CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3396 | CVE-2001-0583 | Candidate | Alt-N Technologies MDaemon 3.5.4 allows a remote attacker to create a denial of service via the URL request of a MS-DOS device (such as GET /aux) to (1) the Worldclient service at port 3000, or (2) the Webconfig service at port 3001. | Proposed (20010727) | ACCEPT(3) Baker, Frech, Williams | NOOP(5) Bishop, Cole, Foat, Wall, Ziese | Baker> ftp1.deerfield.com/pub/mdaemon/Archive/3.5.6/ | This is the site for downloading from Deerfield, the parent company. | The release notes on the web site only apply to version 4.0 and higher. | If you download the 3.5.6 version, you can then install the software, | which will also install the release notes, named RelNotes.txt, in the | docs sub-directory. Inside this file is a vendor confirmation | of sorts, at least close enough for me.... | I quote: | "----------------------------------------------------------------------------- | MDaemon Server v3.X Release Notes | ----------------------------------------------------------------------------- | | PLEASE READ THIS ENTIRE DOCUMENT. IMPORTANT ISSUES RELATED TO THE RELEASE OF | MDAEMON 3.X ARE LISTED TOWARD THE BOTTOM OF THIS DOCUMENT. THEY ARE | CRITICALLY IMPORTANT! PLEASE READ THIS ENTIRE DOCUMENT. | | ---------------------------- | MDaemon v3.5.6 - Mar 9, 2001 | ---------------------------- | | SPECIAL CONSIDERATIONS | ---------------------- | | o None (see 3.51 below) | | MAJOR NEW FEATURES | ------------------ | | o None | | | ADDITIONAL CHANGES AND NEW FEATURES | ----------------------------------- | | o None | | FIXES | ----- | | o Fix to memory leak in IMAP server. | o Fix to crash problem in WorldClient Standard and WebConfig web server. | o Fix to "Send As" address not being used as MAIL FROM when forwarding. | o Fix to "local only" restriction not being applied when mail collected | via DomainPOP. | | ------------------------------- | MDaemon v3.5.4 - Feb 19th, 2001 | ------------------------------- | " | This matches the described problems in the worldclient and webconfig servers | which are part of the Mdaemon package. | View |
| 3334 | CVE-2001-0520 | Candidate | Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including (1) onload in the BODY tag, (2) href in the A tag, (3) the BUTTON tag, (4) the INPUT tag, or (5) any other tag in which scripts can be defined. | Proposed (20010727) | ACCEPT(3) Baker, Cole, Frech | NOOP(3) Foat, Wall, Ziese | REVIEWING(1) Bishop | Baker> Found reference on their website, in the release notes, that appears | to address the problem in this vulnerability: | | "15. Fixed a bug that used to cause the SmartStripping mechanism to miss some scripts in HTML pages." | | The release notes are available here: | ftp://ftp.ealaddin.com/pub/manuals/ESG/ESG3.x/esg_rn.zip | View |
| 3913 | CVE-2001-1109 | Candidate | Directory traversal vulnerability in EFTP 2.0.7.337 allows remote authenticated users to reveal directory contents via a .. (dot dot) in the (1) LIST, (2) QUOTE SIZE, and (3) QUOTE MDTM commands. | Proposed (20020315) | ACCEPT(3) Baker, Frech, Green | NOOP(5) Armstrong, Cole, Foat, Wall, Ziese | Baker> Apparently vendor acknowledgement of the directory problems in the | release history, located at: | http://www.eftp.org/releasehistory.html | 2.0.8.345 2001.12.04 | Fixed a problem where the server would give a GPF whn disconnecting a single user | Added Ratios Feature | Added Statistics Feature | Modified User/Group Administration - now much more stable | Modified Startup Logo | Modifed all data files to .ini files for easy editing and to save space | Added Feature to save/load queues | Added auto reconnect feature on timeout | Fully Implemented RSA Control Port encryption, so now even commands like USER, PASS, GET, REST etc are encrypted. Total security on both data and commands. | Added Idle Timout for the Server component | Fixed some security flaws with directory listings | View |
| 2608 | CVE-2000-1039 | Candidate | Various TCP/IP stacks and network applications allow remote attackers to cause a denial of service by flooding a target host with TCP connection attempts and completing the TCP/IP handshake without maintaining the connection state on the attacker host, aka the "NAPTHA" class of vulnerabilities. NOTE: this candidate may change significantly as the security community discusses the technical nature of NAPTHA and learns more about the affected applications. This candidate is at a higher level of abstraction than is typical for CVE. | Proposed (20001219) | ACCEPT(3) Baker, Cole, Renaud | MODIFY(1) Frech | NOOP(2) Magdych, Wall | REVIEWING(1) Christey | Baker> Although this is at a high level, the fact is that it is a vulnerability, and as such we need to recognize this, even if we have to recast or modify the description at some later time. | Christey> This needs to be commented on and reviewed by many Board | members. | Frech> XF:naptha-resource-starvation(5810) | Christey> ADDREF SGI:20020304-01-A | Christey> SGI:20020304-01-A | View |
| 597 | CVE-1999-0615 | Candidate | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The SNMP service is running." | Modified (20080731) | ACCEPT(3) Baker, Prosser, Wall | NOOP(1) Christey | REJECT(1) Northcutt | Baker> Although newer versions on snmp are not as vulnerable as prior versions, | this can still be a significant risk of exploitation, as seen in recent | attacks on snmp services via automated worms | Christey> XF:snmp(132) ? | Prosser> This fits the "exposure" description although we also know there are many vulnerabilities in SNMP. This is more of a policy/best practice issue for administrators. If you need SNMP lock it down as tight as you can, if you don"t need it, don"t run it. | View |
Page 369 of 20943, showing 5 records out of 104715 total, starting on record 1841, ending on 1845
