Vendor CVEs
IBM
All CVEs
8,825 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2006-2431 | 0.03 | — | 0.03 | May 17, 2006 | Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via… | |||
| CVE-2006-1384 | 0.03 | — | 0.02 | Mar 24, 2006 | Cross-site scripting (XSS) vulnerability in apwc_win_main.jsp in the web console in IBM Tivoli Business Systems Manager (TBSM) before 3.1.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter. | |||
| CVE-2006-0663 | 0.03 | — | 0.06 | Feb 13, 2006 | Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) an email subject; (2) an encoded javascript URI, as demonstrated using "java script:"; or (3) when the Domino… | |||
| CVE-2006-0133 | 0.03 | — | 0.01 | Jan 9, 2006 | Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability… | |||
| CVE-2005-4869 | 0.03 | — | 0.01 | Dec 31, 2005 | The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty string in the second parameter, which causes a null pointer dereference. | |||
| CVE-2005-2236 | 0.03 | — | 0.01 | Jul 12, 2005 | Format string vulnerability in the paginit command in IBM AIX 5.3, and possibly other versions, might allow local users to execute arbitrary code via format strings in command line arguments. | |||
| CVE-2005-2232 | 0.03 | — | 0.01 | Jul 12, 2005 | Buffer overflow in invscout in IBM AIX 5.1.0 through 5.3.0 might allow local users to execute arbitrary code via a long command line argument. | |||
| CVE-2005-2175 | 0.03 | — | 0.05 | Jul 9, 2005 | The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies. | |||
| CVE-2005-0262 | 0.03 | — | 0.01 | May 2, 2005 | Buffer overflow in ipl_varyon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -d argument. | |||
| CVE-2005-0263 | 0.03 | — | 0.01 | May 2, 2005 | Buffer overflow in netpmon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -O argument. | |||
| CVE-2005-0156 | 0.03 | — | 0.01 | Feb 7, 2005 | Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree. | |||
| CVE-2004-1054 | 0.03 | — | 0.01 | Jan 10, 2005 | Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment variable to point to a malicious "uname" program, which is executed from lsvpd after lsvpd has been invoked by invscout. | |||
| CVE-2004-1442 | 0.03 | — | 0.04 | Dec 31, 2004 | Cross-site scripting (XSS) vulnerability in db2www CGI interpreter in IBM Net.Data 7 and 7.2 allows remote attackers to inject arbitrary web script or HTML via a macro filename, which is not properly handled by error messages such as "DTWP001E." | |||
| CVE-2004-2697 | 0.03 | — | 0.01 | Dec 31, 2004 | The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on a command line argument (log file). NOTE: this might be related to CVE-2006-5002. | |||
| CVE-2004-2311 | 0.03 | — | 0.01 | Dec 31, 2004 | Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence of files via a .. (dot dot) in the new folder dialog. | |||
| CVE-2004-2312 | 0.03 | — | 0.01 | Dec 31, 2004 | Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument. | |||
| CVE-2004-1330 | 0.03 | — | 0.01 | Dec 31, 2004 | Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username. | |||
| CVE-2004-2310 | 0.03 | — | 0.04 | Dec 31, 2004 | Cross-site scripting (XSS) vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows remote attackers to inject arbitrary web script or HTML via a Domino command in the Quick Console. | |||
| CVE-2004-1329 | 0.03 | — | 0.03 | Dec 20, 2004 | Untrusted execution path vulnerability in the diag commands (1) lsmcode, (2) diag_exec, (3) invscout, and (4) invscoutd in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program. | |||
| CVE-2004-0318 | 0.03 | — | 0.04 | Nov 23, 2004 | Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges. | |||
| CVE-2004-0795 | 0.03 | — | 0.02 | Oct 20, 2004 | DB2 8.1 remote command server (DB2RCMD.EXE) executes the db2rcmdc.exe program as the db2admin administrator, which allows local users to gain privileges via the DB2REMOTECMD named pipe. | |||
| CVE-2004-1621 | 0.03 | — | 0.03 | Oct 18, 2004 | NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1)… | |||
| CVE-2003-1052 | 0.03 | — | 0.01 | Sep 28, 2004 | IBM DB2 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries that are used in setuid root programs. | |||
| CVE-2003-1050 | 0.03 | — | 0.01 | Sep 28, 2004 | Multiple buffer overflows in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via long command line arguments to (1) db2start, (2) db2stop, or (3) db2govd. | |||
| CVE-2003-1051 | 0.03 | — | 0.01 | Sep 28, 2004 | Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd. | |||
| CVE-2004-0492 | 0.03 | — | 0.34 | Aug 6, 2004 | Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be… | |||
