CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1152 | CVE-1999-1172 | Candidate | By design, Maximizer Enterprise 4 calendar and address book program allows arbitrary users to modify the calendar of other users when the calendar is being shared. | Proposed (20010912) | MODIFY(1) Frech | NOOP(3) Cole, Foat, Wall | REVIEWING(1) Christey | Christey> The discloser does not provide enough details to fully | understand what the problem is. This makes it difficult | because if Maximizer has a concept of "users" and it is | designed to allow any user to modify any other user"s data, | then this would not be a vulnerability or exposure, unless | that "cross-user" capability could be used to violate system | integrity, data confidentiality, or the like. There are some | features of Maximizer 6.0 that, if abused, could allow someone | to do some bad things. For example, an attacker could modify | the email addresses for contacts to redirect sales to | locations besides the customer. There"s also a capability of | assigning priorities and alarms, which could be susceptible to | an "inconvenience attack" at the very least, as well as | tie-ins to e-commerce capabilities. | | The critical question becomes: "how is this data shared" in | the first place? If it"s through a network share or other | distribution method besides transferring the complete database | between sites, then this may be accessible to any attacker who | can mimic a Maximizer client (if there is such a thing as a | client), and this could be a vulnerability or exposure | according to the CVE definition. | | However, since the Maximizer functionality is unknown to me | and not readily apparent from product documentation, it"s hard | to know what to do about this one. | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:maximizer-enterprise-calendar-modification(7590) | View |
| 1488 | CVE-1999-1508 | Candidate | Web server in Tektronix PhaserLink Printer 840.0 and earlier allows a remote attacker to gain administrator access by directly calling undocumented URLs such as ncl_items.html and ncl_subjects.html. | Proposed (20010912) | MODIFY(1) Frech | NOOP(3) Cole, Foat, Wall | REVIEWING(1) Christey | Frech> XF:tektronix-phaserlink-webserver-backdoor(6482) | Possible dupe with CVE-2001-0484 and BID-2659. | Christey> CVE-2001-0484 may be a duplicate. | View |
| 3432 | CVE-2001-0619 | Candidate | The Lucent Closed Network protocol can allow remote attackers to join Closed Network networks which they do not have access to. The "Network Name" or SSID, which is used as a shared secret to join the network, is transmitted in the clear. | Proposed (20010727) | MODIFY(1) Frech | NOOP(3) Cole, Foat, Wall | REJECT(1) Ziese | REVIEWING(1) Bishop | Frech> XF:orinoco-ap-plaintext-ssid(7005) | View |
| 1481 | CVE-1999-1501 | Candidate | (1) ipxchk and (2) ipxlink in SGI OS2 IRIX 6.3 does not properly clear the IFS environmental variable before executing system calls, which allows local users to execute arbitrary commands. | Proposed (20010912) | MODIFY(1) Frech | NOOP(3) Cole, Foat, Wall | REJECT(1) Christey | Frech> XF:irix-ipxchk-ipxlink-ifs-commands(7365) | Christey> DUPE CVE-1999-1040 | View |
| 1029 | CVE-1999-1049 | Candidate | ARCserve NT agents use weak encryption (XOR) for passwords, which allows remote attackers to sniff the authentication request to port 6050 and decrypt the password. | Proposed (20010912) | MODIFY(1) Frech | NOOP(3) Cole, Foat, Wall | Frech> XF:arcserve-agent-passwords(1822) | View |
Page 19820 of 20943, showing 5 records out of 104715 total, starting on record 99096, ending on 99100
