CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 200 | CVE-1999-0201 | Entry | A quote cwd command on FTP servers can reveal the full path of the home directory of the "ftp" user. | View | |||
| 199 | CVE-1999-0200 | Candidate | Windows NT FTP server (WFTP) with the guest account enabled without a password allows an attacker to log into the FTP server using any username and password. | Modified (19991130-01) | ACCEPT(1) Baker | MODIFY(2) Frech, Shostack | NOOP(2) Northcutt, Wall | REJECT(1) Christey | REVIEWING(1) Levy | Shostack> WFTP is not sufficient; is this wu-, ws-, war-, or another? | Frech> Other have mentioned this before, but it may be WU-FTP. | POSSIBLY XF:ftp-exec; does this have to do with the Site Exec allowing root | access without anon FTP or a regular account? | POSSIBLY XF:wu-ftpd-exec;same as above conditions, but instead from a | non-anon FTP account and gain root privs. | Christey> added MSKB reference | CHANGE> [Christey changed vote from REVOTE to REJECT] | Christey> The MSKB article may have confused things even more. There | were reports of problems in a Windows-based FTP server called | WFTP (http://www.wftpd.com/) that is not a Microsft FTP | server. It"s best to just kill this candidate where it | stands and start fresh. | View |
| 198 | CVE-1999-0198 | Candidate | finger .@host on some systems may print information on some user accounts. | Proposed (19990726) | ACCEPT(1) Baker | MODIFY(2) Frech, Shostack | REJECT(1) Northcutt | Shostack> as above | Frech> Need more reference to establish this "exposure". | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:finger-unused-accounts(8378) | We"re entering it into our database solely to track | competition. The only references seem to be product listings: | http://hq.mcafeeasap.com/vulnerabilities/vuln_data/1000.asp (1004 | Finger .@target-host check) | http://www.ipnsa.com/ipnsa_vuln.htm?step=1000 (Finger .@target-host | check ) | http://cgi.nessus.org/plugins/dump.php3?id=10072 (Finger dot at host | feature) | View |
| 197 | CVE-1999-0197 | Candidate | finger 0@host on some systems may print information on some user accounts. | Proposed (19990726) | ACCEPT(1) Baker | MODIFY(2) Frech, Shostack | REJECT(1) Northcutt | Shostack> fingerd may respond to "finger 0@host" with account info | Frech> Need more reference to establish this "exposure". | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:finger-unused-accounts(8378) | We"re entering it into our database solely to track | competition. The only references seem to be product listings: | http://hq.mcafeeasap.com/vulnerabilities/vuln_data/1000.asp (1002 | Finger 0@host check) | http://www.ipnsa.com/ipnsa_vuln.htm?step=1000 (Finger 0@host check) | http://cgi.nessus.org/plugins/dump.php3?id=10069 (Finger zero at host | feature) | View |
| 196 | CVE-1999-0196 | Entry | websendmail in Webgais 1.0 allows a remote user to access arbitrary files and execute arbitrary code via the receiver parameter ($VAR_receiver variable). | View |
Page 20904 of 20943, showing 5 records out of 104715 total, starting on record 104516, ending on 104520