| CVE-2004-0544 | 0.03 | — | 0.01 | Aug 6, 2004 | Multiple buffer overflows in LVM for AIX 5.1 and 5.2 allow local users to gain privileges via the (1) putlvcb or (2) getlvcb commands. | |||
| CVE-2004-0668 | 0.03 | — | 0.03 | Aug 6, 2004 | Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message, as demonstrated using a large image attachment. | |||
| CVE-2004-2131 | 0.03 | — | 0.01 | Jan 27, 2004 | Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users, with DSA privileges, to execute arbitrary code via a long ONCONFIG environment variable. | |||
| CVE-2003-0898 | 0.03 | — | 0.01 | Nov 17, 2003 | IBM DB2 7.2 before FixPak 10a, and earlier versions including 7.1, allows local users to overwrite arbitrary files and gain privileges via a symlink attack on (1) db2job and (2) db2job2. | |||
| CVE-2003-0759 | 0.03 | — | 0.01 | Oct 6, 2003 | Buffer overflow in db2licm in IBM DB2 Universal Data Base 7.2 before Fixpak 10a allows local users to gain root privileges via a long command line argument. | |||
| CVE-2003-0758 | 0.03 | — | 0.01 | Oct 6, 2003 | Buffer overflow in db2dart in IBM DB2 Universal Data Base 7.2 before Fixpak 10 allows local users to gain root privileges via a long command line argument. | |||
| CVE-2003-0579 | 0.03 | — | 0.01 | Aug 18, 2003 | uvadmsh in IBM U2 UniVerse 10.0.0.9 and earlier trusts the user-supplied -uv.install command line option to find and execute the uv.install program, which allows local users to gain privileges by providing a pathname that is under control of the user. | |||
| CVE-2002-1468 | 0.03 | — | 0.04 | Apr 22, 2003 | Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root. | |||
| CVE-2003-0087 | 0.03 | — | 0.01 | Mar 3, 2003 | Buffer overflow in libIM library (libIM.a) for National Language Support (NLS) on AIX 4.3 through 5.2 allows local users to gain privileges via several possible attack vectors, including a long -im argument to aixterm. | |||
| CVE-2002-1731 | 0.03 | — | 0.01 | Dec 31, 2002 | The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF. | |||
| CVE-2002-1167 | 0.03 | — | 0.03 | Nov 4, 2002 | Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP GET request. | |||
| CVE-2002-1168 | 0.03 | — | 0.02 | Nov 4, 2002 | Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that contains an Location: header with a "%0a%0d" (CRLF) sequence, which echoes the… | |||
| CVE-2002-0370 | 0.03 | — | 0.43 | Oct 10, 2002 | Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME,… | |||
| CVE-2002-0905 | 0.03 | — | 0.01 | Oct 4, 2002 | Buffer overflow in sqlexec for Informix SE-7.25 allows local users to gain root privileges via a long INFORMIXDIR environment variable. | |||
| CVE-2002-0747 | 0.03 | — | 0.06 | Aug 12, 2002 | Buffer overflow in lsmcode in AIX 4.3.3. | |||
| CVE-2001-0390 | 0.03 | — | 0.05 | Jul 2, 2001 | IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters. | |||
| CVE-2001-1080 | 0.03 | — | 0.06 | Jun 19, 2001 | diagrpt in AIX 4.3.x and 5.1 uses the DIAGDATADIR environment variable to find and execute certain programs, which allows local users to gain privileges by modifying the variable to point to a Trojan horse program. | |||
| CVE-2001-0122 | 0.03 | — | 0.03 | Mar 13, 2001 | Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests that generate a "bad request" error. | |||
| CVE-1999-0718 | 0.03 | — | 0.01 | Mar 12, 2001 | IBM GINA, when used for OS/2 domain authentication of Windows NT users, allows local users to gain administrator privileges by changing the GroupMapping registry key. | |||
| CVE-2001-0051 | 0.03 | — | 0.03 | Feb 16, 2001 | IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database. | |||
| CVE-2001-0052 | 0.03 | — | 0.01 | Feb 16, 2001 | IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query. | |||
| CVE-2000-1124 | 0.03 | — | 0.01 | Jan 9, 2001 | Buffer overflow in piobe command in IBM AIX 4.3.x allows local users to gain privileges via long environmental variables. | |||
| CVE-2000-1121 | 0.03 | — | 0.01 | Jan 9, 2001 | Buffer overflow in enq command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long -M argument. | |||
| CVE-2000-1110 | 0.03 | — | 0.03 | Jan 9, 2001 | document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of the web server by sending a nonexistent command to the program. |
- CVE-2006-2431May 17, 2006risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via…
- CVE-2006-1384Mar 24, 2006risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in apwc_win_main.jsp in the web console in IBM Tivoli Business Systems Manager (TBSM) before 3.1.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter.
