CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1521 | CVE-1999-1541 | Candidate | shell-lock in Cactus Software Shell Lock allows local users to read or modify decoded shell files before they are executed, via a symlink attack on a temporary file. | Proposed (20010912) | ACCEPT(1) Frech | NOOP(3) Cole, Foat, Wall | View | |
| 67057 | CVE-2013-7110 | Candidate | Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073. | Assigned (20131215) | None (candidate not yet proposed) | View | |
| 1777 | CVE-2000-0199 | Candidate | When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password. | Proposed (20000322) | ACCEPT(6) Baker, Blake, Cole, Levy, Ozancin, Wall | MODIFY(1) Frech | REVIEWING(2) Christey, LeBlanc | LeBlanc> I think this may just be user error - I"d like more information. | Frech> XF:mssql-weak-encryption | ISS:Vulnerability in Microsoft SQL Server 7.0 Encryption Used to Store | Administrative Login ID | URL:http://xforce.iss.net/alerts/advise45.php3 | Christey> According to Scott Culp, this can only be reproduced if the | SQL server is running in an unsafe mode that is not | recommended by Microsoft: "To securely use SQL Server, | Microsoft recommends using Windows Integrated Security. In | Windows Integrated Security mode passwords are never stored, | as your Windows Domain sign-on is used as the security | identifier to the database server." | | We still must consider approving this candidate, however, as a | user configuration error instead of a software flaw. | CD:DESIGN-WEAK-ENCRYPTION applies in this case, so if we | decide to include configuration problems in which a user | intentionally selects weak encryption, then we might still | approve this candidate. | View |
| 67313 | CVE-2013-7366 | Candidate | The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications. | Assigned (20140410) | None (candidate not yet proposed) | View | |
| 67569 | CVE-2014-0160 | Candidate | The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. | Assigned (20131203) | None (candidate not yet proposed) | View |
Page 19752 of 20943, showing 5 records out of 104715 total, starting on record 98756, ending on 98760
