Browse CVE records published in September 1999, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 715 matching CVEs · Page 3 of 15.
nsd in IRIX 6.5 through 6.5.2 exports a virtual filesystem on a UDP port, which allows remote attackers to view files and cause a possible denial of service by mounting the nsd virtual file system.
Published Sep 12, 2001 · Updated Aug 1, 2024
Windows NT 4.0 before SP3 allows remote attackers to bypass firewall restrictions or cause a denial of service (crash) by sending improperly fragmented IP packets without the first fragment, which the TCP/IP stack incorrectly reassembles into a valid session.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in (1) diskperf and (2) diskalign in IRIX 6.4 allows local attacker to create arbitrary root owned files, leading to root privileges.
Published Sep 12, 2001 · Updated Aug 1, 2024
named in ISC BIND 4.9 and 8.1 allows local users to destroy files via a symlink attack on (1) named_dump.db when root kills the process with a SIGINT, or (2) named.stats when SIGIOT is used.
Published Sep 12, 2001 · Updated Aug 1, 2024
MacOS uses weak encryption for passwords that are stored in the Users & Groups Data File.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in GNOME libraries 1.0.8 allows local user to gain root access via a long --espeaker argument in programs such as nethack.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in TestChip function in XFree86 SuperProbe in Slackware Linux 3.1 allows local users to gain root privileges via a long -nopr argument.
Published Sep 12, 2001 · Updated Aug 1, 2024
The textcounter.pl by Matt Wright allows remote attackers to execute arbitrary commands via shell metacharacters.
Published Sep 12, 2001 · Updated Aug 1, 2024
SVGAlib zgv 3.0-7 and earlier allows local users to gain root access via a privilege leak of the iopl(3) privileges to child processes.
Published Sep 12, 2001 · Updated Aug 1, 2024
BMC PATROL SNMP Agent before 3.2.07 allows local users to create arbitrary world-writeable files as root by specifying the target file as the second argument to the snmpmagt program.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in Cisco routers versions 8.2 through 9.1 allows remote attackers to bypass access control lists when extended IP access lists are used on certain interfaces, the IP route cache is enabled, and the access list uses the "established" keyword.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in w3-auth CGI program in miniSQL package allows remote attackers to execute arbitrary commands via an HTTP request with (1) a long URL, or (2) a long User-Agent MIME header.
Published Sep 12, 2001 · Updated Aug 1, 2024
BMC PATROL Agent before 3.2.07 allows local users to gain root privileges via a symlink attack on a temporary file.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in at program in Digital UNIX 4.0 allows local users to gain root privileges via a long command line argument.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in thttpd HTTP server before 2.04-31 allows remote attackers to execute arbitrary commands via a long date string, which is not properly handled by the tdate_parse function.
Published Sep 12, 2001 · Updated Aug 1, 2024
(1) acledit and (2) aclput in AIX 4.3 allow local users to create or modify files via a symlink attack.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in Cisco IOS 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical subinterface, as described by Cisco bug CSCdk43862.
Published Sep 12, 2001 · Updated Aug 1, 2024
inpview in InPerson on IRIX 5.3 through IRIX 6.5.10 trusts the PATH environmental variable to find and execute the ttsession program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse ttsession program.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in zgv in svgalib 1.2.10 and earlier allows local users to execute arbitrary code via a long HOME environment variable.
Published Sep 12, 2001 · Updated Aug 1, 2024
Auto_FTP.pl script in Auto_FTP 0.2 stores usernames and passwords in plaintext in the auto_ftp.conf configuration file.
Published Sep 12, 2001 · Updated Aug 1, 2024
Solaris Solstice AdminSuite (AdminSuite) 2.1 uses unsafe permissions when adding new users to the NIS+ password table, which allows local users to gain root access by modifying their password table entries.
Published Sep 12, 2001 · Updated Aug 1, 2024
Solaris Solstice AdminSuite (AdminSuite) 2.1 follows symbolic links when updating an NIS database, which allows local users to overwrite arbitrary files.
Published Sep 12, 2001 · Updated Aug 1, 2024
The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in (1) rlogin daemon rshd and (2) scheme on SCO UNIX OpenServer 5.0.5 and earlier, and SCO UnixWare 7.0.1 and earlier, allows remote attackers to gain privileges.
Published Sep 12, 2001 · Updated Aug 1, 2024
FORE PowerHub before 5.0.1 allows remote attackers to cause a denial of service (hang) via a TCP SYN scan with TCP/IP OS fingerprinting, e.g. via nmap.
Published Sep 12, 2001 · Updated Aug 1, 2024
Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass the password prompt by pressing the ESC (Escape) key.
