CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1186 | CVE-1999-1206 | Candidate | SystemSoft SystemWizard package in HP Pavilion PC with Windows 98, and possibly other platforms and operating systems, installs two ActiveX controls that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via a malicious web page that references (1) the Launch control, or (2) the RegObj control. | Proposed (20010912) | ACCEPT(4) Armstrong, Cole, Foat, Stracener | MODIFY(1) Frech | NOOP(2) Christey, Wall | Frech> XF:systemwizard-modify-registry(7080) | Christey> CERT-VN:VU#22919 | URL:http://www.kb.cert.org/vuls/id/22919 | CERT-VN:VU#34453 | URL:http://www.kb.cert.org/vuls/id/34453 | View |
| 4743 | CVE-2002-0351 | Candidate | Buffer overflows in CFS daemon (cfsd) before 1.3.3-8.1, and 1.4x before 1.4.1-5, allow remote attackers to cause a denial of service and possibly execute arbitrary code. | Proposed (20020502) | ACCEPT(4) Armstrong, Cole, Frech, Green | NOOP(3) Cox, Foat, Wall | View | |
| 1550 | CVE-1999-1570 | Candidate | Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter. | Proposed (20020830) | ACCEPT(4) Armstrong, Cole, Frech, Green | NOOP(3) Cox, Foat, Wall | REVIEWING(1) Christey | Frech> It seems as if the BID-4089 assignment on this CAN name may be | in error. | BID-4089 (Multiple Vendor SNMP Request Handling Vulnerabilities) is | already assigned to CVE-2002-0013. Also, this CVE issue seems to have | nothing to do with SNMP. | Christey> Agreed, this is the wrong BID. SecurityFocus has assigned | BID:643 to CVE-1999-1570, but there"s a bit of an | inconsistency. BID:643 alludes to Bugtraq posts in 1999 | from Brock Tellier, mentioning overflows in sar via BOTH the | -o and -f parameters. However, they also link this issue to | SCO advisory 99.17, although the advisory itself is too vague | to *really* know what vulns they fixed. And now the link | to a potentially more detailed document (sse037.ltr) | is broken. So we don"t have any independent reason for | knowing whether SCO 99.17 (a) addresses any "sar" | vulnerabilities, and (b) even if it does, whether it addresses | *both* the -o and -f arguments originally claimed by Tellier. | Finally, it seems rather curious that CSSA-2002-SCO.17 | talks about a -o overflow but does not mention -f. | Sounds like an email to the security people at SCO | is in order... | | OK. Having consulted with SCO (who responded quickly), I | looked even further into this issue. There is now sufficient | evidence that the -f overflow was fixed in 1999. This | means that a separate candidate should be created (by | CD:SF-LOC), so the -f overflow is now covered by | CVE-1999-1571. | | Need to DELREF BID:4089 | CHANGE> [Frech changed vote from NOOP to ACCEPT] | CHANGE> [Christey changed vote from NOOP to REVIEWING] | View |
| 2622 | CVE-2000-1053 | Candidate | Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly calling the com.livesoftware.jrun.plugins.JSP JSP servlet. | Proposed (20001129) | ACCEPT(4) Armstrong, Cole, Frech, Mell | View | |
| 2557 | CVE-2000-0988 | Candidate | WinU 1.0 through 5.1 has a backdoor password that allows remote attackers to gain access to its administrative interface and modify configuration. | Proposed (20001129) | ACCEPT(4) Armstrong, Cole, Frech, Mell | View |
Page 1009 of 20943, showing 5 records out of 104715 total, starting on record 5041, ending on 5045
