CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 5800 | CVE-2002-1416 | Candidate | The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct brute force attacks. | Proposed (20030317) | ACCEPT(1) Cole | NOOP(2) Cox, Wall | REVIEWING(1) Baker | Baker> See entry for CAN 2002-1415... | View |
| 5795 | CVE-2002-1411 | Candidate | Directory traversal vulnerability in update.dpgs in Duma Photo Gallery System (DPGS) 0.99.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the id parameter. | Proposed (20030317) | ACCEPT(1) Cole | MODIFY(1) Baker | NOOP(2) Cox, Wall | Baker> Since the vendor no longer maintains the code, no fix appears available. | The dpgs.pll file has insufficient filtering to preclude this, so a fix | should not be too difficult to make and should be straightforward. | The description should probably reflect that the lax filtering in | the dpgs.pll file allows form to be posted with the directory traversal | and null byte data. | View |
| 5868 | CVE-2002-1484 | Candidate | DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message. | Proposed (20030317) | ACCEPT(2) Armstrong, Cole | MODIFY(1) Baker | NOOP(2) Cox, Wall | Baker> The default behavior is the verbose debug messages, so the description should indicate that this is the default configuration. | View |
| 5799 | CVE-2002-1415 | Candidate | Format string vulnerability in SMTP service for WebEasyMail 3.4.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in SMTP requests. | Proposed (20030317) | ACCEPT(1) Cole | NOOP(2) Cox, Wall | REVIEWING(1) Baker | Baker> There is an updated version available from the vendor"s website, | http://www.51webmail.com/downloadwem.html | however, I am unable to determine whether this bug has been fixed or | not, since the site is in Chinese. There is no english language version | of it, apparently. There is an upgrade notes and patch listing under the | download menu, so if we have someone with chinese language skills, we might | be able to get this one sorted out... | View |
| 5825 | CVE-2002-1441 | Candidate | Multiple buffer overflows in Tomahawk SteelArrow before 4.5 allow remote attackers to execute arbitrary code via (1) the Steelarrow Service (Steelarrow.exe) using a long UserIdent Cookie header, (2) DLLHOST.EXE (Steelarrow.dll) via a request for a long .aro file, or (3) DLLHOST.EXE via a Chunked Transfer-Encoding request. | Proposed (20030317) | ACCEPT(1) Cole | MODIFY(1) Baker | NOOP(2) Cox, Wall | Baker> THere is no changelog file in the installer either, so it is difficult to determine how many issues were addressed in the new version. | View |
Page 20579 of 20943, showing 5 records out of 104715 total, starting on record 102891, ending on 102895
