CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 4693 | CVE-2002-0301 | Candidate | Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters. | Proposed (20020502) | ACCEPT(1) Cole | MODIFY(1) Frech | NOOP(4) Christey, Cox, Foat, Wall | Christey> XF:nfuse-user-information-disclosure(8257) | URL:http://www.iss.net/security_center/static/8257.php | Frech> XF:nfuse-user-information-disclosure(8257) | View |
| 4696 | CVE-2002-0304 | Candidate | Lil HTTP Server 2.1 allows remote attackers to read password-protected files via a /./ in the HTTP request. | Modified (20050705) | ACCEPT(1) Cole | MODIFY(1) Frech | NOOP(4) Christey, Cox, Foat, Wall | Christey> VULNWATCH:20020222 [VulnWatch] SecurityOffice Security Advisories: Essentia and LilHTTP web servers | URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0051.html | XF:lilhttp-protected-file-access(8247) | URL:http://www.iss.net/security_center/static/8247.php | BID:4153 | URL:http://www.securityfocus.com/bid/4153 | Frech> XF:lilhttp-protected-file-access(8247) | View |
| 4969 | CVE-2002-0578 | Candidate | Buffer overflow in 4D WebServer 6.7.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP request with Basic Authentication containing a long (1) user name or (2) password. | Proposed (20020611) | ACCEPT(1) Cole | MODIFY(1) Frech | NOOP(5) Armstrong, Christey, Cox, Foat, Wall | Frech> XF:4d-webserver-authentication-bo(8996) | Christey> A very similar issue was reported in the same version: | BUGTRAQ:20020618 4D 6.7 DOS and Buffer Overflow Vulnerability | URL:http://online.securityfocus.com/archive/1/277481 | | That issue is being given a separate CAN, but it may in fact | be a "dupe" of this issue, or at least it may need to be | merged per CD:SF-LOC. | View |
| 2695 | CVE-2000-1128 | Candidate | The default configuration of McAfee VirusScan 4.5 does not quote the ImagePath variable, which improperly sets the search path and allows local users to place a Trojan horse "common.exe" program in the C:Program Files directory. | Proposed (20001219) | ACCEPT(1) Cole | MODIFY(1) Frech | REVIEWING(1) Wall | Frech> XF:nai-virusscan-unquoted-imagepath(5484) | View |
| 3239 | CVE-2001-0421 | Candidate | FTP server in Solaris 8 and earlier allows local and remote attackers to cause a core dump in the root directory, possibly with world-readable permissions, by providing a valid username with an invalid password followed by a CWD ~ command, which could release sensitive information such as shadowed passwords, or fill the disk partition. | Proposed (20010524) | ACCEPT(1) Cole | MODIFY(2) Dik, Frech | NOOP(1) Wall | REVIEWING(2) Williams, Ziese | Frech> XF:solaris-ftp-shadow-recovery(6422) | Dik> sun bug ids: 4436988 | | The "world-readable" core dump problem does not exist in | Solaris 8 and other Solaris releases which have been patched | to include the "coreadm" command and possibly earlier (many release | have been patched to avoid core dumps in more situations and | always make them mode 0600) | | Solaris 8 was the first release to contain coreadm initially | (backported and include in 2.6 & 7) | Solaris 7 was the first release to make core dumps mode 0600. | (fix backported to 2.6 and earlier) | View |
Page 654 of 20943, showing 5 records out of 104715 total, starting on record 3266, ending on 3270
