CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 2656 | CVE-2000-1088 | Candidate | The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. | Proposed (20001219) | ACCEPT(4) Baker, Cole, Magdych, Wall | MODIFY(1) Frech | REVIEWING(1) Christey | Christey> CVE-2000-1085, CVE-2000-1086, CVE-2000-1087, and CVE-2000-1088 | all have abstraction issues; perhaps they should be RECAST | into a single candidate. | Christey> ADDREF XF:mssql-xp-paraminfo-bo | URL:http://xforce.iss.net/static/5622.php | Frech> XF:mssql-xp-paraminfo-bo(5622) | View |
| 2454 | CVE-2000-0885 | Candidate | Buffer overflows in Microsoft Network Monitor (Netmon) allow remote attackers to execute arbitrary commands via a long Browser Name in a CIFS Browse Frame, a long SNMP community name, or a long username or filename in an SMB session, aka the "Netmon Protocol Parsing" vulnerability. NOTE: It is highly likely that this candidate will be split into multiple candidates. | Modified (20010119-01) | ACCEPT(4) Baker, Cole, Mell, Renaud | MODIFY(1) Frech | Frech> XF:network-monitor-bo(5399) | View |
| 986 | CVE-1999-1006 | Candidate | Groupwise web server GWWEB.EXE allows remote attackers to determine the real path of the web server via the HELP parameter. | Proposed (19991222) | ACCEPT(4) Baker, Cole, Prosser, Stracener | MODIFY(1) Frech | NOOP(2) Christey, Wall | Frech> XF:groupwise-web-path | Prosser> Pretty well confirmed by testing with responses to BugTraq list. | | additional ref: BugTraq ID 879 http://www.securityfocus.com/bid/879 | Christey> A later discovery almost 2 years later is at: | BUGTRAQ:20020227 SecurityOffice Security Advisory:// Novell | GroupWise Web Access Path Disclosure Vulnerability | http://marc.theaimsgroup.com/?l=bugtraq&m=101494830315071&w=2 | CD:SF-LOC might suggest merging these together. | View |
| 2922 | CVE-2001-0101 | Candidate | Vulnerability in fetchmail 5.5.0-2 and earlier in the AUTHENTICATE GSSAPI command. | Modified (20020222-01) | ACCEPT(4) Baker, Cole, Prosser, Ziese | MODIFY(1) Frech | NOOP(1) Wall | Prosser> TURBO:TLSA2000024-1 | http://www.turbolinux.com/pipermail/tl-security-announce/2000-December/000027.html | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:fetchmail-authenticate-gssapi(7455) | View |
| 2840 | CVE-2001-0019 | Candidate | Arrowpoint (aka Cisco Content Services, or CSS) allows local users to cause a denial of service via a long argument to the "show script," "clear script," "show archive," "clear archive," "show log," or "clear log" commands. | Proposed (20010202) | ACCEPT(4) Baker, Cole, Prosser, Ziese | MODIFY(1) Frech | NOOP(2) Christey, Wall | Frech> XF:cisco-ccs-cli-dos(6030) | I could not find anything in the Cisco reference that | indicates that this is a local-only vulnerability. Suggest dropping | the description of "local users" unless further information is | available. | Christey> XF:cisco-ccs-cli-dos | Christey> BID:2330 | URL:http://www.securityfocus.com/bid/2330 | Prosser> CISCO:20010131 Cisco Content Services Switch Vulnerability | http://www.cisco.com/warp/public/707/arrowpoint-cli-filesystem-pub.shtml | View |
Page 1029 of 20943, showing 5 records out of 104715 total, starting on record 5141, ending on 5145
