CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3395 | CVE-2001-0582 | Candidate | Ben Spink CrushFTP FTP Server 2.1.6 and earlier allows a local attacker to access arbitrary files via a ".." (dot dot) attack, or variations, in (1) GET, (2) CD, (3) NLST, (4) SIZE, (5) RETR. | Modified (20050510) | ACCEPT(4) Bishop, Cole, Frech, Ziese | NOOP(2) Foat, Wall | View | |
| 3446 | CVE-2001-0633 | Candidate | Directory traversal vulnerability in Sun Chili!Soft ASP on multiple Unixes allows a remote attacker to read arbitrary files above the web root via a ".." (dot dot) attack in the sample script "codebrws.asp". | Proposed (20010727) | ACCEPT(4) Bishop, Cole, Williams, Ziese | MODIFY(1) Frech | NOOP(3) Baker, Foat, Wall | Frech> XF:chilisoft-asp-view-files(6137) | CHANGE> [Baker changed vote from REVIEWING to NOOP] | View |
| 1754 | CVE-2000-0176 | Candidate | The default configuration of Serv-U 2.5d and earlier allows remote attackers to determine the real pathname of the server by requesting a URL for a directory or file that does not exist. | Proposed (20000322) | ACCEPT(4) Blake, Cole, Levy, Ozancin | MODIFY(1) Frech | NOOP(3) Baker, LeBlanc, Wall | Frech> XF:servu-ftp-server-path(4060) | View |
| 1755 | CVE-2000-0177 | Candidate | DNSTools CGI applications allow remote attackers to execute arbitrary commands via shell metacharacters. | Proposed (20000322) | ACCEPT(4) Blake, Cole, Levy, Ozancin | MODIFY(1) Frech | NOOP(3) Baker, LeBlanc, Wall | Frech> XF:dnstools-invalid-input(4876) | View |
| 465 | CVE-1999-0467 | Candidate | The Webcom CGI Guestbook programs wguest.exe and rguest.exe allow a remote attacker to read arbitrary files using the "template" parameter. | Modified (20000106-01) | ACCEPT(4) Blake, Frech, Landfield, Ozancin | NOOP(3) Baker, Christey, Northcutt | Christey> CVE-1999-0287 is probably a duplicate of CVE-1999-0467. In | NTBUGTRAQ:19990409 Webcom"s CGI Guestbook for Win32 web servers | Mnemonix says that he had previously reported on a similar | problem. Let"s refer to the NTBugtraq posting as | CVE-1999-0467. We will refer to the "previous report" as | CVE-1999-0287, which can be found at: | http://oliver.efri.hr/~crv/security/bugs/NT/httpd41.html | | 0287 describes an exploit via the "template" hidden variable. | The exploit describes manually editing the HTML form to | change the filename to read from the template variable. | | The exploit as described in 0467 encodes the template variable | directly into the URL. However, hidden variables are also | encoded into the URL, which would have looked the same to | the web server regardless of the exploit. Therefore 0287 | and 0467 are the same. | Christey> | The CD:SF-EXEC content decision also applies here. We have 2 | programs, wguest.exe and rguest.exe, which appear to have the | same problem. CD:SF-EXEC needs to be accepted by the Editorial | Board before this candidate can be converted into a CVE | entry. When finalized, CD:SF-EXEC will decide whether | this candidate should be split or not. | Christey> BID:2024 | View |
Page 1038 of 20943, showing 5 records out of 104715 total, starting on record 5186, ending on 5190
