CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1775 | CVE-2000-0197 | Candidate | The Windows NT scheduler uses the drive mapping of the interactive user who is currently logged onto the system, which allows the local user to gain privileges by providing a Trojan horse batch file in place of the original batch file. | Proposed (20000322) | ACCEPT(3) Baker, Cole, Levy | MODIFY(1) Frech | NOOP(2) Blake, Ozancin | REJECT(1) LeBlanc | REVIEWING(1) Wall | LeBlanc> this is just bad security practice, not a vulnerability | Frech> XF:nt-at-drive-mappings | View |
| 1998 | CVE-2000-0420 | Candidate | The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker tor ecover it and use it to decrypt Encrypted File System (EFS) data. | Proposed (20000615) | ACCEPT(2) Levy, Ozancin | MODIFY(1) Frech | NOOP(2) Cole, Stracener | REJECT(1) LeBlanc | REVIEWING(1) Wall | LeBlanc> This is not a vulnerability. It is essentially an advisory on best | practices. Also, the description is extremely inaccurate. If I weren"t | intimately familiar with the issue, I would not be able to understand it | from this. Syskey, when applied at lower levels, has well-documented | limitations. | Stracener> "..to recover" | Frech> XF:win2k-syskey-default-configuration | Change "tor ecover" to "to recover" | View |
| 2378 | CVE-2000-0802 | Candidate | The BAIR program does not properly restrict access to the Internet Explorer Internet options menu, which allows local users to obtain access to the menu by modifying the registry key that starts BAIR. | Proposed (20000921) | NOOP(5) Baker, Cole, LeBlanc, Wall, Williams | REVIEWING(1) Levy | LeBlanc> What the heck is BAIR? I don"t think it is MS software. | View |
| 1923 | CVE-2000-0345 | Candidate | The on-line help system options in Cisco routers allows non-privileged users without "enabled" access to obtain sensitive information via the show command. | Proposed (20000518) | ACCEPT(1) Prosser | MODIFY(1) Frech | NOOP(5) Armstrong, Baker, Cole, Levy, Wall | REJECT(1) Balinsky | Levy> Arguably this is not a vulnerability. Cisco replying saying this | is standard behaviour that was simply not well documented. They have | no plans to change it and will simply document it better. | Frech> XF:cisco-online-help | Balinsky> As noted in a bugtraq posting by Lisa Napier from Cisco"s Product Security Incident Response Team, this is a poorly documented feature. This is intended behavior, and does not represent a vulnerability in Cisco"s opinion. | http://www.securityfocus.com/frames/?content=/templates/archive.pike?list=1&mid=59434 | Prosser> Although Lisa Napier did say this issue was "functioning as designed", it was not intended to allow unprivileged access. Lisa did indicate that Cisco would be updating instructions on configuration to ensure proper user privileges. So, this should be considered IMHO an "exposure" vice a vulnerability, but security-related none the less. | http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3D20000502222246.28423.qmail@securityfocus.com | | http://www.securityfocus.com/bid/1161 | View |
| 2361 | CVE-2000-0785 | Candidate | WircSrv IRC Server 5.07s allows IRC operators to read arbitrary files via the importmotd command, which sets the Message of the Day (MOTD) to the specified file. | Proposed (20000921) | ACCEPT(1) Baker | MODIFY(1) Levy | NOOP(3) Cole, Wall, Williams | Levy> BID 1472 | View |
Page 20912 of 20943, showing 5 records out of 104715 total, starting on record 104556, ending on 104560
