CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3779 | CVE-2001-0974 | Candidate | Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. | Modified (20020416-01) | ACCEPT(6) Armstrong, Baker, Cole, Frech, Green, Wall | NOOP(1) Foat | View | |
| 3780 | CVE-2001-0975 | Candidate | Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. | Modified (20020416-01) | ACCEPT(6) Armstrong, Baker, Cole, Frech, Green, Wall | NOOP(1) Foat | View | |
| 2659 | CVE-2000-1092 | Candidate | loadpage.cgi CGI program in EZshopper 3.0 and 2.0 allows remote attackers to list and read files in the EZshopper data directory by inserting a "/" in front of the target filename in the "file" parameter. | Modified (20020327-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Christey, Cole, Magdych, Wall | Christey> This is documented in an NSFOCUS security advisory released | sometime around December 11. Also, it"s BID:2109. | Christey> BUGTRAQ:20001213 NSFOCUS SA2000-09 : AHG EZshopper Loadpage.cgi File List | http://marc.theaimsgroup.com/?l=bugtraq&m=97676270729984&w=2 | XF:ezshopper-cgi-file-disclosure | URL:http://xforce.iss.net/static/5740.php | Frech> XF:ezshopper-cgi-file-disclosure(5740) | Christey> Followup posts indicate that this problem may have been | discovered earlier than 20001213. | View |
| 3776 | CVE-2001-0971 | Candidate | Directory traversal vulnerability in ACI 4d webserver allows remote attackers to read arbitrary files via a .. (dot dot) or drive letter (e.g., C:) in an HTTP request. | Modified (20020313-01) | ACCEPT(1) Green | MODIFY(1) Frech | NOOP(4) Armstrong, Cole, Foat, Wall | REJECT(1) Christey | Christey> According to an email message from the vendor | (bcoveney@4d.com) on March 13, 2002, this problem is only | possible if the server admin has already configured the | server"s web root to be at the top-level folder. This is not | the default. As such, any "directory traversal" attack would | not escape above the folder that has already been specified by | the admin. Since this is a generic misconfiguration problem | for all web servers, and not a default configuration of ACI | 4D, then this candidate should not be included in CVE. | | The quote from the vendor is: "By default the 4D WebServer | doesn"t have this behavior. A property has to be turned on to allow | this (despite our warnings of the consequences). We don"t allow pages | outside of our web folder to be served but if the developer of the | site wishes they can set the webroot folder to be whatever they | want. In the system that "krfinisterre@checkfree.com" evaluated the | developer had chosen to set their root folder to be the root of the | computer system (C:) and therefore all the files on the system were | available. By default we set the root folder at the same level as the | database folder so this doesn"t happen. You cannot look at any files | outside the designated WebFolder root tree." | Frech> XF:4d-webserver-directory-traversal(7010) | View |
| 555 | CVE-1999-0571 | Candidate | A router"s configuration service or management interface (such as a web server or telnet) is configured to allow connections from arbitrary hosts. | Modified (20020312-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(2) Christey, Northcutt | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:ascend-config-kill(889) | XF:cisco-ios-crash(1238) | XF:webramp-remote-access(1670) | XF:ascom-timeplex-debug(1824) | XF:netopia-unpassworded(1850) | XF:cisco-web-crash(1886) | XF:cisco-router-commands(1951) | XF:motorola-cable-default-pass(2002) | XF:default-flowpoint(2091) | XF:netgear-router-idle-dos(4003) | XF:cisco-cbos-telnet(4251) | XF:routermate-snmp-community(4290) | XF:cayman-router-dos(4479) | XF:wavelink-authentication(5185) | XF:ciscosecure-ldap-bypass-authentication(5274) | XF:foundry-firmware-telnet-dos(5514) | XF:netopia-view-system-log(5536) | XF:cisco-webadmin-remote-dos(5595) | XF:cisco-cbos-web-access(5626) | XF:netopia-telnet-dos(6001) | XF:cisco-sn-gain-access(6827) | XF:cayman-dsl-insecure-permissions(6841) | XF:linksys-etherfast-reveal-passwords(6949) | XF:zyxel-router-default-password(6968) | XF:cisco-cbos-web-config(7027) | XF:prestige-wan-bypass-filter(7146) | Christey> I changed the description to make it more explicit that this | candidate is about router configuration, as opposed to | vulnerabilities that accidentally make a configuration | service accessible to anyone. | View |
Page 549 of 20943, showing 5 records out of 104715 total, starting on record 2741, ending on 2745
