/linux/security/advisories/2005_02_php4_mod_php4.html;SUSE-SA:2005:002,XF; http://xforce.iss.net/xforce/xfdb/18514;php-unserialize-code-execution(18514),HP; http://www.securityfocus.com/advisories/9028;HPSBMA01212|remote|design|avail,sec_prot admin="1" user="1"
CVE-2005-1797|OpenSSL (OpenSSL Project)|2005-05-26|7|High|The design of Advanced Encryption Standard (AES), aka Rijndael, allows remote attackers to recover AES keys via timing attacks on S-box lookups, which are difficult to perform in constant time in AES implementations.|MISC; http://cr.yp.to/antiforgery/cachetiming-20050414.pdf;http://cr.yp.to/antiforgery/cachetiming-20050414.pdf,BID; http://www.securityfocus.com/bid/13785;13785|remote|design,race|sec_prot
CVE-2005-1983|Windows 2000 (Microsoft), Windows XP (Microsoft)|2005-08-10|10|High|Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm.|MS; http://www.microsoft.com/technet/Security/bulletin/ms05-039.mspx;MS05-039,CERT; http://www.us-cert.gov/cas/techalerts/TA05-221A.html;TA05-221A,ISS; http://xforce.iss.net/xforce/alerts/id/202;20050809 Windows Plug and Play Remote Compromise,CERT-VN; http://www.kb.cert.org/vuls/id/998653;VU#998653,CIAC; http://www.ciac.org/ciac/bulletins/p-266.shtml;P-266,MISC; http://www.securiteam.com/windowsntfocus/5YP0E00GKW.html;http://www.securiteam.com/windowsntfocus/5YP0E00GKW.html,MISC; http://www.frsirt.com/english/alerts/20050814.ZotobA.php;http://www.frsirt.com/english/alerts/20050814.ZotobA.php,FULLDISC; http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0384.html;20050811 Windows 2000 universal exploit for MS05-039,BID; http://www.securityfocus.com/bid/14513;14513,FRSIRT; http://www.frsirt.com/english/advisories/2005/1354;ADV-2005-1354,SECUNIA; http://secunia.com/advisories/16372;16372,SECTRACK; http://securitytracker.com/id?1014640;1014640,OSVDB; http://www.osvdb.org/18605;18605,XF; http://xforce.iss.net/xforce/xfdb/21602;win-plugandplay-bo(21602),MISC; http://www.hsc.fr/ressources/presentations/null_sessions/;http://www.hsc.fr/ressources/presentations/null_sessions/,OVAL; http://oval.mitre.org/oval/definitions/data/oval100073.html;OVAL100073|local,remote|input buffer="1"|sec_prot admin="1" user="1"
CVE-2005-2797|OpenSSH (OpenBSD)|2005-09-06|3.3|Low|OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding (&amp;quot;-D&amp;quot; option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality.|MLIST; http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html;[openssh-unix-announce] 20050901 Announce: OpenSSH 4.2 released,SECUNIA; http://secunia.com/advisories/16686;16686,BUGTRAQ; http://marc.theaimsgroup.com/?l=bugtraq&amp;amp;m=112605977304049&amp;amp;w=2;20050906 [OpenPKG-SA-2005.019] OpenPKG Security Advisory (openssh),SCO; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.53/SCOSA-2005.53.txt;SCOSA-2005.53,SECUNIA; http://secunia.com/advisories/18010;18010,BID; http://www.securityfocus.com/bid/14727;14727,SCO; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.11/SCOSA-2006.11.txt;SCOSA-2006.11,SECUNIA; http://secunia.com/advisories/19243;19243|remote|config|int
CVE-2005-2969|OpenSSL (OpenSSL)|2005-10-18|3.3|Low|The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.|SUSE; http://www.novell.com/linux/security/advisories/2005_61_openssl.html;SUSE-SA:2005:061,NSO; http://www.openssl.org/news/secadv_20051011.txt adv=1 patch=1;http://www.openssl.org/news/secadv_20051011.txt adv=1 patch=1,REDHAT; http://www.redhat.com/support/errata/RHSA-2005-800.html;RHSA-2005:800,DEBIAN; http://www.debian.org/security/2005/dsa-875;DSA-875,MANDRIVA; http://www.mandriva.com/security/advisories?name=MDKSA-2005:179;MDKSA-2005:179,TRUSTIX; http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html;TSLSA-2005-0059,DEBIAN; http://www.debian.org/security/2005/dsa-881;DSA-881,DEBIAN; http://www.debian.org/security/2005/dsa-882;DSA-882,APPLE; http://docs.info.apple.com/article.html?artnum=302847;APPLE-SA-2005-11-29,BID; http://www.securityfocus.com/bid/15647;15647,SECUNIA; http://secunia.com/advisories/17813;17813,CISCO; http://www.cisco.com/warp/public/707/cisco-response-20051202-openssl.shtml;20051202 Cisco Security Notice: Response to OpenSSL - Potential SSL 2.0 Rollback,FRSIRT; http://www.frsirt.com/english/advisories/2005/2710;ADV-2005-2710,SECUNIA; http://secunia.com/advisories/17888;17888,FRSIRT; http://www.frsirt.com/english/advisories/2005/2908;ADV-2005-2908,SECUNIA; http://secunia.com/advisories/18045;18045,NSO; http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754;http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754,BID; http://www.securityfocus.com/bid/15071;15071,FRSIRT; http://www.frsirt.com/english/advisories/2005/2036;ADV-2005-2036,FRSIRT; http://www.frsirt.com/english/advisories/2005/3002;ADV-2005-3002,SECUNIA; http://secunia.com/advisories/17151;17151,SECUNIA; http://secunia.com/advisories/18165;18165,NSO; http://www.juniper.net/support/security/alerts/PSN-2005-12-025.txt;http://www.juniper.net/support/security/alerts/PSN-2005-12-025.txt,FRSIRT; http://www.frsirt.com/english/advisories/2005/3056;ADV-2005-3056,SECUNIA; http://secunia.com/advisories/18123;18123,SECTRACK; http://securitytracker.com/id?1015032;1015032,SECUNIA; http://secunia.com/advisories/17146;17146,SECUNIA; http://secunia.com/advisories/17153;17153,SECUNIA; http://secunia.com/advisories/17169;17169,SECUNIA; http://secunia.com/advisories/17178;17178,SECUNIA; http://secunia.com/advisories/17180;17180,SECUNIA; http://secunia.com/advisories/17189;17189,SECUNIA; http://secunia.com/advisories/17191;17191,SECUNIA; http://secunia.com/advisories/17210;17210,SECUNIA; http://secunia.com/advisories/17259;17259,SECUNIA; http://secunia.com/advisories/17288;17288,SECUNIA; http://secunia.com/advisories/17335;17335,SECUNIA; http://secunia.com/advisories/17344;17344,SECUNIA; http://secunia.com/advisories/17389;17389,SECUNIA; http://secunia.com/advisories/17409;17409,SECUNIA; http://secunia.com/advisories/17432;17432,SECUNIA; http://secunia.com/advisories/17466;17466,SECUNIA; http://secunia.com/advisories/17589;17589,SECUNIA; http://secunia.com/advisories/17617;17617,SECUNIA; http://secunia.com/advisories/17632;17632,FRSIRT; http://www.frsirt.com/english/advisories/2005/2659;ADV-2005-2659,REDHAT; http://www.redhat.com/support/errata/RHSA-2005-762.html;RHSA-2005:762|remote|config|int
