CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 443 | CVE-1999-0444 | Candidate | Remote attackers can perform a denial of service in Windows machines using malicious ARP packets, forcing a message box display for each packet or filling up log files. | Modified (20000106-01) | ACCEPT(1) Baker | MODIFY(1) Frech | Frech> ADDREF: XF:windows-arp-dos | View |
| 465 | CVE-1999-0467 | Candidate | The Webcom CGI Guestbook programs wguest.exe and rguest.exe allow a remote attacker to read arbitrary files using the "template" parameter. | Modified (20000106-01) | ACCEPT(4) Blake, Frech, Landfield, Ozancin | NOOP(3) Baker, Christey, Northcutt | Christey> CVE-1999-0287 is probably a duplicate of CVE-1999-0467. In | NTBUGTRAQ:19990409 Webcom"s CGI Guestbook for Win32 web servers | Mnemonix says that he had previously reported on a similar | problem. Let"s refer to the NTBugtraq posting as | CVE-1999-0467. We will refer to the "previous report" as | CVE-1999-0287, which can be found at: | http://oliver.efri.hr/~crv/security/bugs/NT/httpd41.html | | 0287 describes an exploit via the "template" hidden variable. | The exploit describes manually editing the HTML form to | change the filename to read from the template variable. | | The exploit as described in 0467 encodes the template variable | directly into the URL. However, hidden variables are also | encoded into the URL, which would have looked the same to | the web server regardless of the exploit. Therefore 0287 | and 0467 are the same. | Christey> | The CD:SF-EXEC content decision also applies here. We have 2 | programs, wguest.exe and rguest.exe, which appear to have the | same problem. CD:SF-EXEC needs to be accepted by the Editorial | Board before this candidate can be converted into a CVE | entry. When finalized, CD:SF-EXEC will decide whether | this candidate should be split or not. | Christey> BID:2024 | View |
| 478 | CVE-1999-0480 | Candidate | Local attackers can conduct a denial of service in Midnight Commander 4.x with a symlink attack. | Modified (20000106-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(1) Christey | Frech> XF:midnight-commander-symlink-dos | Christey> XF:midnight-commander-symlink-dos(3505) | View |
| 484 | CVE-1999-0486 | Candidate | Denial of service in AOL Instant Messenger when a remote attacker sends a malicious hyperlink to the receiving client, potentially causing a system crash. | Modified (20000106-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(1) Christey | Frech> XF:aol-im. | Christey> XF:aol-im appears to be related to the problem discussed in | BUGTRAQ:19980224 AOL Instant Messanger Bug | | This one is related to BUGTRAQ:19990420 AOL Instant Messenger URL Crash | View |
| 241 | CVE-1999-0242 | Candidate | Remote attackers can access mail files via POP3 in some Linux systems that are using shadow passwords. | Modified (20000106-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Christey, Northcutt, Shostack, Wall | REVIEWING(1) Levy | Frech> Ambiguous description: need more detail. Possibly: | XF:linux-pop3d (mktemp() leads to reading e-mail) | Christey> At first glance this might look like CVE-1999-0123 or | CVE-1999-0125, however this particular candidate arises out | of a brief mention of the problem in a larger posting which | discusses CVE-1999-0123 (which may be the same bug as | CVE-1999-0125). See the following phrase in the Bugtraq | post: "one such example of this is in.pop3d" | | However, the original source of this candidate"s description | explicitly mentions shadowed passwords, though it has no | references to help out here. | View |
Page 569 of 20943, showing 5 records out of 104715 total, starting on record 2841, ending on 2845
