CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 2772 | CVE-2000-1205 | Candidate | Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant. | Modified (20070926) | ACCEPT(7) Armstrong, Baker, Cole, Cox, Foat, Green, Wall | MODIFY(1) Frech | Frech> XF:apache-printenv-xss(10938) | View |
| 1826 | CVE-2000-0248 | Candidate | The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands. | Modified (20070924) | ACCEPT(3) Baker, Cole, Levy | MODIFY(1) Frech | NOOP(2) Christey, Wall | REJECT(1) Cox | Christey> Typo fix: change "passowrd" to "password" | ADDREF BID:1148 | ADDREF URL:http://www.securityfocus.com/bid/1148 | Christey> ADDREF XF:piranha-default-password | Frech> XF:piranha-default-password | In description, passowrd should be password. | Cox> The "execute arbitrary commands" part is a seperate vulnerability, | already assigned CVE-2000-0322. The package was designed to have no | password on installation, so "backdoor" does not apply. When users | install Piranha they are expected to add a password to the web | administration GUI, it"s a documented part of the procedure. "The web | GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux | Piranha package installs with a default password" is accurate if it | qualifies as an exposure. | Christey> BUGTRAQ:20000425 piranha default password/exploit | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95668829621268&w=2 | | Default accounts/passwords need to be accounted for in CVE, | but the question is what level of abstraction to use - a | separate CVE for each password, or one CVE for all passwords, | or somewhere in the middle? That is the crux of CD:CF-PASS. | View |
| 4814 | CVE-2002-0422 | Candidate | IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header. | Modified (20070919) | ACCEPT(1) Alderson | MODIFY(1) Frech | NOOP(3) Cole, Cox, Foat | REVIEWING(1) Wall | Frech> XF:iis-request-ip-disclosure(8385) | View |
| 1834 | CVE-2000-0256 | Candidate | Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site, aka the "Server-Side Image Map Components" vulnerability. | Modified (20070607) | ACCEPT(4) Baker, Cole, Levy, Wall | MODIFY(1) Frech | NOOP(1) Christey | Frech> XF:frontpage-ext-image-map | Christey> Possibly related to BUGTRAQ:20000418 More vulnerabilities in FP | http://archives.neohapsis.com/archives/bugtraq/2000-04/0116.html | View |
| 1700 | CVE-2000-0122 | Candidate | Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program. | Modified (20070607) | ACCEPT(4) Baker, Cole, LeBlanc, Wall | MODIFY(1) Frech | NOOP(1) Christey | Frech> XF:ms-frontpage-get-htimage | Christey> It appears that this was rediscovered in April 18, 2000: | BUGTRAQ:20000418 More vulnerabilities in FP | URL:http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3D38FCAC0C.869611C0%40hobbiton.org | | This in turn may match BID:1141 | Christey> According to Scott Culp of Microsoft, this was patched in MS:MS00-028. | Christey> BID:1141 ?? | View |
Page 475 of 20943, showing 5 records out of 104715 total, starting on record 2371, ending on 2375
