CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3369 | CVE-2001-0556 | Candidate | The Nirvana Editor (NEdit) 5.1.1 and earlier allows a local attacker to overwrite other users" files via a symlink attack on (1) backup files or (2) temporary files used when nedit prints a file or portions of a file. | Proposed (20010727) | ACCEPT(6) Baker, Bishop, Cole, Foat, Williams, Ziese | MODIFY(1) Frech | NOOP(2) Christey, Wall | Frech> nedit-print-symlink(6424) | Christey> SGI:20011105-01-P | ftp://patches.sgi.com/support/free/security/advisories/20011105-01-P | ADDREF BID:2627 | URL:http://www.securityfocus.com/bid/2627 | (there are different BID"s for the different symlink issues) | View |
| 3375 | CVE-2001-0562 | Candidate | a1disp.cgi program in Drummond Miles A1Stats prior to 1.6 allows a remote attacker to execute commands via a specially crafted URL which includes shell metacharacters. | Proposed (20010727) | ACCEPT(3) Cole, Frech, Ziese | NOOP(4) Bishop, Christey, Foat, Wall | Frech> CONFIRM:http://www.gadnet.com/cgi-bin/ultimatebb.cgi?ubb=get_topic&f=1 | 5&t=000008 | Statement of fix is ambiguous: A major security flaw in the scripts | has now been fixed. For obvious reasons the details of the flaw will | not be posted here. | Site lists their product as A1-Stats, not A1Stats as in description. | CHANGE> [Bishop changed vote from REVIEWING to NOOP] | Christey> The URL recommended by Andre is *probably* addressing this | problem, but it"s not quite certain. There is insufficient | detail to determine if the vendor has truly acknowledged the | problem. I have an email to a1stats@gadnet.com to see | if I can confirm. | | This is affected by CD:SF-EXEC since multiple executables in the same | package are affected (a1disp.cgi, a1disp2.cgi, a1disp4.cgi, and | a1disp3.cgi). | Christey> Received confirmation via email, 2/26/2002. | View |
| 3379 | CVE-2001-0566 | Candidate | Cisco Catalyst 2900XL switch allows a remote attacker to create a denial of service via an empty UDP packet sent to port 161 (SNMP) when SNMP is disabled. | Proposed (20010727) | ACCEPT(3) Baker, Frech, Ziese | MODIFY(1) Bishop | NOOP(2) Cole, Wall | REJECT(1) Foat | Bishop> Is the entire switch shut down or is traffic blocked for a | limited time? | Foat> Unable to duplicate event | Baker> Seems kind of strange that someone that works at Cisco would accept this vulnerability, | yet someone else would reject it. I was unable to find a reference on the Cisco | web site, so perhaps we need some clarification about the accept vote, like what build | of the OS is vulnerable, since the "fail to duplicate" may be a different build of the | OS. | CHANGE> [Baker changed vote from REVIEWING to ACCEPT] | View |
| 3381 | CVE-2001-0568 | Candidate | Digital Creations Zope 2.3.1 b1 and earlier allows a local attacker (Zope user) with through-the-web scripting capabilities to alter ZClasses class attributes. | Proposed (20010727) | ACCEPT(5) Baker, Bishop, Cole, Williams, Ziese | MODIFY(1) Frech | NOOP(2) Foat, Wall | Frech> XF:zope-zclass-modification(6247) | View |
| 3382 | CVE-2001-0569 | Candidate | Digital Creations Zope 2.3.1 b1 and earlier contains a problem in the method return values related to the classes (1) ObjectManager, (2) PropertyManager, and (3) PropertySheet. | Proposed (20010727) | ACCEPT(4) Baker, Cole, Williams, Ziese | MODIFY(2) Bishop, Frech | NOOP(2) Foat, Wall | Bishop> the description is too vague; please specify the result of | the problem | Frech> XF:zope-classes-return-value(6952) | View |
Page 278 of 20943, showing 5 records out of 104715 total, starting on record 1386, ending on 1390
