CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3067 | CVE-2001-0246 | Candidate | Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different domain, aka a variant of the "Frame Domain Verification" vulnerability. | Proposed (20010524) | ACCEPT(5) Baker, Cole, Magdych, Wall, Williams | MODIFY(1) Frech | NOOP(2) Renaud, Ziese | REVIEWING(1) Christey | Christey> See comments for CVE-2001-0332; may need to be merged because | of CD:SF-LOC. | Frech> XF:ie-frame-verification-variant(6748) | View |
| 3333 | CVE-2001-0519 | Candidate | Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags. | Proposed (20010727) | ACCEPT(3) Cole, Foat, Frech | NOOP(2) Wall, Ziese | REVIEWING(1) Bishop | View | |
| 3334 | CVE-2001-0520 | Candidate | Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including (1) onload in the BODY tag, (2) href in the A tag, (3) the BUTTON tag, (4) the INPUT tag, or (5) any other tag in which scripts can be defined. | Proposed (20010727) | ACCEPT(3) Baker, Cole, Frech | NOOP(3) Foat, Wall, Ziese | REVIEWING(1) Bishop | Baker> Found reference on their website, in the release notes, that appears | to address the problem in this vulnerability: | | "15. Fixed a bug that used to cause the SmartStripping mechanism to miss some scripts in HTML pages." | | The release notes are available here: | ftp://ftp.ealaddin.com/pub/manuals/ESG/ESG3.x/esg_rn.zip | View |
| 3335 | CVE-2001-0521 | Candidate | Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document. | Proposed (20010727) | ACCEPT(2) Baker, Cole | MODIFY(1) Frech | NOOP(3) Foat, Wall, Ziese | REVIEWING(1) Bishop | CHANGE> [Frech changed vote from ACCEPT to MODIFY] | Frech> DELREF:XF:esafe-gateway-bypass-filtering(6580) | ADDREF:XF:content-unicode-bypass-filter(6980) | Baker> Found acknowledgement in the release notes for build 71, that said: | | "15. Fixed a bug that used to cause the SmartStripping mechanism to miss some scripts in HTML pages." | | Release notes are at the following url: | ftp://ftp.ealaddin.com/pub/manuals/ESG/ESG3.x/esg_rn.zip | View |
| 3338 | CVE-2001-0524 | Candidate | eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, which allows a remote attacker to send arbitrary length strings to IIS, contrary to an advertised feature of SecureIIS versions 1.0.3 and earlier. | Proposed (20010727) | ACCEPT(4) Bishop, Cole, Frech, Ziese | NOOP(2) Foat, Wall | View |
Page 20660 of 20943, showing 5 records out of 104715 total, starting on record 103296, ending on 103300