CVE-2005-4765||2005-12-31>
|||BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection.|BEA; http://dev2dev.bea.com/pub/advisory/156;BEA05-102.00,BID; http://www.securityfocus.com/bid/15052;15052,SECUNIA; http://secunia.com/advisories/17138;17138|||
CVE-2006-0034|Windows NT (Microsoft), Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), Microsoft Distributed Transaction Coordinator (Microsoft), Windows XP (Microsoft)|2006-05-09|7.0|High|Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, aka the MSDTC Invalid Memory Access Vulnerability.|BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/433430/100/0/threaded;20060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow,NSO; http://www.eeye.com/html/research/advisories/AD20060509a.html adv=1 patch=1;http://www.eeye.com/html/research/advisories/AD20060509a.html adv=1 patch=1,MS; http://www.microsoft.com/technet/security/bulletin/ms06-018.mspx;MS06-018,BID; http://www.securityfocus.com/bid/17906;17906,FRSIRT; http://www.frsirt.com/english/advisories/2006/1742;ADV-2006-1742,SECUNIA; http://secunia.com/advisories/20000;20000,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/433677/100/0/threaded;20060511 Microsoft MSDTC NdrAllocate Validation Vulnerability,SECTRACK; http://securitytracker.com/id?1016047;1016047,FULLDISC; http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0238.html;20060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow,FULLDISC; http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0269.html;20060510 Microsoft MSDTC NdrAllocate Validation Vulnerability,OSVDB; http://www.osvdb.org/25335;25335,OVAL; http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1222;oval:org.mitre.oval:def:1222,OVAL; http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1477;oval:org.mitre.oval:def:1477,OVAL; http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1908;oval:org.mitre.oval:def:1908|remote|input buffer="1"|avail,conf,int,sec_prot user="1"
CVE-2006-0058|Sendmail (Sendmail Consortium)|2006-03-22|8.0|High|Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.|ISS; http://xforce.iss.net/xforce/alerts/id/216;20060322 Sendmail Remote Signal Handling Vulnerability,REDHAT; http://www.redhat.com/support/errata/RHSA-2006-0264.html;RHSA-2006:0264,REDHAT; http://www.redhat.com/support/errata/RHSA-2006-0265.html;RHSA-2006:0265,FRSIRT; http://www.frsirt.com/english/advisories/2006/1049;ADV-2006-1049,FRSIRT; http://www.frsirt.com/english/advisories/2006/1051;ADV-2006-1051,BUGTRAQ; http://www.securityfocus.com/archive/1/428536/100/0/threaded;20060322 sendmail vuln advisories (CVE-2006-0058),NSO; http://www.sendmail.com/company/advisory/index.shtml;http://www.sendmail.com/company/advisory/index.shtml,DEBIAN; http://www.debian.org/security/2006/dsa-1015;DSA-1015,GENTOO; http://www.gentoo.org/security/en/glsa/glsa-200603-21.xml;GLSA-200603-21,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:058;MDKSA-2006:058,OPENPKG; http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.007-sendmail.html;OpenPKG-SA-2006.007,CERT; http://www.us-cert.gov/cas/techalerts/TA06-081A.html;TA06-081A,CERT-VN; http://www.kb.cert.org/vuls/id/834865;VU#834865,SECUNIA; http://secunia.com/advisories/19342;19342,SECUNIA; http://secunia.com/advisories/19363;19363,SECUNIA; http://secunia.com/advisories/19367;19367,FEDORA; http://www.securityfocus.com/archive/1/archive/1/428656/100/0/threaded;FLSA:186277,FREEBSD; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:13.sendmail.asc;FreeBSD-SA-06:13,SUSE; http://www.novell.com/linux/security/advisories/2006_17_sendmail.html;SUSE-SA:2006:017,NSO; http://support.avaya.com/elmodocs2/security/ASA-2006-074.htm;http://support.avaya.com/elmodocs2/security/ASA-2006-074.htm,HP; http://www.securityfocus.com/archive/1/archive/1/428892/100/0/threaded;HPSBUX02108,OPENBSD; http://www.openbsd.org/errata38.html#sendmail;[3.8] 006: SECURITY FIX: March 25, 2006,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102262-1;102262,BID; http://www.securityfocus.com/bid/17192;17192,FRSIRT; http://www.frsirt.com/english/advisories/2006/1068;ADV-2006-1068,FRSIRT; http://www.frsirt.com/english/advisories/2006/1072;ADV-2006-1072,OSVDB; http://www.osvdb.org/24037;24037,SECTRACK; http://securitytracker.com/id?1015801;1015801,SECUNIA; http://secunia.com/advisories/19368;19368,SECUNIA; http://secunia.com/advisories/19404;19404,SECUNIA; http://secunia.com/advisories/19407;19407,SECUNIA; http://secunia.com/advisories/19349;19349,SECUNIA; http://secunia.com/advisories/19360;19360,SECUNIA; http://secunia.com/advisories/19361;19361,XF; http://xforce.iss.net/xforce/xfdb/24584;smtp-timeout-bo(24584),NSO; http://www.f-secure.com/security/fsc-2006-2.shtml;http://www.f-secure.com/security/fsc-2006-2.shtml,NETBSD; ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-010.txt.asc;NetBSD-SA2006-010,FRSIRT; http://www.frsirt.com/english/advisories/2006/1139;ADV-2006-1139,FRSIRT; http://www.frsirt.com/english/advisories/2006/1157;ADV-2006-1157,SECUNIA; http://secunia.com/advisories/19394;19394,SECUNIA; http://secunia.com/advisories/19450;19450,SECUNIA; http://secunia.com/advisories/19466;19466,AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;q=IY82992&amp;apar=only;IY82992,AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;q=IY82993&amp;apar=only;IY82993,AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;q=IY82994&amp;apar=only;IY82994,SLACKWARE; http://slackware.com/security/viewer.php?l=slackware-security&amp;y=2006&amp;m=slackware-security.619600;SSA:2006-081-01,SGI; ftp://patches.sgi.com/support/free/security/advisories/20060302-01-P;20060302-01-P,SGI; ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U;20060401-01-U,SECUNIA; http://secunia.com/advisories/19533;19533,SECUNIA; http://secunia.com/advisories/19532;19532,FEDORA; http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00018.html;FEDORA-2006-193,FEDORA; http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00017.html;FEDORA-2006-194,CIAC; http://www.ciac.org/ciac/bulletins/q-151.shtml;Q-151,SECUNIA; http://secunia.com/advisories/19345;19345,SECUNIA; http://secunia.com/advisories/19346;19346,SECUNIA; http://secunia.com/advisories/19356;19356,NSO; http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm;http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm,SECUNIA; http://secunia.com/advisories/19676;19676,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102324-1;102324,FRSIRT; http://www.frsirt.com/english/advisories/2006/1529;ADV-2006-1529,SECUNIA; http://secunia.com/advisories/19774;19774,SCO; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.24/SCOSA-2006.24.txt;SCOSA-2006.24,SECUNIA; http://secunia.com/advisories/20243;20243,HP; http://itrc.hp.com/service/cki/docDisplay.do?docId=c00692635;HPSBTU02116,FRSIRT; http://www.frsirt.com/english/advisories/2006/2189;ADV-2006-2189,NSO; http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688;http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688,NSO; http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&amp;ID=2751;http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&amp;ID=2751,FRSIRT; http://www.frsirt.com/english/advisories/2006/2490;ADV-2006-2490,SECUNIA; http://secunia.com/advisories/20723;20723,HP; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&amp;cc=us&amp;objectID=c00629555;HPSBUX02108,OVAL; http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1689;oval:org.mitre.oval:def:1689|remote|race|avail,conf,int,sec_prot admin="1"
CVE-2006-0058|Sendmail (Sendmail Consortium)|2006-03-22|8.0|High|Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.|ISS; http://xforce.iss.net/xforce/alerts/id/216;20060322 Sendmail Remote Signal Handling Vulnerability,REDHAT; http://www.redhat.com/support/errata/RHSA-2006-0264.html;RHSA-2006:0264,REDHAT; http://www.redhat.com/support/errata/RHSA-2006-0265.html;RHSA-2006:0265,FRSIRT; http://www.frsirt.com/english/advisories/2006/1049;ADV-2006-1049,FRSIRT; http://www.frsirt.com/english/advisories/2006/1051;ADV-2006-1051,BUGTRAQ; http://www.securityfocus.com/archive/1/428536/100/0/threaded;20060322 sendmail vuln advisories (CVE-2006-0058),NSO; http://www.sendmail.com/company/advisory/index.shtml;http://www.sendmail.com/company/advisory/index.shtml,DEBIAN; http://www.debian.org/security/2006/dsa-1015;DSA-1015,GENTOO; http://www.gentoo.org/security/en/glsa/glsa-200603-21.xml;GLSA-200603-21,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:058;MDKSA-2006:058,OPENPKG; http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.007-sendmail.html;OpenPKG-SA-2006.007,CERT; http://www.us-cert.gov/cas/techalerts/TA06-081A.html;TA06-081A,CERT-VN; http://www.kb.cert.org/vuls/id/834865;VU#834865,SECUNIA; http://secunia.com/advisories/19342;19342,SECUNIA; http://secunia.com/advisories/19363;19363,SECUNIA; http://secunia.com/advisories/19367;19367,FEDORA; http://www.securityfocus.com/archive/1/archive/1/428656/100/0/threaded;FLSA:186277,FREEBSD; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:13.sendmail.asc;FreeBSD-SA-06:13,SUSE; http://www.novell.com/linux/security/advisories/2006_17_sendmail.html;SUSE-SA:2006:017,NSO; http://support.avaya.com/elmodocs2/security/ASA-2006-074.htm;http://support.avaya.com/elmodocs2/security/ASA-2006-074.htm,HP; http://www.securityfocus.com/archive/1/archive/1/428892/100/0/threaded;HPSBUX02108,OPENBSD; http://www.openbsd.org/errata38.html#sendmail;[3.8] 006: SECURITY FIX: March 25, 2006,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102262-1;102262,BID; http://www.securityfocus.com/bid/17192;17192,FRSIRT; http://www.frsirt.com/english/advisories/2006/1068;ADV-2006-1068,FRSIRT; http://www.frsirt.com/english/advisories/2006/1072;ADV-2006-1072,OSVDB; http://www.osvdb.org/24037;24037,SECTRACK; http://securitytracker.com/id?1015801;1015801,SECUNIA; http://secunia.com/advisories/19368;19368,SECUNIA; http://secunia.com/advisories/19404;19404,SECUNIA; http://secunia.com/advisories/19407;19407,SECUNIA; http://secunia.com/advisories/19349;19349,SECUNIA; http://secunia.com/advisories/19360;19360,SECUNIA; http://secunia.com/advisories/19361;19361,XF; http://xforce.iss.net/xforce/xfdb/24584;smtp-timeout-bo(24584),NSO; http://www.f-secure.com/security/fsc-2006-2.shtml;http://www.f-secure.com/security/fsc-2006-2.shtml,NETBSD; ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-010.txt.asc;NetBSD-SA2006-010,FRSIRT; http://www.frsirt.com/english/advisories/2006/1139;ADV-2006-1139,FRSIRT; http://www.frsirt.com/english/advisories/2006/1157;ADV-2006-1157,SECUNIA; http://secunia.com/advisories/19394;19394,SECUNIA; http://secunia.com/advisories/19450;19450,SECUNIA; http://secunia.com/advisories/19466;19466,AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;q=IY82992&amp;apar=only;IY82992,AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;q=IY82993&amp;apar=only;IY82993,AIXAPAR; http://www-1.ibm.com/support/search.wss?rs=0&amp;q=IY82994&amp;apar=only;IY82994,SLACKWARE; http://slackware.com/security/viewer.php?l=slackware-security&amp;y=2006&amp;m=slackware-security.619600;SSA:2006-081-01,SGI; ftp://patches.sgi.com/support/free/security/advisories/20060302-01-P;20060302-01-P,SGI; ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U;20060401-01-U,SECUNIA; http://secunia.com/advisories/19533;19533,SECUNIA; http://secunia.com/advisories/19532;19532,FEDORA; http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00018.html;FEDORA-2006-193,FEDORA; http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00017.html;FEDORA-2006-194,CIAC; http://www.ciac.org/ciac/bulletins/q-151.shtml;Q-151,SECUNIA; http://secunia.com/advisories/19345;19345,SECUNIA; http://secunia.com/advisories/19346;19346,SECUNIA; http://secunia.com/advisories/19356;19356,NSO; http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm;http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm,SECUNIA; http://secunia.com/advisories/19676;19676,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102324-1;102324,FRSIRT; http://www.frsirt.com/english/advisories/2006/1529;ADV-2006-1529,SECUNIA; http://secunia.com/advisories/19774;19774,SCO; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.24/SCOSA-2006.24.txt;SCOSA-2006.24,SECUNIA; http://secunia.com/advisories/20243;20243,HP; http://itrc.hp.com/service/cki/docDisplay.do?docId=c00692635;HPSBTU02116,FRSIRT; http://www.frsirt.com/english/advisories/2006/2189;ADV-2006-2189,NSO; http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688;http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688,NSO; http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&amp;ID=2751;http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&amp;ID=2751,FRSIRT; http://www.frsirt.com/english/advisories/2006/2490;ADV-2006-2490,SECUNIA; http://secunia.com/advisories/20723;20723,HP; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&amp;cc=us&amp;objectID=c00629555;HPSBUX02108,OVAL; http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1689;oval:org.mitre.oval:def:1689|remote|race|avail,conf,int,sec_prot admin="1"
CVE-2006-3439|Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), Windows XP (Microsoft)|2006-08-08|10.0|High|Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314.|MS; http://www.microsoft.com/technet/security/bulletin/ms06-040.mspx;MS06-040,CERT; http://www.us-cert.gov/cas/techalerts/TA06-220A.html;TA06-220A,CERT-VN; http://www.kb.cert.org/vuls/id/650769;VU#650769,FRSIRT; http://www.frsirt.com/english/advisories/2006/3210;ADV-2006-3210,SECUNIA; http://secunia.com/advisories/21388;21388,NSO; http://www.dhs.gov/dhspublic/display?content=5789;http://www.dhs.gov/dhspublic/display?content=5789,BID; http://www.securityfocus.com/bid/19409;19409,SECTRACK; http://securitytracker.com/id?1016667;1016667,XF; http://xforce.iss.net/xforce/xfdb/28002;ms-server-service-bo(28002),CISCO; http://www.cisco.com/en/US/products/ps6120/tsd_products_security_response09186a008070c75a.html;20060814 Mitigating Exploitation of the MS06-040 Service Buffer Vulnerability,OVAL; http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:492;oval:org.mitre.oval:def:492|remote|input buffer="1"|avail,conf,int,sec_prot admin="1"
CVE-2006-3439|Windows 2000 (Microsoft), Windows Server 2003 (Microsoft), Windows XP (Microsoft)|2006-08-08|10.0|High|Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314.|MS; http://www.microsoft.com/technet/security/bulletin/ms06-040.mspx;MS06-040,CERT; http://www.us-cert.gov/cas/techalerts/TA06-220A.html;TA06-220A,CERT-VN; http://www.kb.cert.org/vuls/id/650769;VU#650769,FRSIRT; http://www.frsirt.com/english/advisories/2006/3210;ADV-2006-3210,SECUNIA; http://secunia.com/advisories/21388;21388,NSO; http://www.dhs.gov/dhspublic/display?content=5789;http://www.dhs.gov/dhspublic/display?content=5789,BID; http://www.securityfocus.com/bid/19409;19409,SECTRACK; http://securitytracker.com/id?1016667;1016667,XF; http://xforce.iss.net/xforce/xfdb/28002;ms-server-service-bo(28002),CISCO; http://www.cisco.com/en/US/products/ps6120/tsd_products_security_response09186a008070c75a.html;20060814 Mitigating Exploitation of the MS06-040 Service Buffer Vulnerability,OVAL; http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:492;oval:org.mitre.oval:def:492|remote|input buffer="1"|avail,conf,int,sec_prot admin="1"
CVE-2006-3738|OpenSSL (OpenSSL Project)|2006-09-28|7.0|High|Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.|SECUNIA; http://secunia.com/advisories/22385;22385,SECUNIA; http://secunia.com/advisories/22460;22460,NSO; http://www.openssl.org/news/secadv_20060928.txt;http://www.openssl.org/news/secadv_20060928.txt,CERT-VN; http://www.kb.cert.org/vuls/id/547300;VU#547300,BID; http://www.securityfocus.com/bid/20249;20249,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html;20060928 [SECURITY] OpenSSL 0.9.8d and 0.9.7l released,NSO; https://issues.rpath.com/browse/RPL-613;https://issues.rpath.com/browse/RPL-613,DEBIAN; http://www.debian.org/security/2006/dsa-1185;DSA-1185,FREEBSD; http://security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.asc;FreeBSD-SA-06:23.openssl,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:172;MDKSA-2006:172,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:177;MDKSA-2006:177,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:178;MDKSA-2006:178,REDHAT; http://www.redhat.com/support/errata/RHSA-2006-0695.html;RHSA-2006:0695,SLACKWARE; http://slackware.com/security/viewer.php?l=slackware-security&amp;y=2006&amp;m=slackware-security.676946;SSA:2006-272-01,UBUNTU; http://www.ubuntu.com/usn/usn-353-1;USN-353-1,FRSIRT; http://www.frsirt.com/english/advisories/2006/3820;ADV-2006-3820,FRSIRT; http://www.frsirt.com/english/advisories/2006/3860;ADV-2006-3860,SECUNIA; http://secunia.com/advisories/22130;22130,SECUNIA; http://secunia.com/advisories/22094;22094,SECUNIA; http://secunia.com/advisories/22165;22165,SECUNIA; http://secunia.com/advisories/22186;22186,SECUNIA; http://secunia.com/advisories/22193;22193,SECUNIA; http://secunia.com/advisories/22207;22207,SECUNIA; http://secunia.com/advisories/22259;22259,SECUNIA; http://secunia.com/advisories/22260;22260,XF; http://xforce.iss.net/xforce/xfdb/29237;openssl-sslgetsharedciphers-bo(29237),NSO; http://kolab.org/security/kolab-vendor-notice-11.txt patch=1;http://kolab.org/security/kolab-vendor-notice-11.txt