CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3960 | CVE-2001-1156 | Candidate | TYPSoft FTP 0.95 allows remote attackers to cause a denial of service (CPU consumption) via a "../../*" argument to (1) STOR or (2) RETR. | Proposed (20020315) | ACCEPT(6) Armstrong, Baker, Cole, Frech, Green, Ziese | NOOP(2) Foat, Wall | Frech> http://membres.lycos.fr/typsoft/eng/history.html currently | shows as 404. | New page is | http://www.typsoft.com/history.php?prog=ftp&PHPSESSID=3c2ef43838699c79 | efab517f60af5349 | View |
| 1710 | CVE-2000-0132 | Candidate | Microsoft Java Virtual Machine allows remote attackers to read files via the getSystemResourceAsStream function. | Proposed (20000208) | ACCEPT(2) Cole, Wall | NOOP(1) Baker | REJECT(3) Christey, Frech, LeBlanc | Frech> How is this different from MITRE:CVE-2000-0162, other than the | fact that it has an MS advisory that"s vague on the reason but | has the same outcome, and this one mentions the | getSystemResourceAsStream function? | Christey> This is a duplicate of CVE-2000-0162, as confirmed via David | LeBlanc. The descriptions of CVE-2000-0132 and CVE-2000-0162 were | significantly different, as was the descriptive text of | MS:MS00-011 and the original Bugtraq posting. So this | duplicate wasn"t picked up before. CVE-2000-0162 needs to be | modified to include XF:virtual-machine-file-read as a | reference. | LeBlanc> Duplicate | Christey> Ensure that CVE-2000-0162 uses msvm-java-file-read(4024) now, | instead of virtual-machine-file-read(4577) | Frech> If duplicate with CVE-2000-0098, shouldn"t the references be | moved over to the valid CVE number? Please advise. | Christey> When CVE-2000-0132 is rejected, the references will be added | to CVE-2000-0098. | View |
| 1088 | CVE-1999-1108 | Candidate | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-1107. Reason: This candidate is a duplicate of CVE-1999-1107. Notes: All CVE users should reference CVE-1999-1107 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. | Modified (20050204) | ACCEPT(1) Cole | NOOP(2) Foat, Wall | REJECT(2) Christey, Frech | Frech> Has exactly the same attributes as CVE-1999-1107. | Christey> DUPE CVE-1999-1107. | View |
| 498 | CVE-1999-0501 | Candidate | A Unix account has a guessable password. | Proposed (19990714) | ACCEPT(3) Baker, Northcutt, Shostack | RECAST(2) Frech, Meunier | REVIEWING(1) Christey | Frech> Guessable falls into the class of CVE-1999-0502, since I can guess a | default, null, etc. password. | Suggest changing to something like "has an existing non-default password | that can be guessed." | I"m also including default passwords in this entry. | In that vein, we show the following references: | XF:user-password | XF:passwd-username | XF:default-unix-sync | XF:default-unix-4dgifts | XF:default-unix-bin | XF:default-unix-daemon | XF:default-unix-lp | XF:default-unix-me | XF:default-unix-nuucp | XF:default-unix-root | XF:default-unix-toor | XF:default-unix-tour | XF:default-unix-tty | XF:default-unix-uucp | Christey> This candidate is affected by the CD:CF-PASS content decision, | which determines the appropriate level of abstraction to | use for password problems. CD:CF-PASS needs to be accepted | by the Editorial Board before this candidate can be | converted into a CVE entry; the final version of CD:CF-PASS | may require using a different LOA than this candidate is | currently using. | CHANGE> [Meunier changed vote from ACCEPT to RECAST] | Meunier> This relates only to account password technology, so this candidate is | independent of the operating system, application, web site or other | application of this technology. The appropriate (natural) level of | abstraction is therefore without specifying that it is for UNIX. | Change the description to "An account has a guessable password other | than default, null, blank." This should satisfy Andre"s objection. | | This Candidate should be merged with any candidate relating to | account password technology where "Unix" in the original description | can be replaced by something else. | View |
| 533 | CVE-1999-0537 | Candidate | A configuration in a web browser such as Internet Explorer or Netscape Navigator allows execution of active content such as ActiveX, Java, Javascript, etc. | Proposed (19990726) | ACCEPT(1) Wall | NOOP(1) Baker | RECAST(1) Frech | REJECT(1) LeBlanc | Frech> Good candidate for dot notation. | XF:nav-java-enabled | XF:nav-javascript-enabled | XF:ie-active-content | XF:ie-active-download | XF:ie-active-scripting | XF:ie-activex-execution | XF:ie-java-enabled | XF:netscape-javascript | XF:netscape-java | XF:zone-active-scripting | XF:zone-activex-execution | XF:zone-desktop-install | XF:zone-low-channel | XF:zone-file-download | XF:zone-file-launch | XF:zone-java-scripting | XF:zone-low-java | XF:zone-safe-scripting | XF:zone-unsafe-scripting | LeBlanc> Not a vulnerability. These are just checks for configuration | settings that a user might have changed. I understand need to increase | number of checks in a scanning product, but don"t feel like these belong | in CVE. Scanner vendors could argue that these entries are needed to | keep a common language. | Baker> Not sure about whether we should bother to include this type issue or not. It does provide a stepping stone for further actions, but in and of itself it isn"t a specific vulnerability. | View |
Page 230 of 20943, showing 5 records out of 104715 total, starting on record 1146, ending on 1150
