| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Command execution in Sun systems via buffer overflow in the at program. |
| Command execution via shell metachars in INN daemon (innd) 1.5 using "newgroup" and "rmgroup" control messages, and others. |
| Buffer overflow in HP-UX newgrp program. |
| File creation and deletion, and remote execution, in the BSD line printer daemon (lpd). |
| pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call. |
| Certain configurations of wu-ftp FTP server 2.4 use a _PATH_EXECPATH setting to a directory with dangerous commands, such as /bin, which allows remote authenticated users to gain root access via the "site exec" command. |
| Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0. |
| Buffer overflow in AIX libDtSvc library can allow local users to gain root access. |
| The debug command in Sendmail is enabled, allowing attackers to execute commands as root. |
| Remote access in AIX innd 1.5.1, using control messages. |
| Echo and chargen, or other combinations of UDP services, can be used in tandem to flood the server, a.k.a. UDP bomb or UDP packet storm. |
| swinstall and swmodify commands in SD-UX package in HP-UX systems allow local users to create or overwrite arbitrary files to gain root access. |
| Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death. |
| vold in Solaris 2.x allows local users to gain root access. |
| The SATAN session key may be disclosed if the user points the web browser to other sites, possibly allowing root access. |
| Some classic Cisco IOS devices have a vulnerability in the PPP CHAP authentication to establish unauthorized PPP connections. |
| In Cisco IOS 10.3, with the tacacs-ds or tacacs keyword, an extended IP access control list could bypass filtering. |
| In older versions of Sendmail, an attacker could use a pipe character to execute root commands. |
| In SunOS, NFS file handles could be guessed, giving unauthorized access to the exported file system. |
| The portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, possibly bypassing authentication that would otherwise have taken place. For example, NFS file systems could be mounted through the portmapper despite export restrictions. |