patch=1,OPENPKG; http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.021-openssl.html;OpenPKG-SA-2006.021,SUSE; http://www.novell.com/linux/security/advisories/2006_58_openssl.html;SUSE-SA:2006:058,TRUSTIX; http://www.trustix.org/errata/2006/0054;2006-0054,FRSIRT; http://www.frsirt.com/english/advisories/2006/3902;ADV-2006-3902,SECTRACK; http://securitytracker.com/id?1016943;1016943,SECUNIA; http://secunia.com/advisories/22166;22166,SECUNIA; http://secunia.com/advisories/22172;22172,SECUNIA; http://secunia.com/advisories/22212;22212,SECUNIA; http://secunia.com/advisories/22240;22240,SECUNIA; http://secunia.com/advisories/22216;22216,SECUNIA; http://secunia.com/advisories/22116;22116,SECUNIA; http://secunia.com/advisories/22220;22220,NSO; http://openvpn.net/changelog.html patch=1;http://openvpn.net/changelog.html patch=1,NSO; http://www.serv-u.com/releasenotes/ patch=1;http://www.serv-u.com/releasenotes/ patch=1,OPENBSD; http://openbsd.org/errata.html#openssl2;[3.9] 20061007 013: SECURITY FIX: October 7, 2006,FRSIRT; http://www.frsirt.com/english/advisories/2006/3869;ADV-2006-3869,FRSIRT; http://www.frsirt.com/english/advisories/2006/3936;ADV-2006-3936,SECUNIA; http://secunia.com/advisories/22284;22284,SECUNIA; http://secunia.com/advisories/22330;22330,NSO; http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm patch=1;http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm patch=1,DEBIAN; http://www.debian.org/security/2006/dsa-1195;DSA-1195,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102668-1;102668,SUSE; http://www.novell.com/linux/security/advisories/2006_24_sr.html;SUSE-SR:2006:024,FRSIRT; http://www.frsirt.com/english/advisories/2006/4036;ADV-2006-4036,OSVDB; http://www.osvdb.org/29262;29262,GENTOO; http://security.gentoo.org/glsa/glsa-200610-11.xml;GLSA-200610-11,SECUNIA; http://secunia.com/advisories/22500;22500,SECUNIA; http://secunia.com/advisories/22544;22544,NSO; http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&amp;DocumentOID=498093&amp;RenditionID=&amp;poid=8881;http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&amp;DocumentOID=498093&amp;RenditionID=&amp;poid=8881,SGI; ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc;20061001-01-P,FRSIRT; http://www.frsirt.com/english/advisories/2006/4314;ADV-2006-4314,FRSIRT; http://www.frsirt.com/english/advisories/2006/4264;ADV-2006-4264,SECUNIA; http://secunia.com/advisories/22626;22626,SECUNIA; http://secunia.com/advisories/22633;22633,SECUNIA; http://secunia.com/advisories/22654;22654,SECUNIA; http://secunia.com/advisories/22487;22487,NSO; http://sourceforge.net/project/shownotes.php?release_id=461863&amp;group_id=69227;http://sourceforge.net/project/shownotes.php?release_id=461863&amp;group_id=69227,CISCO; http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml;20061108 Multiple Vulnerabilities in OpenSSL library,CISCO; http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html;20061108 Multiple Vulnerabilities in OpenSSL Library,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102711-1;102711,FRSIRT; http://www.frsirt.com/english/advisories/2006/4417;ADV-2006-4417,FRSIRT; http://www.frsirt.com/english/advisories/2006/4401;ADV-2006-4401,FRSIRT; http://www.frsirt.com/english/advisories/2006/4443;ADV-2006-4443,SECUNIA; http://secunia.com/advisories/22758;22758,SECUNIA; http://secunia.com/advisories/22799;22799,SECUNIA; http://secunia.com/advisories/22791;22791,SECUNIA; http://secunia.com/advisories/22772;22772,SECUNIA; http://secunia.com/advisories/23038;23038,NSO; http://docs.info.apple.com/article.html?artnum=304829;http://docs.info.apple.com/article.html?artnum=304829,APPLE; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html;APPLE-SA-2006-11-28,CERT; http://www.us-cert.gov/cas/techalerts/TA06-333A.html;TA06-333A,FRSIRT; http://www.frsirt.com/english/advisories/2006/4750;ADV-2006-4750,SECUNIA; http://secunia.com/advisories/23155;23155,SECUNIA; http://secunia.com/advisories/22298;22298,NSO; http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm;http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm,GENTOO; http://www.gentoo.org/security/en/glsa/glsa-200612-11.xml;GLSA-200612-11,HP; http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100;HPSBUX02174,SECUNIA; http://secunia.com/advisories/23309;23309,SECUNIA; http://secunia.com/advisories/23280;23280,SECUNIA; http://secunia.com/advisories/23340;23340,NSO; http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html;http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html,NSO; http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html;http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html,NSO; http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html;http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html,NSO; http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html;http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html,NSO; http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html;http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html,NSO; http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html;http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html,SECUNIA; http://secunia.com/advisories/23680;23680,NSO; http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html;http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html,SECUNIA; http://secunia.com/advisories/23794;23794|remote|input buffer="1"|avail,conf,int,sec_prot user="1"
