2003

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml f

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread

Unknown vulnerability in mail for Solaris 2.6 through 9 allows local users to read the email of other users.

Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC, and 2.5.1 through 8 for x86, allows remote attac

Integer signedness error in MIT Kerberos V5 ASN.1 decoder before krb5 1.2.5 allows remote attackers to cause a denial of

The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause

The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local

w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attac

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP

slapd in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows local users to overwrite arbitrary files via a race condition d

Buffer overflow in the Windows Redirector function in Microsoft Windows XP allows local users to execute arbitrary code

Linux kernel 2.4.10 through 2.4.21-pre4 does not properly handle the O_DIRECT feature, which allows local attackers with

uml_net in the kernel-utils package for Red Hat Linux 8.0 has incorrect setuid root privileges, which allows local users

SQL injection vulnerability in the PostgreSQL auth module for courier 0.40 and earlier allows remote attackers to execut

Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is ret

AbsoluteTelnet SSH2 client does not clear logon credentials from memory, including plaintext passwords, which could allo

SSH2 clients for VanDyke (1) SecureCRT 4.0.2 and 3.4.7, (2) SecureFX 2.1.2 and 2.0.4, and (3) Entunnel 1.0.2 and earlier

PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow a

Buffer overflow in secure locate (slocate) before 2.7 allows local users to execute arbitrary code via a long (1) -c or

Multiple buffer overflows in Hypermail 2 before 2.1.6 allows remote attackers to cause a denial of service and possibly

MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of se

Unknown vulnerability in the chk_trans.c of the libkrb5 library for MIT Kerberos V5 before 1.2.5 allows users from one r

Format string vulnerabilities in the logging routines for MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 all

Buffer overflow in Eset Software NOD32 for UNIX before 1.013 allows local users to execute arbitrary code via a long pat

Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of ser

Format string vulnerability in mpmain.c for plpnfsd of the plptools package allows remote attackers to execute arbitrary

Integer signedness error in the myFseek function of samplein.c for Blade encoder (BladeEnc) 0.94.2 and earlier allows re

Unknown vulnerability in the directory parser for Direct Connect 4 Linux (dcgui) before 0.2.2 allows remote attackers to

Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicio

The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols

The FTP client for Solaris 2.6, 7, and 8 with the debug (-d) flag enabled displays the user password on the screen durin

Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracl

Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users

A patch for shadow-utils 20000902 causes the useradd command to create a mail spool files with read/write privileges of

xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth

The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand() function instead of srand(), which causes vncserver to g

The "screen dump" feature in Eterm 0.9.1 and earlier allows attackers to overwrite arbitrary files via a certain charact

The "screen dump" feature in rxvt 2.7.8 allows attackers to overwrite arbitrary files via a certain character escape seq

The menuBar feature in rxvt 2.7.8 allows attackers to modify menu options and execute arbitrary commands via a certain c

The menuBar feature in aterm 0.42 allows attackers to modify menu options and execute arbitrary commands via a certain c

Apple File Protocol (AFP) in Mac OS X before 10.2.4 allows administrators to log in as other users by using the administ

The dtterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and the

The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and the

The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape

The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape

VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0, allows attackers

The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause

ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an i