- CVE-2006-0663Feb 13, 2006risk 0.03cvss —epss 0.06
Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) an email subject; (2) an encoded javascript URI, as demonstrated using "java script:"; or (3) when the Domino…
- CVE-2006-0133Jan 9, 2006risk 0.03cvss —epss 0.01
Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability…
- CVE-2005-4869Dec 31, 2005risk 0.03cvss —epss 0.01
The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty string in the second parameter, which causes a null pointer dereference.
- CVE-2005-2236Jul 12, 2005risk 0.03cvss —epss 0.01
Format string vulnerability in the paginit command in IBM AIX 5.3, and possibly other versions, might allow local users to execute arbitrary code via format strings in command line arguments.
- CVE-2005-2232Jul 12, 2005risk 0.03cvss —epss 0.01
Buffer overflow in invscout in IBM AIX 5.1.0 through 5.3.0 might allow local users to execute arbitrary code via a long command line argument.
- CVE-2005-2175Jul 9, 2005risk 0.03cvss —epss 0.05
The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies.
- CVE-2005-0262May 2, 2005risk 0.03cvss —epss 0.01
Buffer overflow in ipl_varyon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -d argument.
- CVE-2005-0263May 2, 2005risk 0.03cvss —epss 0.01
Buffer overflow in netpmon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -O argument.
- CVE-2005-0156Feb 7, 2005risk 0.03cvss —epss 0.01
Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.
- CVE-2004-1054Jan 10, 2005risk 0.03cvss —epss 0.01
Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment variable to point to a malicious "uname" program, which is executed from lsvpd after lsvpd has been invoked by invscout.
- CVE-2004-1442Dec 31, 2004risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in db2www CGI interpreter in IBM Net.Data 7 and 7.2 allows remote attackers to inject arbitrary web script or HTML via a macro filename, which is not properly handled by error messages such as "DTWP001E."
- CVE-2004-2697Dec 31, 2004risk 0.03cvss —epss 0.01
The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on a command line argument (log file). NOTE: this might be related to CVE-2006-5002.
- CVE-2004-2311Dec 31, 2004risk 0.03cvss —epss 0.01
Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence of files via a .. (dot dot) in the new folder dialog.
- CVE-2004-2312Dec 31, 2004risk 0.03cvss —epss 0.01
Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument.
- CVE-2004-1330Dec 31, 2004risk 0.03cvss —epss 0.01
Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.
- CVE-2004-2310Dec 31, 2004risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows remote attackers to inject arbitrary web script or HTML via a Domino command in the Quick Console.
- CVE-2004-1329Dec 20, 2004risk 0.03cvss —epss 0.03
Untrusted execution path vulnerability in the diag commands (1) lsmcode, (2) diag_exec, (3) invscout, and (4) invscoutd in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program.
- CVE-2004-0318Nov 23, 2004risk 0.03cvss —epss 0.04
Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges.
- CVE-2004-0795Oct 20, 2004risk 0.03cvss —epss 0.02
DB2 8.1 remote command server (DB2RCMD.EXE) executes the db2rcmdc.exe program as the db2admin administrator, which allows local users to gain privileges via the DB2REMOTECMD named pipe.
- CVE-2004-1621Oct 18, 2004risk 0.03cvss —epss 0.03
NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1)…
- CVE-2003-1052Sep 28, 2004risk 0.03cvss —epss 0.01
IBM DB2 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries that are used in setuid root programs.