CVE-2006-3747|Ubuntu Linux (Ubuntu), Apache (Apache Software Foundation)|2006-07-28|7.0|High|Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.|NSO; http://www.apache.org/dist/httpd/Announcement2.0.html;http://www.apache.org/dist/httpd/Announcement2.0.html,NSO; http://svn.apache.org/viewvc?view=rev&amp;revision=426144;http://svn.apache.org/viewvc?view=rev&amp;revision=426144,CERT-VN; http://www.kb.cert.org/vuls/id/395412;VU#395412,UBUNTU; http://www.ubuntu.com/usn/usn-328-1;USN-328-1,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/441487/100/0/threaded;20060728 Apache mod_rewrite Buffer Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/441485/100/0/threaded;20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048267.html;20060728 Apache 1.3.29/2.X mod_rewrite Buffer Overflow Vulnerability CVE-2006-3747,FULLDISC; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048271.html;20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:133;MDKSA-2006:133,OPENPKG; http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.015-apache.html;OpenPKG-SA-2006.015,SUSE; http://www.novell.com/linux/security/advisories/2006_43_apache.html;SUSE-SA:2006:043,BID; http://www.securityfocus.com/bid/19204;19204,FRSIRT; http://www.frsirt.com/english/advisories/2006/3017;ADV-2006-3017,SECTRACK; http://securitytracker.com/id?1016601;1016601,SECUNIA; http://secunia.com/advisories/21197;21197,SECUNIA; http://secunia.com/advisories/21241;21241,XF; http://xforce.iss.net/xforce/xfdb/28063;apache-modrewrite-offbyone-bo(28063),NSO; http://kbase.redhat.com/faq/FAQ_68_8653.shtm;http://kbase.redhat.com/faq/FAQ_68_8653.shtm,DEBIAN; http://www.debian.org/security/2006/dsa-1131;DSA-1131,DEBIAN; http://www.debian.org/security/2006/dsa-1132;DSA-1132,GENTOO; http://security.gentoo.org/glsa/glsa-200608-01.xml;GLSA-200608-01,SECUNIA; http://secunia.com/advisories/21245;21245,SECUNIA; http://secunia.com/advisories/21266;21266,SECUNIA; http://secunia.com/advisories/21273;21273,SECUNIA; http://secunia.com/advisories/21284;21284,SECUNIA; http://secunia.com/advisories/21313;21313,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/441526/100/200/threaded;20060728 rPSA-2006-0139-1 httpd mod_ssl,NSO; https://issues.rpath.com/browse/RPL-538;https://issues.rpath.com/browse/RPL-538,AIXAPAR; http://www-1.ibm.com/support/docview.wss?uid=swg24013080;PK27875,AIXAPAR; http://www-1.ibm.com/support/docview.wss?uid=swg1PK29154;PK29154,AIXAPAR; http://www-1.ibm.com/support/docview.wss?uid=swg1PK29156;PK29156,FRSIRT; http://www.frsirt.com/english/advisories/2006/3264;ADV-2006-3264,FRSIRT; http://www.frsirt.com/english/advisories/2006/3282;ADV-2006-3282,OSVDB; http://www.osvdb.org/27588;27588,SECUNIA; http://secunia.com/advisories/21307;21307,SECUNIA; http://secunia.com/advisories/21315;21315,SECUNIA; http://secunia.com/advisories/21247;21247,SECUNIA; http://secunia.com/advisories/21478;21478,SECUNIA; http://secunia.com/advisories/21509;21509,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded;20060820 POC &amp; exploit for Apache mod_rewrite off-by-one,HP; http://www.securityfocus.com/archive/1/archive/1/445206/100/0/threaded;HPSBUX02145,FRSIRT; http://www.frsirt.com/english/advisories/2006/3884;ADV-2006-3884,SECUNIA; http://secunia.com/advisories/22262;22262,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102662-1;102662,SUNALERT; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102663-1;102663,FRSIRT; http://www.frsirt.com/english/advisories/2006/3995;ADV-2006-3995,FRSIRT; http://www.frsirt.com/english/advisories/2006/4015;ADV-2006-4015,SECUNIA; http://secunia.com/advisories/22368;22368,SECUNIA; http://secunia.com/advisories/22388;22388,NSO; http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&amp;ID=3117;http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&amp;ID=3117,FRSIRT; http://www.frsirt.com/english/advisories/2006/4207;ADV-2006-4207,SECUNIA; http://secunia.com/advisories/22523;22523,HP; http://www.securityfocus.com/archive/1/archive/1/450321/100/0/threaded;HPSBUX02164,FRSIRT; http://www.frsirt.com/english/advisories/2006/4300;ADV-2006-4300,NSO; http://www-1.ibm.com/support/docview.wss?uid=swg27007951;http://www-1.ibm.com/support/docview.wss?uid=swg27007951,SECUNIA; http://secunia.com/advisories/23028;23028,FRSIRT; http://www.frsirt.com/english/advisories/2006/4868;ADV-2006-4868,SECUNIA; http://secunia.com/advisories/23260;23260|remote|exception|avail,conf,int,sec_prot user="1"
CVE-2006-5052|OpenSSH (OpenBSD)|2006-09-27|2.3|Low|Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI &quot;authentication abort.&quot;|MLIST; http://marc.theaimsgroup.com/?l=openssh-unix-dev&amp;m=115939141729160&amp;w=2;[openssh-unix-dev] 20060927 Announce: OpenSSH 4.4 released,REDHAT; http://rhn.redhat.com/errata/RHSA-2006-0697.html;RHSA-2006:0697,SLACKWARE; http://slackware.com/security/viewer.php?l=slackware-security&amp;y=2006&amp;m=slackware-security.592566;SSA:2006-272-02,BID; http://www.securityfocus.com/bid/20245;20245,SECTRACK; http://securitytracker.com/id?1016939;1016939,SECUNIA; http://secunia.com/advisories/22158;22158,SECUNIA; http://secunia.com/advisories/22173;22173,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/447861/100/200/threaded;20061005 rPSA-2006-0185-1 gnome-ssh-askpass openssh openssh-client openssh-server,NSO; https://issues.rpath.com/browse/RPL-681;https://issues.rpath.com/browse/RPL-681,SUSE; http://www.novell.com/linux/security/advisories/2006_62_openssh.html;SUSE-SA:2006:062,SECUNIA; http://secunia.com/advisories/22495;22495,GENTOO; http://security.gentoo.org/glsa/glsa-200611-06.xml;GLSA-200611-06,SECUNIA; http://secunia.com/advisories/22823;22823,XF; http://xforce.iss.net/xforce/xfdb/29255;openssh-gssapi-user-enumeration(29255)|remote||conf
