CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3956 | CVE-2001-1152 | Candidate | Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters. | Proposed (20020315) | ACCEPT(2) Baker, Foat | MODIFY(1) Frech | NOOP(4) Armstrong, Cole, Green, Wall | REJECT(1) Ziese | Ziese> ACCEPT REASON: Rejection logic makes sense, products have to be used as | intended. Misuse is not a security vulnerability per se. | Frech> XF:content-slash-bypass-filter(6816) | Baker> I would say that this is a vulnerability, since their website | touts URL filtering as a feature of the product. If the product has to | filter URL"s then the product needs to be able to filter URL"s properly, | or the product fails. | Here is the list of features, quoted from their product page for | web sweeper: | | "Key Features | Policy based web security implementation for information posted to and downloaded from the web | Protects against unauthorized users accessing the web utilizing user authentication | Provides URL filtering blocking stopping inappropriate site access | Protects against loss of confidential information, viruses, portable code, and inappropriate content entering and | leaving via web based e-mail accounts such as hotmail and Yahoo | Auditing and reporting on individual and group web traffic | Customizable "Block" and "Progress Message" pages " | View |
| 3958 | CVE-2001-1154 | Candidate | Cyrus 2.0.15, 2.0.16, and 1.6.24 on BSDi 4.2, with IMAP enabled, allows remote attackers to cause a denial of service (hang) using PHP IMAP clients. | Proposed (20020315) | ACCEPT(2) Frech, Green | NOOP(5) Armstrong, Cole, Foat, Wall, Ziese | View | |
| 3960 | CVE-2001-1156 | Candidate | TYPSoft FTP 0.95 allows remote attackers to cause a denial of service (CPU consumption) via a "../../*" argument to (1) STOR or (2) RETR. | Proposed (20020315) | ACCEPT(6) Armstrong, Baker, Cole, Frech, Green, Ziese | NOOP(2) Foat, Wall | Frech> http://membres.lycos.fr/typsoft/eng/history.html currently | shows as 404. | New page is | http://www.typsoft.com/history.php?prog=ftp&PHPSESSID=3c2ef43838699c79 | efab517f60af5349 | View |
| 3961 | CVE-2001-1157 | Candidate | Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode. | Proposed (20020315) | ACCEPT(1) Green | MODIFY(1) Frech | NOOP(5) Armstrong, Cole, Foat, Wall, Ziese | Frech> XF:content-script-bypass-filtering(6580) | XF:content-unicode-bypass-script(6980) | View |
| 3963 | CVE-2001-1159 | Candidate | load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP. | Proposed (20020315) | ACCEPT(3) Baker, Frech, Green | NOOP(5) Armstrong, Cole, Foat, Wall, Ziese | CHANGE> [Baker changed vote from REVIEWING to ACCEPT] | View |
Page 20777 of 20943, showing 5 records out of 104715 total, starting on record 103881, ending on 103885
