CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 8715 | CVE-2004-0287 | Candidate | Xlight FTP server 1.52 allows remote authenticated users to cause a denial of service (crash) via a RETR command with a long argument containing a large number of / (slash) characters, possibly triggering a buffer overflow. | Modified (20050518) | NOOP(5) Armstrong, Christey, Cole, Cox, Wall | Christey> CONFIRM:http://xlightftpd.com/forum/viewtopic.php?t=32 | and http://www.xlightftpd.com/forum/viewtopic.php?t=40 says | that this was fixed in 1.55. | | Also, DELREF BID:9627 - it"s not a clean match. | Instead, ADDREF BID:9668 | View |
| 3150 | CVE-2001-0329 | Candidate | Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi. | Modified (20011130) | ACCEPT(4) Baker, Cole, Renaud, Williams | MODIFY(1) Frech | NOOP(2) Wall, Ziese | RECAST(1) Christey | Christey> CONFIRM:http://www.mozilla.org/projects/bugzilla/security2_12.html | Frech> XF:bugzilla-email-shell-characters(6488) | CHANGE> [Christey changed vote from NOOP to RECAST] | Christey> This needs to be MERGED with CVE-2000-0421. | CVE-2000-0421 documents a problem in the "who" parameter of | the process_bug.cgi program. This is a duplicate of one of the | problems being identified by CVE-2001-0329. The other problem | in CVE-2001-0329, the Bugzilla_login cookie, is fixed in | the same version as the who problem is. CD:SF-EXEC | suggests merging multiple executables in the same package | that have the same problem that is present in the same version. | Both the "who" and "Bugzilla_login" problems were fixed in | version 2.12. Therefore CVE-2000-0421 and CVE-2001-0329 | need to be MERGED. | | CHANGEREF BID:1199 | View |
| 5233 | CVE-2002-0843 | Candidate | Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response. | Modified (20071016) | ACCEPT(3) Armstrong, Cole, Green | MODIFY(1) Cox | NOOP(1) Christey | Christey> CONFIRM:http://www.info.apple.com/usen/security/security_updates.html | Cox> Support inclusion decision: a user may well run ApacheBench against | their own server in a DMZ that has been compromised therefore leading | to a break across security zones. | Addref: RHSA-2002:251 | Addref: RHSA-2002:248 | Addref: RHSA-2002:244 | Addref: RHSA-2002:243 | Addref: RHSA-2002:222 | Change Apache Week ref to: http://www.apacheweek.com/issues/02-10-04#security | Christey> SGI:20021105-02-I | URL:ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I | Christey> BUGTRAQ:20021016 Apache 1.3.26 | URL:http://archives.neohapsis.com/archives/bugtraq/2002-10/0229.html | XF:apache-apachebench-response-bo(10281) | URL:http://www.iss.net/security_center/static/10281.php | BID:5996 | URL:http://www.securityfocus.com/bid/5996 | View |
| 5229 | CVE-2002-0839 | Candidate | The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard. | Modified (20110830) | ACCEPT(3) Armstrong, Cole, Green | MODIFY(1) Cox | NOOP(1) Christey | Christey> CONFIRM:http://www.info.apple.com/usen/security/security_updates.html | Cox> Addref: RHSA-2002:251 | Addref: RHSA-2002:248 | Addref: RHSA-2002:244 | Addref: RHSA-2002:243 | Addref: RHSA-2002:222 | Change Apache Week ref to: http://www.apacheweek.com/issues/02-10-04#security | Christey> SGI:20021105-02-I | URL:ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I | View |
| 5458 | CVE-2002-1070 | Candidate | Cross-site scripting vulnerability in PHPWiki Postnuke wiki module allows remote attackers to execute script as other PHPWiki users via the pagename parameter. | Proposed (20020830) | ACCEPT(1) Frech | NOOP(5) Christey, Cole, Cox, Foat, Wall | Christey> CONFIRM:http://cvs.sourceforge.net/viewcvs.py/phpwiki/phpwiki/lib/Request.php | This URL is a changelog for Request.php. For revsion 1.17, | dated 20020909, the author says "Prevent from possible XSS attacks" | and includes a sample exploit for the pagename parameter. | View |
Page 318 of 20943, showing 5 records out of 104715 total, starting on record 1586, ending on 1590