CVE-2006-5815|ProFTPD (ProFTPD Project)|2006-11-08|2.3|Low|Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers to cause a denial of service, as demonstrated by vd_proftpd.pm, a &quot;ProFTPD remote exploit.&quot;|NSO; http://gleg.net/vulndisco_meta.shtml;http://gleg.net/vulndisco_meta.shtml,SECTRACK; http://securitytracker.com/id?1017167;1017167,BID; http://www.securityfocus.com/bid/20992;20992,FRSIRT; http://www.frsirt.com/english/advisories/2006/4451;ADV-2006-4451,SECUNIA; http://secunia.com/advisories/22803;22803,XF; http://xforce.iss.net/xforce/xfdb/30147;proftpd-code-execution(30147),DEBIAN; http://www.debian.org/security/2006/dsa-1218;DSA-1218,OPENPKG; http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.035-proftpd.html;OpenPKG-SA-2006.035,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:217;MDKSA-2006:217,SECUNIA; http://secunia.com/advisories/22821;22821,SECUNIA; http://secunia.com/advisories/23000;23000,SECUNIA; http://secunia.com/advisories/23069;23069,NSO; http://bugs.proftpd.org/show_bug.cgi?id=2858;http://bugs.proftpd.org/show_bug.cgi?id=2858,NSO; https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=214820;https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=214820,TRUSTIX; http://www.trustix.org/errata/2006/0066/;2006-0066,SECUNIA; http://secunia.com/advisories/23125;23125,DEBIAN; http://www.debian.org/security/2006/dsa-1222;DSA-1222,GENTOO; http://www.gentoo.org/security/en/glsa/glsa-200611-26.xml;GLSA-200611-26,MANDRIVA; http://www.mandriva.com/security/advisories?name=MDKSA-2006:217-1;MDKSA-2006:217-1,SLACKWARE; http://slackware.com/security/viewer.php?l=slackware-security&amp;y=2006&amp;m=slackware-security.502491;SSA:2006-335-02,SECUNIA; http://secunia.com/advisories/23174;23174,SECUNIA; http://secunia.com/advisories/23179;23179,SECUNIA; http://secunia.com/advisories/23184;23184,SECUNIA; http://secunia.com/advisories/23207;23207,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/452760/100/200/threaded;20061127 CVE-2006-5815: remote code execution in ProFTPD,TRUSTIX; http://www.trustix.org/errata/2006/0070;2006-0070|remote|input buffer="1"|avail
CVE-2007-1864|PHP (PHP)|2007-05-08|7.5|High|Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.|NSO; http://us2.php.net/releases/4_4_7.php patch=1;http://us2.php.net/releases/4_4_7.php patch=1,NSO; http://us2.php.net/releases/5_2_2.php patch=1;http://us2.php.net/releases/5_2_2.php patch=1,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:102;MDKSA-2007:102,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:103;MDKSA-2007:103,REDHAT; https://rhn.redhat.com/errata/RHSA-2007-0348.html;RHSA-2007:0348,REDHAT; http://www.redhat.com/support/errata/RHSA-2007-0349.html;RHSA-2007:0349,REDHAT; http://www.redhat.com/support/errata/RHSA-2007-0355.html;RHSA-2007:0355,SECTRACK; http://www.securitytracker.com/id?1018024;1018024,SECUNIA; http://secunia.com/advisories/25187;25187,SECUNIA; http://secunia.com/advisories/25191;25191,TRUSTIX; http://www.trustix.org/errata/2007/0017/;2007-0017,SECUNIA; http://secunia.com/advisories/25255;25255|network|input buffer="1"|avail,conf,int,sec_prot other="1"
CVE-2007-2446|Samba (Samba)|2007-05-14|10.0|High|Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).|BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468542/100/0/threaded;20070513 [SAMBA-SECURITY] CVE-2007-2446: Multiple Heap Overflows Allow Remote Code Execution,NSO; http://www.samba.org/samba/security/CVE-2007-2446.html adv=1 patch=1;http://www.samba.org/samba/security/CVE-2007-2446.html adv=1 patch=1,NSO; https://issues.rpath.com/browse/RPL-1366;https://issues.rpath.com/browse/RPL-1366,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:104;MDKSA-2007:104,REDHAT; http://www.redhat.com/support/errata/RHSA-2007-0354.html;RHSA-2007:0354,SLACKWARE; http://slackware.com/security/viewer.php?l=slackware-security&amp;y=2007&amp;m=slackware-security.475906;SSA:2007-134-01,CERT-VN; http://www.kb.cert.org/vuls/id/773720;VU#773720,BID; http://www.securityfocus.com/bid/23973;23973,FRSIRT; http://www.frsirt.com/english/advisories/2007/1805;ADV-2007-1805,SECUNIA; http://secunia.com/advisories/25241;25241,SECUNIA; http://secunia.com/advisories/25246;25246,SECUNIA; http://secunia.com/advisories/25256;25256,SECUNIA; http://secunia.com/advisories/25257;25257,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468670/100/0/threaded;20070515 FLEA-2007-0017-1: samba,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468674/100/0/threaded;20070515 ZDI-07-029: Samba lsa_io_privilege_set Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468675/100/0/threaded;20070515 ZDI-07-030: Samba netdfs_io_dfs_EnumInfo_d Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468673/100/0/threaded;20070515 ZDI-07-031: Samba smb_io_notify_option_type_data Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468672/100/0/threaded;20070515 ZDI-07-032: Samba sec_io_acl Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468680/100/0/threaded;20070515 ZDI-07-033: Samba lsa_io_trans_names Heap Overflow Vulnerability,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-029.html;http://www.zerodayinitiative.com/advisories/ZDI-07-029.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-030.html;http://www.zerodayinitiative.com/advisories/ZDI-07-030.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-031.html;http://www.zerodayinitiative.com/advisories/ZDI-07-031.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-032.html;http://www.zerodayinitiative.com/advisories/ZDI-07-032.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-033.html;http://www.zerodayinitiative.com/advisories/ZDI-07-033.html,DEBIAN; http://www.debian.org/security/2007/dsa-1291;DSA-1291,GENTOO; http://security.gentoo.org/glsa/glsa-200705-15.xml;GLSA-200705-15,TRUSTIX; http://www.trustix.org/errata/2007/0017/;2007-0017,UBUNTU; http://www.ubuntu.com/usn/usn-460-1;USN-460-1,SECTRACK; http://www.securitytracker.com/id?1018050;1018050,SECUNIA; http://secunia.com/advisories/25232;25232,SECUNIA; http://secunia.com/advisories/25251;25251,SECUNIA; http://secunia.com/advisories/25270;25270,SECUNIA; http://secunia.com/advisories/25259;25259,SECUNIA; http://secunia.com/advisories/25255;25255,XF; http://xforce.iss.net/xforce/xfdb/34309;samba-lsaioprivilegeset-bo(34309),XF; http://xforce.iss.net/xforce/xfdb/34316;samba-lsaiotransnames-bo(34316),XF; http://xforce.iss.net/xforce/xfdb/34311;samba-netdfsiodfsenuminfod-bo(34311),XF; http://xforce.iss.net/xforce/xfdb/34314;samba-secioacl-bo(34314),XF; http://xforce.iss.net/xforce/xfdb/34312;samba-smbionotifyoptiontypedata-bo(34312)|network|input buffer="1"|avail,conf,int,sec_prot admin="1"
