CVE Feed

HP-UX aserver program allows local users to gain privileges via a symlink attack.

wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.

The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users.

IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.

The RPC portmapper service is running.

A system is operating in "promiscuous" mode which allows it to perform packet sniffing.

IIS has the #exec function enabled for Server Side Include (SSI) files.

rpc.admind in Solaris is not running in a secure mode.

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A POP service is running.

Denial of service in telnet from the Windows NT Resource Kit, by opening then immediately closing a connection.

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is not about any specific product, protocol, or design, so it is out of scope of CVE. Notes: the former description is: "A service may include useful information in its banner or help function (such as the name and version), making it useful for information gathering activities.

Windows NT FTP server (WFTP) with the guest account enabled without a password allows an attacker to log into the FTP server using any username and password.

An attacker can force a printer to print arbitrary documents (e.g. if the printer doesn't require a password) or to become disabled.

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to NIS is running.

A network intrusion detection system (IDS) does not properly handle packets with improper sequence numbers.

A router's configuration service or management interface (such as a web server or telnet) is configured to allow connections from arbitrary hosts.

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The IRC service is running.

The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.

A system-critical Windows NT registry key has an inappropriate value.

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to DNS service is running.

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0032. Reason: This candidate is a duplicate of CVE-1999-0032. Notes: All CVE users should reference CVE-1999-0032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0315. Reason: This candidate's original description had a typo that delayed it from being detected as a duplicate of CVE-1999-0315. Notes: All CVE users should reference CVE-1999-0315 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0022. Reason: This candidate is a duplicate of CVE-1999-0022. Notes: All CVE users should reference CVE-1999-0022 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

finger 0@host on some systems may print information on some user accounts.

finger .@host on some systems may print information on some user accounts.

Attackers can do a denial of service of IRC by crashing the server.

Some filters or firewalls allow fragmented SYN packets with IP reserved bits in violation of their implemented policy.

Linux cfingerd could be exploited to gain root access.

Buffer overflow in ircd allows arbitrary command execution.

MetaInfo MetaWeb web server allows users to upload, execute, and read scripts.

The Java Web Server would allow remote users to obtain the source code for CGI programs.

Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data.

DataLynx suGuard trusts the PATH environment variable to execute the ps command, allowing local users to execute commands as root.

In some instances of SSH 1.2.27 and 2.0.11 on Linux systems, SSH will allow users with expired accounts to login.

The demo version of the Quakenbush NT Password Appraiser sends passwords across the network in plaintext.

A service or application has a backdoor password that was placed there by the developer.

An attacker can identify a CISCO device by sending a SYN packet to port 1999, which is for the Cisco Discovery Protocol (CDP).

A remote attacker can sometimes identify the operating system of a host based on how it reacts to some IP or ICMP packets, using a tool such as nmap or queso.

Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter.

Anonymous FTP is enabled.

An unrestricted remote trust relationship for Unix systems has been set up, e.g. by using a + sign in /etc/hosts.equiv.

A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers.

The permissions for system-critical data in an anonymous FTP account are inappropriate. For example, the root directory is writeable by world, a real password file is obtainable, or executable commands such as "ls" can be overwritten.

A router or firewall forwards external packets that claim to come from inside the network that the router/firewall is in front of.

A router or firewall forwards packets that claim to come from IANA reserved or private addresses, e.g. 10.x.x.x, 127.x.x.x, 217.x.x.x, etc.

ICMP echo (ping) is allowed from arbitrary hosts.

A trust relationship exists between two Unix hosts.

A Unix account with a name other than "root" has UID 0, i.e. root privileges.

Two or more Unix accounts have the same UID.

A system-critical Unix file or directory has inappropriate permissions.