CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 2448 | CVE-2000-0879 | Candidate | LPPlus programs dccsched, dcclpdser, dccbkst, dccshut, dcclpdshut, and dccbkstshut are installed setuid root and world executable, which allows arbitrary local users to start and stop various LPD services. | Proposed (20001018) | ACCEPT(2) Baker, Collins | NOOP(3) Armstrong, Cole, Wall | View | |
| 2449 | CVE-2000-0880 | Candidate | LPPlus creates the lpdprocess file with world-writeable permissions, which allows local users to kill arbitrary processes by specifying an alternate process ID and using the setuid dcclpdshut program to kill the process that was specified in the lpdprocess file. | Proposed (20001018) | ACCEPT(2) Baker, Collins | NOOP(3) Armstrong, Cole, Wall | View | |
| 2450 | CVE-2000-0881 | Candidate | The dccscan setuid program in LPPlus does not properly check if the user has the permissions to print the file that is specified to dccscan, which allows local users to print arbitrary files. | Proposed (20001018) | ACCEPT(2) Baker, Collins | NOOP(3) Armstrong, Cole, Wall | View | |
| 2401 | CVE-2000-0832 | Candidate | Htgrep CGI program allows remote attackers to read arbitrary files by specifying the full pathname in the hdr parameter. | Modified (20010910-01) | ACCEPT(2) Baker, Collins | MODIFY(1) Frech | NOOP(4) Armstrong, Christey, Cole, Wall | Frech> XF:htgrep-cgi-view-files(5476) | Collins> http://www.iam.unibe.ch/~scg/Src/Doc/ | Christey> The change log for htgrep acknowledges the problem, but it | says that the qry tag is also affected. CD:SF-LOC says that | multiple problems of the same type in the same version should | be combined, so this candidate should get a "soft recast" | and qry should be added to the description. | View |
| 5147 | CVE-2002-0757 | Candidate | (1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations. | Proposed (20020726) | ACCEPT(2) Baker, Cole | NOOP(5) Armstrong, Christey, Cox, Foat, Wall | Christey> This *might* be vendor acknowledgement: | URL:http://www.geocrawler.com/lists/3/SourceForge/12082/0/8595354/ | | However, the person who"s credited by the vendor found *TWO* | authentication-related vulnerabilities at about the same time, | and the vendor is clearly fixing "a" vulnerability. So, which | issue did the vendor fix? Which issue is the vendor | acknowledging - CVE-2002-0757 or CVE-2002-0756? | View |
Page 20164 of 20943, showing 5 records out of 104715 total, starting on record 100816, ending on 100820