Published Sep 12, 2001 · Updated Aug 1, 2024
dumpreg in Red Hat Linux 5.1 opens /dev/mem with O_RDWR access, which allows local users to cause a denial of service (crash) by redirecting fd 1 (stdout) to the kernel.
Published Sep 12, 2001 · Updated Aug 1, 2024
suidexec in suidmanager 0.18 on Debian 2.0 allows local users to gain root privileges by specifying a malicious program on the command line.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in Desktop searchbook program in IRIX 5.0.x through 6.2 sets insecure permissions for certain user files (iconbook and searchbook).
Published Sep 12, 2001 · Updated Aug 1, 2024
NBase switches NH208 and NH215 run a TFTP server which allows remote attackers to send software updates to modify the switch or cause a denial of service (crash) by guessing the target filenames, which have default names.
Published Sep 12, 2001 · Updated Aug 1, 2024
Linux 2.0.34 does not properly prevent users from sending SIGIO signals to arbitrary processes, which allows local users to cause a denial of service by sending SIGIO to processes that do not catch it.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords.
Published Sep 12, 2001 · Updated Aug 1, 2024
Ray Chan WWW Authorization Gateway 0.1 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "user" parameter.
Published Sep 12, 2001 · Updated Aug 1, 2024
Eudora and Eudora Light before 3.05 allows remote attackers to cause a crash and corrupt the user's mailbox via an e-mail message with certain dates, such as (1) dates before 1970, which cause a Divide By Zero error, or (2) dates that are 100 years after the current date, which causes a segmentation fault.
Published Sep 12, 2001 · Updated Aug 1, 2024
IBM/Tivoli OPC Tracker Agent version 2 release 1 allows remote attackers to cause a denial of service (resource exhaustion) via malformed data to the localtracker client port (5011), which prevents the connection from being closed properly.
Published Sep 12, 2001 · Updated Aug 1, 2024
ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing software into the TEMP directory, and changing the name to that for an allowed application, such as Winword.exe.
Published Sep 12, 2001 · Updated Aug 1, 2024
Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users.
Published Sep 12, 2001 · Updated Aug 1, 2024
snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directory when snap -a is executed, which could allow local users to access the shadowed password file by creating /tmp/ibmsupt/general/passwd before root runs snap -a.
Published Sep 12, 2001 · Updated Aug 1, 2024
addnetpr in IRIX 5.3 and 6.2 allows local users to overwrite arbitrary files and possibly gain root privileges via a symlink attack on the printers temporary file.
Published Sep 12, 2001 · Updated Aug 1, 2024
The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users.
Published Sep 12, 2001 · Updated Aug 1, 2024
SunOS 4.1.4 on a Sparc 20 machine allows local users to cause a denial of service (kernel panic) by reading from the /dev/tcx0 TCX device.
Published Sep 12, 2001 · Updated Aug 1, 2024
The setup wizard (ie5setup.exe) for Internet Explorer 5.0 disables (1) the screen saver, which could leave the system open to users with physical access if a failure occurs during an unattended installation, and (2) the Task Scheduler Service, which might prevent the scheduled execution of security-critical programs.
Published Sep 12, 2001 · Updated Aug 1, 2024
dbmlparser.exe CGI guestbook program does not perform a chroot operation properly, which allows remote attackers to read arbitrary files.
Published Sep 12, 2001 · Updated Aug 1, 2024
DIT TransferPro installs devices with world-readable and world-writable permissions, which could allow local users to damage disks through the ff device driver.
Published Sep 12, 2001 · Updated Aug 1, 2024
(1) bash before 1.14.7, and (2) tcsh 6.05 allow local users to gain privileges via directory names that contain shell metacharacters (` back-tick), which can cause the commands enclosed in the directory name to be executed when the shell expands filenames using the \w option in the PS1 variable.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in xfsdump in SGI IRIX may allow local users to obtain root privileges via the bck.log log file, possibly via a symlink attack.
Published Sep 12, 2001 · Updated Aug 1, 2024
login in Slackware Linux 3.2 through 3.5 does not properly check for an error when the /etc/group file is missing, which prevents it from dropping privileges, causing it to assign root privileges to any local user who logs on to the server.
Published Sep 12, 2001 · Updated Aug 1, 2024
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
Published Sep 1, 2004 · Updated Aug 1, 2024
Vulnerability in /bin/mail in SunOS 4.1.1 and earlier allows local users to gain root privileges via certain command line arguments.
Published Sep 12, 2001 · Updated Aug 1, 2024
Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send an executable file with a long name that contains so many spaces that the .exe extension is not displayed, which could make the user believe that the file is safe to open from the client.
Published Sep 12, 2001 · Updated Aug 1, 2024