- CVE-2003-1050Sep 28, 2004risk 0.03cvss —epss 0.01
Multiple buffer overflows in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via long command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
- CVE-2003-1051Sep 28, 2004risk 0.03cvss —epss 0.01
Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
- CVE-2004-0492Aug 6, 2004risk 0.03cvss —epss 0.34
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be…
- CVE-2004-0544Aug 6, 2004risk 0.03cvss —epss 0.01
Multiple buffer overflows in LVM for AIX 5.1 and 5.2 allow local users to gain privileges via the (1) putlvcb or (2) getlvcb commands.
- CVE-2004-0668Aug 6, 2004risk 0.03cvss —epss 0.03
Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message, as demonstrated using a large image attachment.
- CVE-2004-2131Jan 27, 2004risk 0.03cvss —epss 0.01
Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users, with DSA privileges, to execute arbitrary code via a long ONCONFIG environment variable.
- CVE-2003-0898Nov 17, 2003risk 0.03cvss —epss 0.01
IBM DB2 7.2 before FixPak 10a, and earlier versions including 7.1, allows local users to overwrite arbitrary files and gain privileges via a symlink attack on (1) db2job and (2) db2job2.
- CVE-2003-0759Oct 6, 2003risk 0.03cvss —epss 0.01
Buffer overflow in db2licm in IBM DB2 Universal Data Base 7.2 before Fixpak 10a allows local users to gain root privileges via a long command line argument.
- CVE-2003-0758Oct 6, 2003risk 0.03cvss —epss 0.01
Buffer overflow in db2dart in IBM DB2 Universal Data Base 7.2 before Fixpak 10 allows local users to gain root privileges via a long command line argument.
- CVE-2003-0579Aug 18, 2003risk 0.03cvss —epss 0.01
uvadmsh in IBM U2 UniVerse 10.0.0.9 and earlier trusts the user-supplied -uv.install command line option to find and execute the uv.install program, which allows local users to gain privileges by providing a pathname that is under control of the user.
- CVE-2002-1468Apr 22, 2003risk 0.03cvss —epss 0.04
Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root.
- CVE-2003-0087Mar 3, 2003risk 0.03cvss —epss 0.01
Buffer overflow in libIM library (libIM.a) for National Language Support (NLS) on AIX 4.3 through 5.2 allows local users to gain privileges via several possible attack vectors, including a long -im argument to aixterm.
- CVE-2002-1731Dec 31, 2002risk 0.03cvss —epss 0.01
The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF.
- CVE-2002-1167Nov 4, 2002risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP GET request.
- CVE-2002-1168Nov 4, 2002risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that contains an Location: header with a "%0a%0d" (CRLF) sequence, which echoes the…
- CVE-2002-0370Oct 10, 2002risk 0.03cvss —epss 0.43
Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME,…
- CVE-2002-0905Oct 4, 2002risk 0.03cvss —epss 0.01
Buffer overflow in sqlexec for Informix SE-7.25 allows local users to gain root privileges via a long INFORMIXDIR environment variable.
- CVE-2002-0747Aug 12, 2002risk 0.03cvss —epss 0.06
Buffer overflow in lsmcode in AIX 4.3.3.
- CVE-2001-0390Jul 2, 2001risk 0.03cvss —epss 0.05
IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.
- CVE-2001-1080Jun 19, 2001risk 0.03cvss —epss 0.06
diagrpt in AIX 4.3.x and 5.1 uses the DIAGDATADIR environment variable to find and execute certain programs, which allows local users to gain privileges by modifying the variable to point to a Trojan horse program.
- CVE-2001-0122Mar 13, 2001risk 0.03cvss —epss 0.03
Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests that generate a "bad request" error.
- CVE-1999-0718Mar 12, 2001risk 0.03cvss —epss 0.01
IBM GINA, when used for OS/2 domain authentication of Windows NT users, allows local users to gain administrator privileges by changing the GroupMapping registry key.
- CVE-2001-0051Feb 16, 2001risk 0.03cvss —epss 0.03
IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database.
- CVE-2001-0052Feb 16, 2001risk 0.03cvss —epss 0.01
IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query.
- CVE-2000-1124Jan 9, 2001risk 0.03cvss —epss 0.01
Buffer overflow in piobe command in IBM AIX 4.3.x allows local users to gain privileges via long environmental variables.
- CVE-2000-1121Jan 9, 2001risk 0.03cvss —epss 0.01
Buffer overflow in enq command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long -M argument.
- CVE-2000-1110Jan 9, 2001risk 0.03cvss —epss 0.03
document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of the web server by sending a nonexistent command to the program.
Page 126 of 177