CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 4042 | CVE-2001-1238 | Candidate | Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the Process tab which could allow local users to install Trojan horses that cannot be stopped with the Task Manager. | Proposed (20020502) | ACCEPT(3) Cole, Frech, Green | NOOP(2) Cox, Foat | REJECT(1) Baker | REVIEWING(1) Wall | Baker> I don"t think this is really a vulnerability. If I am not mistaken, | those are "services" which have to be managed by the services control | in windows 2K. This keeps users from killing things the system has | to have. I don"t think it is possible to kill another of other services | in this manner either. Try it on almost any W2K system, and there are any | number of services that you cannot kill from the process tab, rather you | must go to the services controller to stop the service. | I vote to reject this, as this is not a vulnerability, since you would have | to be administrator on the system to change one of these services to a trojan | version anyway. | View |
| 5059 | CVE-2002-0669 | Candidate | The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause a denial of service by modifying the SIP_AUTHENTICATE_SCHEME value to force authentication of incoming calls, which does not notify the user when an authentication failure occurs. | Proposed (20030317) | ACCEPT(1) Cole | NOOP(2) Cox, Wall | REJECT(1) Baker | Baker> I don"t believe that a configuration option by the administrator is a | vulnerability. The fact that the administrator can require authentication | of users attempting to use the service, without notifying users that | are NOT using authentication is not a vulnerability. For example, I | could configure sshd to allow only certain hosts to connect, by means of | a key, and if someone else tried to connect that is not authorized, it | would disallow it. Similarly, the administrator could require authentication | and only notify those users allowed to connect of the necessary authentication | credentials to preclude un-authorized use of the system. The only way I would | see this as a vulnerability was if the change was able to be made without | the proper credentials through some fault in the program, or if there was no way to enable authentication on | any client trying to connect which would render the system unusable to everyone | (but that would still not really be a vulnerability as much as a "stupid | feature") | The ability to make this change afer gaining administrator priveleges by means | of another vulnerability does not make this a vulnerability. I would classify | this as a configuration setting that can severly restrict access, at the discretion | of the administrator. | View |
| 2592 | CVE-2000-1023 | Candidate | The Alabanza Control Panel does not require passwords to access administrative commands, which allows remote attackers to modify domain name information via the nsManager.cgi CGI program. | Proposed (20001129) | ACCEPT(2) Collins, Mell | NOOP(2) Cole, Wall | REJECT(1) Baker | Baker> I agree with Steve that this appears to be an on-line applet, accessible from their server only. | CHANGE> [Baker changed vote from REVIEWING to REJECT] | View |
| 3177 | CVE-2001-0357 | Candidate | FormMail.pl in FormMail 1.6 and earlier allows a remote attacker to send anonymous email (spam) by modifying the recipient and message parameters. | Modified (20060526) | ACCEPT(2) Baker, Frech | NOOP(6) Bishop, Christey, Cole, Foat, Wall, Ziese | REVIEWING(1) Williams | Baker> http://www.securityfocus.com/archive/1/168177 | http://www.securityfocus.com/archive/1/168292 | http://www.securityfocus.com/archive/1/168366 | http://www.securityfocus.com/archive/1/168345 | http://www.securityfocus.com/archive/1/168302 | http://www.securityfocus.com/archive/1/168360 | http://www.securityfocus.com/archive/1/168633 | | I think from the discussion on the Bugtraq list, there is sufficient verfication that this | is a real problem, and well-known. There are a couple of work arounds | described in the posts, so this should be accepted. | Christey> Fix typo: "paramaters" | Christey> Fix typo: "paramater" | Christey> The following references discuss this problem and/or later | variants of it, up to version 1.9. | MISC:http://www.softwolves.pp.se/misc/formmail_hall_of_shame | MISC:http://www.monkeys.com/anti-spam/formmail-advisory.pdf | MISC:http://www.scriptarchive.com/readme/formmail.html | View |
| 5694 | CVE-2002-1310 | Candidate | Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia JRun 4.0 and earlier allows remote attackers to execute arbitrary via an HTTP GET request with a long .jsp file name. | Modified (20060616) | ACCEPT(3) Armstrong, Baker, Cole | NOOP(1) Cox | REVIEWING(1) Wall | Baker> http://www.macromedia.com/v1/handlers/index.cfm?ID=23500 | View |
Page 367 of 20943, showing 5 records out of 104715 total, starting on record 1831, ending on 1835
