CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3308 | CVE-2001-0491 | Candidate | Directory traversal vulnerability in RaidenFTPD Server 2.1 before build 952 allows attackers to access files outside the ftp root via dot dot attacks, such as (1) .... in CWD, (2) .. in NLST, or (3) ... in NLST. | Modified (20010910-01) | ACCEPT(1) Williams | MODIFY(2) Baker, Frech | NOOP(4) Cole, Renaud, Wall, Ziese | Frech> XF:raidenftpd-dot-directory-traversal(6455) | Baker> Should probably modify description to say v2.1 prior to build 952, since the interim builds also had similar problems until build 952 resolved this. | View |
| 3313 | CVE-2001-0496 | Candidate | kdesu in kdelibs package creates world readable temporary files containing authentication info, which can allow local users to gain privileges. | Modified (20010910-01) | ACCEPT(4) Baker, Cole, Williams, Ziese | MODIFY(1) Frech | NOOP(2) Renaud, Wall | REVIEWING(1) Christey | Williams> kdesu is part of kdelibs package. since entire kdelibs package must be upgraded, and since kdelibs (rather than kdesu) is referenced in most advisories related to this issue, we might want to reference kdelibs in this CAN. | Frech> XF:kdelibs-kdesu-insecure-tmpfile(6856) | Christey> Agree with Ken Williams. The CVE descriptions in general | should capture all "reasonable" keywords under which | someone may know the vulnerability. | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> It"s possible that this is the same vulnerability as CVE-2001-0178, | but the description is written so differently from the others, that | it"s hard to be sure. In addition, Mandrake released a separate | advisory for CVE-2001-0178. | BID:2669 addresses CVE-2001-0178. | View |
| 3068 | CVE-2001-0247 | Candidate | Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3. | Modified (20010910-01) | ACCEPT(5) Baker, Cole, Oliver, Renaud, Ziese | MODIFY(1) Frech | NOOP(2) Christey, Wall | Frech> XF:ftp-glob-expansion(6332) | Christey> ADDREF SGI:20010802-01-P | Christey> COMPAQ:SSRT-547 | URL:http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html | View |
| 1512 | CVE-1999-1532 | Candidate | Netscape Messaging Server 3.54, 3.55, and 3.6 allows a remote attacker to cause a denial of service (memory exhaustion) via a series of long RCPT TO commands. | Modified (20011126-01) | MODIFY(1) Frech | NOOP(3) Cole, Foat, Wall | Frech> XF:netscape-messaging-rcptto-dos(8340) | Description ends with a comma and not a period, possibly | indicating that the sentence is not complete, | View |
| 3150 | CVE-2001-0329 | Candidate | Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi. | Modified (20011130) | ACCEPT(4) Baker, Cole, Renaud, Williams | MODIFY(1) Frech | NOOP(2) Wall, Ziese | RECAST(1) Christey | Christey> CONFIRM:http://www.mozilla.org/projects/bugzilla/security2_12.html | Frech> XF:bugzilla-email-shell-characters(6488) | CHANGE> [Christey changed vote from NOOP to RECAST] | Christey> This needs to be MERGED with CVE-2000-0421. | CVE-2000-0421 documents a problem in the "who" parameter of | the process_bug.cgi program. This is a duplicate of one of the | problems being identified by CVE-2001-0329. The other problem | in CVE-2001-0329, the Bugzilla_login cookie, is fixed in | the same version as the who problem is. CD:SF-EXEC | suggests merging multiple executables in the same package | that have the same problem that is present in the same version. | Both the "who" and "Bugzilla_login" problems were fixed in | version 2.12. Therefore CVE-2000-0421 and CVE-2001-0329 | need to be MERGED. | | CHANGEREF BID:1199 | View |
Page 20385 of 20943, showing 5 records out of 104715 total, starting on record 101921, ending on 101925
