CVEs

A network intrusion detection system (IDS) does not properly handle packets with improper sequence numbers.

DPEC Online Courseware allows an attacker to change another user's password without knowing the original password.

A WWW server is not running in a restricted file system, e.g. through a chroot, thus allowing access to system-critical data.

Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter.

A router's configuration service or management interface (such as a web server or telnet) is configured to allow connections from arbitrary hosts.

The Gopher service is running.

Local or remote users can force ControlIT 4.5 to reboot or force a user to log out, resulting in a denial of service.

Linux cfingerd could be exploited to gain root access.

A Unix account with a name other than "root" has UID 0, i.e. root privileges.

A race condition in the BackWeb Polite Agent Protocol allows an attacker to spoof a BackWeb server.

DataLynx suGuard trusts the PATH environment variable to execute the ps command, allowing local users to execute commands as root.

An event log in Windows NT has inappropriate access permissions.

A race condition in Linux 2.2.1 allows local users to read arbitrary memory from /proc files.

Denial of service in Sendmail 8.6.11 and 8.6.12.

The chargen service is running.

The discard service is running.

The rpc.rquotad service is running.

There is a one-way or two-way trust relationship between Windows NT domains.

The Logon box of a Windows NT system displays the name of the last user who logged in.

The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.

A system-critical program or library does not have the appropriate patch, hotfix, or service pack installed, or is outdated or obsolete.

A system-critical Windows NT registry key has an inappropriate value.

A Windows NT log file has an inappropriate maximum size or retention period.

An application-critical Windows NT registry key has an inappropriate value.

The UUCP service is running.

A network intrusion detection system (IDS) does not verify the checksum on a packet.

A Windows NT system's file audit policy does not log an event success or failure for non-critical files or directories.

A network intrusion detection system (IDS) does not properly handle packets that are sent out of order, allowing an attacker to escape detection.

The rsh/rlogin service is running.

A service or application has a backdoor password that was placed there by the developer.

Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers.

finger .@host on some systems may print information on some user accounts.

In some instances of SSH 1.2.27 and 2.0.11 on Linux systems, SSH will allow users with expired accounts to login.

The DCC server command in the Mirc 5.5 client doesn't filter characters from file names properly, allowing remote attackers to place a malicious file in a different location, possibly allowing the attacker to execute commands.

The ident/identd service is running.

WinGate is being used.

SSH 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root.

Linux 2.1.132 and earlier allows local users to cause a denial of service (resource exhaustion) by reading a large buffer from a random device (e.g. /dev/urandom), which cannot be interrupted until the read has completed.

mysqld in MySQL 3.21 creates log files with world-readable permissions, which allows local users to obtain passwords for users who are added to the user database.

Buffer overflow in BNC IRC proxy allows remote attackers to gain privileges.

Development version of Breeze Network Server allows remote attackers to cause the system to reboot by accessing the configbreeze CGI program.

nlog CGI scripts do not properly filter shell metacharacters from the IP address argument, which could allow remote attackers to execute certain commands via (1) nlog-smb.pl or (2) rpc-nlog.pl.

BackWeb client stores the username and password in cleartext for proxy authentication in the Communication registry key, which could allow other local users to gain privileges by reading the password.

Corel Word Perfect 8 for Linux creates a temporary working directory with world-writable permissions, which allows local users to (1) modify Word Perfect behavior by modifying files in the working directory, or (2) modify files of other users via a symlink attack.

The passwd command in Solaris can be subjected to a denial of service.

Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access.

RealSystem G2 server stores the administrator password in cleartext in a world-readable configuration file, which allows local users to gain privileges.

fte-console in the fte package before 0.46b-4.1 does not drop root privileges, which allows local users to gain root access via the virtual console device.

Buffer overflow in bootpd on OpenBSD, FreeBSD, and Linux systems via a malformed header type.

Buffer overflow in Platinum Policy Compliance Manager (PCM) 7.0 allows remote attackers to execute arbitrary commands via a long string to the Agent port (1827), which is handled by smaxagent.exe.