CVE-2007-4138|Samba (Samba)|2007-09-13|6.9|Medium|The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the &quot;winbind nss info&quot; option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.|BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/479078/100/0/threaded;20070911 [SECURITY] Winbind&apos;s rfc2307 &amp; SFU nss_info plugin in Samba 3.0.25[a-c] assigns users a primary gid of 0 by default,NSO; http://www.samba.org/samba/security/CVE-2007-4138.html;http://www.samba.org/samba/security/CVE-2007-4138.html,BID; http://www.securityfocus.com/bid/25636;25636,FRSIRT; http://www.frsirt.com/english/advisories/2007/3120;ADV-2007-3120,SECUNIA; http://secunia.com/advisories/26764;26764|local||avail,conf,int,sec_prot admin="1"
CVE-2007-1864|PHP (PHP)|2007-05-08|7.5|High|Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.|NSO; http://us2.php.net/releases/4_4_7.php patch=1;http://us2.php.net/releases/4_4_7.php patch=1,NSO; http://us2.php.net/releases/5_2_2.php patch=1;http://us2.php.net/releases/5_2_2.php patch=1,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:102;MDKSA-2007:102,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:103;MDKSA-2007:103,REDHAT; https://rhn.redhat.com/errata/RHSA-2007-0348.html;RHSA-2007:0348,REDHAT; http://www.redhat.com/support/errata/RHSA-2007-0349.html;RHSA-2007:0349,REDHAT; http://www.redhat.com/support/errata/RHSA-2007-0355.html;RHSA-2007:0355,SECTRACK; http://www.securitytracker.com/id?1018024;1018024,SECUNIA; http://secunia.com/advisories/25187;25187,SECUNIA; http://secunia.com/advisories/25191;25191,TRUSTIX; http://www.trustix.org/errata/2007/0017/;2007-0017,SECUNIA; http://secunia.com/advisories/25255;25255|network|input buffer="1"|avail,conf,int,sec_prot other="1"
CVE-2007-2446|Samba (Samba)|2007-05-14|10.0|High|Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).|BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468542/100/0/threaded;20070513 [SAMBA-SECURITY] CVE-2007-2446: Multiple Heap Overflows Allow Remote Code Execution,NSO; http://www.samba.org/samba/security/CVE-2007-2446.html adv=1 patch=1;http://www.samba.org/samba/security/CVE-2007-2446.html adv=1 patch=1,NSO; https://issues.rpath.com/browse/RPL-1366;https://issues.rpath.com/browse/RPL-1366,MANDRIVA; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:104;MDKSA-2007:104,REDHAT; http://www.redhat.com/support/errata/RHSA-2007-0354.html;RHSA-2007:0354,SLACKWARE; http://slackware.com/security/viewer.php?l=slackware-security&amp;y=2007&amp;m=slackware-security.475906;SSA:2007-134-01,CERT-VN; http://www.kb.cert.org/vuls/id/773720;VU#773720,BID; http://www.securityfocus.com/bid/23973;23973,FRSIRT; http://www.frsirt.com/english/advisories/2007/1805;ADV-2007-1805,SECUNIA; http://secunia.com/advisories/25241;25241,SECUNIA; http://secunia.com/advisories/25246;25246,SECUNIA; http://secunia.com/advisories/25256;25256,SECUNIA; http://secunia.com/advisories/25257;25257,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468670/100/0/threaded;20070515 FLEA-2007-0017-1: samba,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468674/100/0/threaded;20070515 ZDI-07-029: Samba lsa_io_privilege_set Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468675/100/0/threaded;20070515 ZDI-07-030: Samba netdfs_io_dfs_EnumInfo_d Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468673/100/0/threaded;20070515 ZDI-07-031: Samba smb_io_notify_option_type_data Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468672/100/0/threaded;20070515 ZDI-07-032: Samba sec_io_acl Heap Overflow Vulnerability,BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/468680/100/0/threaded;20070515 ZDI-07-033: Samba lsa_io_trans_names Heap Overflow Vulnerability,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-029.html;http://www.zerodayinitiative.com/advisories/ZDI-07-029.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-030.html;http://www.zerodayinitiative.com/advisories/ZDI-07-030.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-031.html;http://www.zerodayinitiative.com/advisories/ZDI-07-031.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-032.html;http://www.zerodayinitiative.com/advisories/ZDI-07-032.html,NSO; http://www.zerodayinitiative.com/advisories/ZDI-07-033.html;http://www.zerodayinitiative.com/advisories/ZDI-07-033.html,DEBIAN; http://www.debian.org/security/2007/dsa-1291;DSA-1291,GENTOO; http://security.gentoo.org/glsa/glsa-200705-15.xml;GLSA-200705-15,TRUSTIX; http://www.trustix.org/errata/2007/0017/;2007-0017,UBUNTU; http://www.ubuntu.com/usn/usn-460-1;USN-460-1,SECTRACK; http://www.securitytracker.com/id?1018050;1018050,SECUNIA; http://secunia.com/advisories/25232;25232,SECUNIA; http://secunia.com/advisories/25251;25251,SECUNIA; http://secunia.com/advisories/25270;25270,SECUNIA; http://secunia.com/advisories/25259;25259,SECUNIA; http://secunia.com/advisories/25255;25255,XF; http://xforce.iss.net/xforce/xfdb/34309;samba-lsaioprivilegeset-bo(34309),XF; http://xforce.iss.net/xforce/xfdb/34316;samba-lsaiotransnames-bo(34316),XF; http://xforce.iss.net/xforce/xfdb/34311;samba-netdfsiodfsenuminfod-bo(34311),XF; http://xforce.iss.net/xforce/xfdb/34314;samba-secioacl-bo(34314),XF; http://xforce.iss.net/xforce/xfdb/34312;samba-smbionotifyoptiontypedata-bo(34312)|network|input buffer="1"|avail,conf,int,sec_prot admin="1"
CVE-2007-4138|Samba (Samba)|2007-09-13|6.9|Medium|The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the &quot;winbind nss info&quot; option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.|BUGTRAQ; http://www.securityfocus.com/archive/1/archive/1/479078/100/0/threaded;20070911 [SECURITY] Winbind&apos;s rfc2307 &amp; SFU nss_info plugin in Samba 3.0.25[a-c] assigns users a primary gid of 0 by default,NSO; http://www.samba.org/samba/security/CVE-2007-4138.html;http://www.samba.org/samba/security/CVE-2007-4138.html,BID; http://www.securityfocus.com/bid/25636;25636,FRSIRT; http://www.frsirt.com/english/advisories/2007/3120;ADV-2007-3120,SECUNIA; http://secunia.com/advisories/26764;26764|local||avail,conf,int,sec_prot admin="1"
