Overview 81 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
1.2%
Not applicable
80
98.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
81
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
81
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 10 / year
19972
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
19980
19991
Not applicable1
Medium1
not blocked1
Working exploit published1
20001
Not applicable1
High1
not blocked1
Working exploit published1
20013
Not applicable3
High3
not blocked3
Working exploit published3
20023
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20037
Not applicable7
High2
Medium4
Low1
not blocked7
Working exploit published7
20045
Not applicable5
High4
Low1
not blocked5
Working exploit published5
20057
Not applicable7
High5
Medium2
not blocked7
Working exploit published7
20067
Not applicable7
High2
Medium5
not blocked7
Working exploit published7
20074
Not applicable4
High2
Medium2
not blocked4
Working exploit published4
20082
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20092
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20102
Not applicable2
Medium1
Low1
not blocked2
Working exploit published2
20116
Not applicable6
High1
Medium5
not blocked6
Working exploit published6
20122
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20134
Not applicable4
High1
Medium3
not blocked4
Working exploit published4
20142
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20151
Outside Waratek scope1
High1
not blocked1
Working exploit published1
20162
Not applicable2
High2
not blocked2
Working exploit published2
201710
Not applicable10
High9
Medium1
not blocked10
Working exploit published10
20184
Not applicable4
High3
Medium1
not blocked4
Working exploit published4
20191
Not applicable1
High1
not blocked1
Working exploit published1
20200
20210
20220
20231
Not applicable1
Medium1
not blocked1
Working exploit published1
20241
Not applicable1
High1
not blocked1
Working exploit published1
20250
20261
Not applicable1
Critical1
not blocked1
Working exploit published1
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-32746 | Critical | 2026-03-13 | Not applicable | Working exploit published | telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full. |
| CVE-2023-6246 | High | 2024-01-31 | Not applicable | Working exploit published | A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. |
| CVE-2023-24626 | Medium | 2023-04-08 | Not applicable | Working exploit published | socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process. |
| CVE-2019-18862 | High | 2019-11-11 | Not applicable | Working exploit published | maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode. |
| CVE-2018-0494 | Medium | 2018-05-06 | Not applicable | Working exploit published | GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line. |
| CVE-2017-1000409 | High | 2018-02-01 | Not applicable | Working exploit published | A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366. |
| CVE-2017-1000408 | High | 2018-02-01 | Not applicable | Working exploit published | A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366. |
| CVE-2018-6323 | High | 2018-01-26 | Not applicable | Working exploit published | The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. |
| CVE-2017-14939 | Medium | 2017-09-30 | Not applicable | Working exploit published | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte. |
| CVE-2017-9756 | High | 2017-06-19 | Not applicable | Working exploit published | The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. |
| CVE-2017-9750 | High | 2017-06-19 | Not applicable | Working exploit published | opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. |
| CVE-2017-9749 | High | 2017-06-19 | Not applicable | Working exploit published | The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. |
| CVE-2017-9748 | High | 2017-06-19 | Not applicable | Working exploit published | The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug. |
| CVE-2017-9747 | High | 2017-06-19 | Not applicable | Working exploit published | The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug. |
| CVE-2017-9746 | High | 2017-06-19 | Not applicable | Working exploit published | The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during "objdump -D" execution. |
| CVE-2017-9742 | High | 2017-06-19 | Not applicable | Working exploit published | The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. |
| CVE-2017-1000366 | High | 2017-06-19 | Not applicable | Working exploit published | glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier. |
| CVE-2016-2226 | High | 2017-02-24 | Not applicable | Working exploit published | Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow. |
| CVE-2016-7098 | High | 2016-09-26 | Not applicable | Working exploit published | Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open. |
| CVE-2016-4971 | High | 2016-06-30 | Not applicable | Working exploit published | GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. |
