CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 396 | CVE-1999-0397 | Candidate | The demo version of the Quakenbush NT Password Appraiser sends passwords across the network in plaintext. | Proposed (19990728) | ACCEPT(1) Northcutt | MODIFY(1) Frech | NOOP(1) Baker | REJECT(1) Wall | Wall> Reject based on beta copy. | Frech> XF:quakenbush-pw-appraiser(1652) | View |
| 463 | CVE-1999-0465 | Candidate | Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter. | Proposed (19990728) | ACCEPT(2) Frech, Northcutt | NOOP(1) Baker | REJECT(2) LeBlanc, Wall | Wall> Reject based on client-side DoS | LeBlanc> Client side DOS | View |
| 567 | CVE-1999-0585 | Candidate | A Windows NT administrator account has the default name of Administrator. | Proposed (19990721) | ACCEPT(1) Ozancin | MODIFY(1) Frech | REJECT(3) Baker, Northcutt, Shostack | REVIEWING(1) Wall | Wall> Some sources say this is not a vulnerability, but a warning. It just | slows down the search for the admin account (SID = 500) which can | always be found. | Northcutt> I change this on all NT systems I am responsible for, but is | root a vulnerability? | Baker> There are ways to identify the administrator account anyway, so this | is only a minor delay to someone that is knowledgeable. This, in and | of itself, doesn"t really strike me as a vulnerability, anymore than | the root account on a Unix box. | Shostack> (there is no way to hide the account name today) | Frech> XF:nt-adminexists | View |
| 575 | CVE-1999-0593 | Candidate | The default setting for the Winlogon key entry ShutdownWithoutLogon in Windows NT allows users with physical access to shut down a Windows NT system without logging in. | Modified (20091029) | ACCEPT(1) Wall | MODIFY(1) Frech | NOOP(1) Baker | REJECT(1) Northcutt | Wall> Still a denial of service. | Northcutt> May well be appropriate | Frech> XF:nt-shutdown-without-logon(1291) | View |
| 454 | CVE-1999-0455 | Candidate | The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly. | Modified (19991210-01) | ACCEPT(3) Balinsky, Frech, Ozancin | MODIFY(1) Wall | NOOP(1) Baker | REVIEWING(1) Christey | Wall> The reference should be ASB99-01 (Expression Evaluator Security Issues) | make application plural since there are three sample applications | (openfile.cfm, displayopenedfile.cfm, and exprcalc.cfm). | Christey> The CD:SF-EXEC and CD:SF-LOC content decisions apply here. | Since there are 3 separate "executables" with the same | (or similar) problem, we need to make sure that CD:SF-EXEC | determines what to do here. There is evidence that some | of these .cfm scripts have an "include" file, and if so, | then CD:SF-LOC says that we shouldn"t make separate entries | for each of these scripts. On the other hand, the initial | L0pht discovery didn"t include all 3 of these scripts, and | as far as I can tell, Allaire had patched the first problem | before the others were discovered. So, CD:DISCOVERY-DATE | may argue that we should split these because the problems | were discovered and patched at different times. | | In any case, this candidate can not be accepted until the | Editorial Board has accepted the CD:SF-EXEC, CD:SF-LOC, | and CD:DISCOVERY-DATE content decisions. | View |
Page 20937 of 20943, showing 5 records out of 104715 total, starting on record 104681, ending on 104685
