CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3741 | CVE-2001-0935 | Candidate | Vulnerability in wu-ftpd 2.6.0, and possibly earlier versions, which is unrelated to the ftpglob bug described in CVE-2001-0550. | Proposed (20020131) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Armstrong, Cole, Foat, Wall | Frech> XF:wuftp-glob-heap-corruption(7611) | View |
| 3568 | CVE-2001-0761 | Candidate | Buffer overflow in HttpSave.dll in Trend Micro InterScan WebManager 1.2 allows remote attackers to execute arbitrary code via a long value to a certain parameter. | Proposed (20011012) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Armstrong, Cole, Foat, Wall | REVIEWING(1) Christey | Christey> CD:SF-LOC may suggest merging with CVE-2001-0678 | Frech> XF:interscan-webmanager-httpsave-bo(6788) | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> There is evidence that this problem was confirmed by Trend, | but there are some inconsistencies. | MISC:http://solutionbank.antivirus.com/solutions/solutionDetail.asp?solutionID=9682 | Note, however, that the date of the patch description at | MISC:http://solutionfile.trendmicro.com/SolutionFile/9682/en/ReadMe-BufferOverflowPatch.txt | is June 19th, but the Bugtraq post was July 2, and the poster | said that a patch had not been available yet. However, the | poster also said that they had notified Trend on June 11. | Add that the Action parameter is the one with the overflow. | | This patch description only identifies HttpSave.dll, not | RegGo.dll (as identified by CVE-2001-0678), but it implies | that multiple DLL"s may have been fixed. Looking at the DLL"s | in the patch, there is RegGo.dll and a number of other DLL"s. | However, this RegGo.dll is different than the one from | the patch for CVE-2001-0678, so maybe they fixed yet another | problem here. | | That problem might be: | BUGTRAQ:20010621 TrendMicro InterScan WebManager Version 1.2 RegGo.dll Buffer Overflow Vulnerability | URL:http://www.securityfocus.com/archive/1/192645 | where the discloser said that the problem was discovered | in June 6 and implied that Trend Micro would fix the problem, | so Trend was notified sometime between June 6 and June 21. | So, the dates might imply that Trend fixed both the | HTTPSave.dll and this variant (if in fact it"s a variant and | not a rediscovery of CVE-2001-0678) in a single patch. | If true, then that would argue that this candidate should be | merged with the RegGo.dll variant reported in the above | Bugtraq reference, along with some of the other DLL"s - just | in case someone rediscovers THOSE, too. | | Other DLL"s in this patch are covered in other posts | in the same time frame by the same person. | HttpSaveCVP.dll and HttpSaveCSP.dll are in: | BUGTRAQ:20010628 [SNS Advisory No.35] TrendMicro InterScan VirusWall 3.51 HttpSaveC*P.dll Buffer Overflow | URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0388.html | smtpscan.dll is described in: | BUGTRAQ:20010628 [SNS Advisory No.34] TrendMicro InterScan VirusWall 3.51 smtpscan.dll Buffer Overflow | URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0387.html | View |
| 989 | CVE-1999-1009 | Candidate | The Disney Go Express Search allows remote attackers to access and modify search information for users by connecting to an HTTP server on the user"s system. | Proposed (19991222) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Balinsky, Cole, Stracener, Wall | Frech> XF:disney-search-info(3955) | Balinsky> The go.express.com web site does not mention the existence of the Express web server mentioned in the advisory. There appears to be no way of verifying this. | View |
| 2659 | CVE-2000-1092 | Candidate | loadpage.cgi CGI program in EZshopper 3.0 and 2.0 allows remote attackers to list and read files in the EZshopper data directory by inserting a "/" in front of the target filename in the "file" parameter. | Modified (20020327-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Christey, Cole, Magdych, Wall | Christey> This is documented in an NSFOCUS security advisory released | sometime around December 11. Also, it"s BID:2109. | Christey> BUGTRAQ:20001213 NSFOCUS SA2000-09 : AHG EZshopper Loadpage.cgi File List | http://marc.theaimsgroup.com/?l=bugtraq&m=97676270729984&w=2 | XF:ezshopper-cgi-file-disclosure | URL:http://xforce.iss.net/static/5740.php | Frech> XF:ezshopper-cgi-file-disclosure(5740) | Christey> Followup posts indicate that this problem may have been | discovered earlier than 20001213. | View |
| 3199 | CVE-2001-0381 | Candidate | The OpenPGP PGP standard allows an attacker to determine the private signature key via a cryptanalytic attack in which the attacker alters the encrypted private key file and captures a single message signed with the signature key. | Modified (20060915) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Christey, Cole, Oliver, Wall | REVIEWING(1) Ziese | Frech> XF:openpgp-private-key-disclosure(6558) | Christey> Consider CALDERA:CSSA-2001-017.0 | URL:http://www.caldera.com/support/security/advisories/CSSA-2001-017.0.txt | Also http://www.redhat.com/support/errata/RHSA-2001-063.html | Add that gnupg before 1.0.5-3 is affected. | TURBO:TLSA2001028 | http://www.turbolinux.com/pipermail/tl-security-announce/2001-June/000439.html | View |
Page 628 of 20943, showing 5 records out of 104715 total, starting on record 3136, ending on 3140
