The ToolTalk ttsession daemon uses weak RPC authentication, which allows a remote attacker to execute commands.

Denial of service in Netscape Enterprise Server (NES) in HP Virtual Vault (VVOS) via a long URL.

Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.

Denial of service in Sendmail 8.8.6 in HPUX.

Denial of service in Gauntlet Firewall via a malformed ICMP packet.

Microsoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled.

Buffer overflow in Microsoft FrontPage Server Extensions (PWS) 3.0.2.926 on Windows 95, and possibly other versions, allows remote attackers to cause a denial of service via a long URL.

Windows NT Terminal Server performs extra work when a client opens a new connection but before it is authenticated, allowing for a denial of service.

Buffer overflow in hybrid-6 IRC server commonly used on EFnet allows remote attackers to execute commands via m_invite invite option.

A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.

The WebRamp web administration utility has a default password.

sdtcm_convert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.

Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host.

The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.

Buffer overflow in ALMail32 POP3 client via From: or To: headers.

Buffer overflow in Fujitsu Chocoa IRC client via IRC channel topics.

Buffer overflow in ToxSoft NextFTP client through CWD command.

Buffer overflow in the Eyedog ActiveX control allows a remote attacker to execute arbitrary commands.

The Eyedog ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.

The scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.