| CVE-2015-0235 | High | 2015-01-28 | Outside Waratek scope | Working exploit published | Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST." |
| CVE-2011-2702 | Medium | 2014-10-27 | Not applicable | Working exploit published | Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S, (2) memcpy-ssse3.S, or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/, which triggers an out-of-bounds read, as demonstrated using the memcpy function. |
| CVE-2014-5119 | High | 2014-08-29 | Not applicable | Working exploit published | Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules. |
| CVE-2012-4412 | High | 2013-10-09 | Not applicable | Working exploit published | Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow. |
| CVE-2013-4788 | Medium | 2013-10-04 | Not applicable | Working exploit published | The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address. |
| CVE-2009-5029 | Medium | 2013-05-02 | Not applicable | Working exploit published | Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd. |
| CVE-2012-5667 | Medium | 2013-01-03 | Not applicable | Working exploit published | Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow. |
| CVE-2012-3480 | Medium | 2012-08-25 | Not applicable | Working exploit published | Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow. |
| CVE-2012-1663 | High | 2012-03-13 | Not applicable | Working exploit published | Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted certificate list. |
| CVE-2011-1071 | Medium | 2011-04-08 | Not applicable | Working exploit published | The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome. |
| CVE-2011-0536 | Medium | 2011-04-08 | Not applicable | Working exploit published | Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847. |
| CVE-2010-4052 | Medium | 2011-01-13 | Not applicable | Working exploit published | Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD. |
| CVE-2010-4051 | Medium | 2011-01-13 | Not applicable | Working exploit published | The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow." |
| CVE-2010-3856 | High | 2011-01-07 | Not applicable | Working exploit published | ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so. |
| CVE-2010-3847 | Medium | 2011-01-07 | Not applicable | Working exploit published | elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory. |
| CVE-2009-4880 | Medium | 2010-06-01 | Not applicable | Working exploit published | Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391. |
| CVE-2010-0002 | Low | 2010-01-14 | Not applicable | Working exploit published | The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename. |
| CVE-2009-1416 | High | 2009-04-30 | Not applicable | Working exploit published | lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key. |
| CVE-2009-1415 | Medium | 2009-04-30 | Not applicable | Working exploit published | lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free. |
| CVE-2008-5659 | High | 2008-12-17 | Not applicable | Working exploit published | The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys. |
| CVE-2007-6613 | Medium | 2008-01-03 | Not applicable | Working exploit published | Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name. |
| CVE-2007-5795 | Medium | 2007-11-02 | Not applicable | Working exploit published | The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a Local variables declaration. |
| CVE-2007-4476 | High | 2007-09-05 | Not applicable | Working exploit published | Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack." |
| CVE-2007-3048 | High | 2007-06-05 | Not applicable | Working exploit published | GNU screen 4.0.3 allows local users to unlock the screen via a CTRL-C sequence at the password prompt. NOTE: multiple third parties report inability to reproduce this issue |
| CVE-2007-1263 | Medium | 2007-03-06 | Not applicable | Working exploit published | GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection. |
| CVE-2006-6719 | Medium | 2006-12-23 | Not applicable | Working exploit published | The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP server with a large number of blank 220 responses to the SYST command. |
| CVE-2006-6097 | Medium | 2006-11-24 | Not applicable | Working exploit published | GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216. |
| CVE-2006-5864 | Medium | 2006-11-11 | Not applicable | Working exploit published | Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the (1) DocumentMedia, (2) DocumentPaperSizes, and possibly (3) PageMedia and (4) PaperSize headers. NOTE: this issue can be exploited through other products that use gv such as evince. |
| CVE-2006-3636 | Medium | 2006-09-06 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2006-2362 | High | 2006-05-15 | Not applicable | Working exploit published | Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character. |
| CVE-2006-0455 | Medium | 2006-02-15 | Not applicable | Working exploit published | gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify". |
