CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 2646 | CVE-2000-1078 | Candidate | ICQ Web Front HTTPd allows remote attackers to cause a denial of service by requesting a URL that contains a "?" character. | Proposed (20001129) | ACCEPT(3) Baker, Frech, Mell | NOOP(2) Christey, Cole | Christey> The following post appears to describe the same problem, 7 | months earlier: | BUGTRAQ:20000310 ICQ remote DoS | View |
| 1766 | CVE-2000-0188 | Candidate | EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters. | Proposed (20000322) | ACCEPT(2) Levy, Ozancin | MODIFY(1) Frech | NOOP(6) Baker, Blake, Christey, Cole, LeBlanc, Wall | Christey> The exploit is different than CVE-2000-0187 by going through | a different field in a different script, so maybe this should | be kept separate, even though it"s probably another open() | call problem. | Frech> XF:ezshopper-search-cgi(4045) | View |
| 1152 | CVE-1999-1172 | Candidate | By design, Maximizer Enterprise 4 calendar and address book program allows arbitrary users to modify the calendar of other users when the calendar is being shared. | Proposed (20010912) | MODIFY(1) Frech | NOOP(3) Cole, Foat, Wall | REVIEWING(1) Christey | Christey> The discloser does not provide enough details to fully | understand what the problem is. This makes it difficult | because if Maximizer has a concept of "users" and it is | designed to allow any user to modify any other user"s data, | then this would not be a vulnerability or exposure, unless | that "cross-user" capability could be used to violate system | integrity, data confidentiality, or the like. There are some | features of Maximizer 6.0 that, if abused, could allow someone | to do some bad things. For example, an attacker could modify | the email addresses for contacts to redirect sales to | locations besides the customer. There"s also a capability of | assigning priorities and alarms, which could be susceptible to | an "inconvenience attack" at the very least, as well as | tie-ins to e-commerce capabilities. | | The critical question becomes: "how is this data shared" in | the first place? If it"s through a network share or other | distribution method besides transferring the complete database | between sites, then this may be accessible to any attacker who | can mimic a Maximizer client (if there is such a thing as a | client), and this could be a vulnerability or exposure | according to the CVE definition. | | However, since the Maximizer functionality is unknown to me | and not readily apparent from product documentation, it"s hard | to know what to do about this one. | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:maximizer-enterprise-calendar-modification(7590) | View |
| 8724 | CVE-2004-0296 | Candidate | TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a TsFtpSrv.exe to exit with an exception by opening and immediately closing a connection. | Modified (20050707) | NOOP(4) Armstrong, Cole, Cox, Wall | REVIEWING(1) Christey | Christey> The description is incomplete. Wonder what it was about the | original researcher that was important enough to note? | Christey> What was I saying in the desc about the original researcher??? | View |
| 5046 | CVE-2002-0656 | Candidate | Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3. | Modified (20071016) | ACCEPT(3) Baker, Cole, Wall | MODIFY(1) Cox | NOOP(2) Christey, Foat | Christey> The CVE content decision "CD:SF-LOC" recommends that multiple | bugs of the same type, in the same version of software, should | be combined. Content decisions such as CD:SF-LOC ensure the | long-term consistency of CVE across all vulnerability reports, | since the amount of detail can vary widely. | Cox> ADDREF:RHSA-2002:163 RHSA-2002:164 RHSA-2002:157 | This issue also affects SSLeay and BSAFE SSL-C | ADDREF: http://www.rsasecurity.com/products/bsafe/bulletins/BSAFE_SSL_Products_Security_Bulletin_Aug_8_2002.pdf | Christey> BUGTRAQ:20021003 Cisco Secure Content Accelerator vulnerable to SSL worm | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103374616018622&w=2 | CONFIRM:http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_sca/sca_320/v320b20.htm#xtocid13 | Christey> I should probably create a separate CAN for the BSAFE issues, | unless there is a codebase relationship. | Christey> XF:openssl-ssl3-sessionid-bo(9716) | URL:http://www.iss.net/security_center/static/9716.php | View |
Page 288 of 20943, showing 5 records out of 104715 total, starting on record 1436, ending on 1440
