CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3915 | CVE-2001-1111 | Candidate | EFTP 2.0.7.337 stores user passwords in plaintext in the eftp2users.dat file. | Proposed (20020315) | ACCEPT(3) Baker, Frech, Green | NOOP(5) Armstrong, Cole, Foat, Wall, Ziese | Baker> It looks like this issue was modified in the changelog, but the basic issue | still exists. They moved all data files into the ini file. Still a | plain text file, however. It would have been better in a registry setting | so it was harder to get to... | | 2.0.8.345 2001.12.04 | Fixed a problem where the server would give a GPF whn disconnecting a single user | Added Ratios Feature | Added Statistics Feature | Modified User/Group Administration - now much more stable | Modified Startup Logo | Modifed all data files to .ini files for easy editing and to save space | Added Feature to save/load queues | Added auto reconnect feature on timeout | Fully Implemented RSA Control Port encryption, so now even commands like USER, PASS, GET, REST etc are encrypted. Total security on both data and commands. | Added Idle Timout for the Server component | Fixed some security flaws with directory listings | View |
| 3916 | CVE-2001-1112 | Candidate | Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of characters. | Proposed (20020315) | ACCEPT(2) Frech, Green | NOOP(5) Armstrong, Cole, Foat, Wall, Ziese | View | |
| 3918 | CVE-2001-1114 | Candidate | book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the "current" parameter. | Proposed (20020315) | ACCEPT(1) Frech | NOOP(5) Armstrong, Cole, Foat, Green, Wall | REVIEWING(1) Ziese | View | |
| 3919 | CVE-2001-1115 | Candidate | generate.cgi in SIX-webboard 2.01 and before allows remote attackers to read arbitrary files via a dot dot (..) in the content parameter. | Proposed (20020315) | ACCEPT(2) Frech, Green | NOOP(5) Armstrong, Cole, Foat, Wall, Ziese | View | |
| 3926 | CVE-2001-1122 | Candidate | Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running the NT4ALL exploit program in "SPECIAL" mode. | Proposed (20020315) | ACCEPT(3) Foat, Frech, Green | NOOP(2) Baker, Cole | REJECT(2) Armstrong, Ziese | REVIEWING(1) Wall | Ziese> fact that important system | files are not appropriately secured from user, a/o admin, level access. | Green> ACCESS TO THE WINNT/SYSTEM32 DIRECTORY, ALLOWING FOR A DoS TO BE PERFORMED. | Foat> Our attempts to repair the computer with the Windows NT cd-rom failed. | The machine still would not allow logins. Tried two different NT 4.0 CD"s. Both | CD"s gave the error message that the file MSV1_0.dll read okay but is invalid on | the hard drive. It says the CD is probably defective. | Armstrong> I don"t believe that a privileged user being able to run code | on a system is a vulnerability. | Baker> I generally agree that unless you are elevating your priveleges, this should not be listed as a vulnerability. | CHANGE> [Baker changed vote from REVIEWING to NOOP] | View |
Page 20772 of 20943, showing 5 records out of 104715 total, starting on record 103856, ending on 103860
