CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 2909 | CVE-2001-0088 | Candidate | common.inc.php in phpWebLog 0.4.2 does not properly initialize the $CONF array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the SiteKey and gain administrative privileges to phpWebLog. | Proposed (20010202) | ACCEPT(2) Baker, Frech | NOOP(3) Cole, Wall, Ziese | View | |
| 2658 | CVE-2000-1090 | Candidate | Microsoft IIS for Far East editions 4.0 and 5.0 allows remote attackers to read source code for parsed pages via a malformed URL that uses the lead-byte of a double-byte character. | Proposed (20010202) | ACCEPT(3) Baker, Frech, LeBlanc | NOOP(1) Cole | REVIEWING(3) Christey, Wall, Ziese | LeBlanc> Fixed in SP2 for Win2K. NT 4.0 is not affected. bulletin | MS99-022 | Christey> Need to add the Bugtraq references for this. | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> Is this really the same problem addressed by MS99-022, | which is covered by CVE-1999-0725 ? | View |
| 2914 | CVE-2001-0093 | Candidate | Vulnerability in telnetd in FreeBSD 1.5 allows local users to gain root privileges by modifying critical environmental variables that affect the behavior of telnetd. | Proposed (20010202) | ACCEPT(3) Baker, Cole, Ziese | MODIFY(2) Frech, Prosser | NOOP(1) Wall | REVIEWING(1) Christey | Frech> XF:kerberos4-arbitrary-proxy(9733) | Description states FreeBSD, but advisory is for NetBSD. | Prosser> http://www.linuxsecurity.com/advisories/netbsd_advisory-1007.html | CHANGE> [Prosser changed vote from ACCEPT to MODIFY] | Prosser> The operating system in this CAN should also be NetBSD vice FreeBSD, same as in 0094. FreeBSD 3.5 STABLE and 4.2 STABLE are vulnerable as well. See ref | FreeBSD-SA-01:25 | http://www.linuxsecurity.com/advisories/freebsd_advisory-1153.html | or http://www.freebsd.org/security/security.html#adv | Christey> This description does not explicitly mention that the problem is | in a kerberized telnet. Need to verify that there aren"t | already other CVE"s that describe this. | View |
| 2918 | CVE-2001-0097 | Candidate | The Web interface for Infinite Interchange 3.6.1 allows remote attackers to cause a denial of service (application crash) via a large POST request. | Proposed (20010202) | ACCEPT(1) Frech | NOOP(3) Cole, Wall, Ziese | Frech> Version is listed as 3.61 (see | http://support.infinite.com/kb/648.asp) | Also, vendor seems to have issued a verification (see above | document): | - - WebMail: Fix for an exception error triggered by a POST request | with | an extremely long garbage URL. (v3.61.08) | View |
| 2919 | CVE-2001-0098 | Candidate | Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." string. | Proposed (20010202) | ACCEPT(1) Frech | NOOP(3) Cole, Wall, Ziese | View |
Page 20628 of 20943, showing 5 records out of 104715 total, starting on record 103136, ending on 103140