| CVE-2006-0075 | High | 2006-01-04 | Not applicable | Working exploit published | Direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field (mail variable) in a new message, which is written to a PHP file. |
| CVE-2005-4807 | High | 2005-12-31 | Not applicable | Working exploit published | Stack-based buffer overflow in the as_bad function in messages.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils before 20050721 allows attackers to execute arbitrary code via a .c file with crafted inline assembly code. |
| CVE-2005-2878 | High | 2005-09-13 | Not applicable | Working exploit published | Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command. |
| CVE-2005-2397 | Medium | 2005-07-27 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in guestbook.php in phpBook 1.46 allows remote attackers to inject arbitrary web script or HTML via the admin parameter. |
| CVE-2005-1523 | High | 2005-05-26 | Not applicable | Working exploit published | Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands. |
| CVE-2005-1520 | High | 2005-05-26 | Not applicable | Working exploit published | Buffer overflow in the header_get_field_name function in header.c for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via a crafted e-mail. |
| CVE-2004-1488 | Medium | 2005-04-27 | Not applicable | Working exploit published | wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code. |
| CVE-2004-1170 | High | 2005-01-10 | Not applicable | Working exploit published | a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename. |
| CVE-2004-2014 | Low | 2004-12-31 | Not applicable | Working exploit published | Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded. |
| CVE-2004-0354 | High | 2004-11-23 | Not applicable | Working exploit published | Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c, (2) the anubis_error function in errs.c, or (3) the ssl_error function in ssl.c. |
| CVE-2004-0353 | High | 2004-11-23 | Not applicable | Working exploit published | Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string. |
| CVE-2004-1701 | High | 2004-08-09 | Not applicable | Working exploit published | Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication. |
| CVE-2004-0548 | High | 2004-08-06 | Not applicable | Working exploit published | Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) "c" compress option or (2) "d" decompress option. |
| CVE-2003-1232 | Medium | 2003-12-31 | Not applicable | Working exploit published | Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable. |
| CVE-2003-0795 | Medium | 2003-12-15 | Not applicable | Working exploit published | The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference. |
| CVE-2003-0854 | Low | 2003-11-17 | Not applicable | Working exploit published | ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd. |
| CVE-2003-0853 | Medium | 2003-11-17 | Not applicable | Working exploit published | An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd. |
| CVE-2003-0849 | High | 2003-11-17 | Not applicable | Working exploit published | Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function. |
| CVE-2003-0826 | High | 2003-10-06 | Not applicable | Working exploit published | lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack. |
| CVE-2003-0038 | Medium | 2003-02-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters. |
| CVE-2002-0855 | High | 2002-09-05 | Not applicable | Working exploit published | Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature. |
| CVE-2002-0388 | High | 2002-06-18 | Not applicable | Working exploit published | Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) the Pipermail index summaries. |
| CVE-2002-1602 | Medium | 2002-04-23 | Not applicable | Working exploit published | Buffer overflow in the Braille module for GNU screen 3.9.11, when HAVE_BRAILLE is defined, allows local users to execute arbitrary code. |
| CVE-2001-1036 | High | 2001-08-31 | Not applicable | Working exploit published | GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory. |
| CVE-2001-0522 | High | 2001-08-14 | Not applicable | Working exploit published | Format string vulnerability in Gnu Privacy Guard (aka GnuPG or gpg) 1.05 and earlier can allow an attacker to gain privileges via format strings in the original filename that is stored in an encrypted file. |
| CVE-2001-1022 | High | 2001-07-26 | Not applicable | Working exploit published | Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command. |
| CVE-2000-0824 | High | 2000-11-14 | Not applicable | Working exploit published | The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LD_PRELOAD or LD_LIBRARY_PATH. |
| CVE-1999-0491 | Medium | 1999-04-20 | Not applicable | Working exploit published | The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute. |
| CVE-1999-0016 | Medium | 1997-12-01 | Not applicable | Working exploit published | Land IP denial of service. |
| CVE-1999-0041 | High | 1997-02-13 | Not applicable | Working exploit published | Buffer overflow in NLS (Natural Language Service). |