CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 5386 | CVE-2002-0998 | Candidate | Directory traversal vulnerability in cafenews.php for CARE 2002 before beta 1.0.02 allows remote attackers to read arbitrary files via .. (dot dot) sequences and null characters in the lang parameter, which is processed by a call to the include function. | Proposed (20020830) | ACCEPT(3) Baker, Cole, Frech | NOOP(3) Cox, Foat, Wall | View | |
| 1549 | CVE-1999-1569 | Candidate | Quake 1 and NetQuake servers allow remote attackers to cause a denial of service (resource exhaustion or forced disconnection) via a flood of spoofed UDP connection packets, which exceeds the server"s player limit. | Proposed (20020830) | ACCEPT(1) Frech | NOOP(5) Armstrong, Cole, Cox, Foat, Wall | REVIEWING(1) Green | View | |
| 5389 | CVE-2002-1001 | Candidate | Buffer overflows in AnalogX Proxy before 4.12 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a long HTTP request to TCP port 6588 or (2) a SOCKS 4A request to TCP port 1080 with a long DNS hostname. | Proposed (20020830) | ACCEPT(3) Baker, Cole, Frech | NOOP(3) Cox, Foat, Wall | View | |
| 1550 | CVE-1999-1570 | Candidate | Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter. | Proposed (20020830) | ACCEPT(4) Armstrong, Cole, Frech, Green | NOOP(3) Cox, Foat, Wall | REVIEWING(1) Christey | Frech> It seems as if the BID-4089 assignment on this CAN name may be | in error. | BID-4089 (Multiple Vendor SNMP Request Handling Vulnerabilities) is | already assigned to CVE-2002-0013. Also, this CVE issue seems to have | nothing to do with SNMP. | Christey> Agreed, this is the wrong BID. SecurityFocus has assigned | BID:643 to CVE-1999-1570, but there"s a bit of an | inconsistency. BID:643 alludes to Bugtraq posts in 1999 | from Brock Tellier, mentioning overflows in sar via BOTH the | -o and -f parameters. However, they also link this issue to | SCO advisory 99.17, although the advisory itself is too vague | to *really* know what vulns they fixed. And now the link | to a potentially more detailed document (sse037.ltr) | is broken. So we don"t have any independent reason for | knowing whether SCO 99.17 (a) addresses any "sar" | vulnerabilities, and (b) even if it does, whether it addresses | *both* the -o and -f arguments originally claimed by Tellier. | Finally, it seems rather curious that CSSA-2002-SCO.17 | talks about a -o overflow but does not mention -f. | Sounds like an email to the security people at SCO | is in order... | | OK. Having consulted with SCO (who responded quickly), I | looked even further into this issue. There is now sufficient | evidence that the -f overflow was fixed in 1999. This | means that a separate candidate should be created (by | CD:SF-LOC), so the -f overflow is now covered by | CVE-1999-1571. | | Need to DELREF BID:4089 | CHANGE> [Frech changed vote from NOOP to ACCEPT] | CHANGE> [Christey changed vote from NOOP to REVIEWING] | View |
| 5391 | CVE-2002-1003 | Candidate | Buffer overflow in MyWebServer 1.02 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. | Proposed (20020830) | ACCEPT(1) Frech | NOOP(4) Cole, Cox, Foat, Wall | View |
Page 20867 of 20943, showing 5 records out of 104715 total, starting on record 104331, ending on 104335
