Browse CVE records published in September 1999, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 715 matching CVEs · Page 8 of 15.
Kabsoftware Lydia utility uses weak encryption to store user passwords in the lydia.ini file, which allows local users to easily decrypt the passwords and gain privileges.
Published Sep 12, 2001 · Updated Aug 1, 2024
Windows Media Player ActiveX object as used in Internet Explorer 5.0 returns a specific error code when a file does not exist, which allows remote malicious web sites to determine the existence of files on the client.
Published Sep 12, 2001 · Updated Aug 1, 2024
tin 1.40 creates the .tin directory with insecure permissions, which allows local users to read passwords from the .inputhistory file.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in chfn command in HP-UX 9.X through 10.20 allows local users to gain privileges via a long command line argument.
Published Sep 12, 2001 · Updated Aug 1, 2024
Microsoft NetMeeting 2.1 allows one client to read the contents of another client's clipboard via a CTRL-C in the chat box when the box is empty.
Published Sep 12, 2001 · Updated Aug 1, 2024
Excite for Web Servers (EWS) 1.1 records the first two characters of a plaintext password in the beginning of the encrypted password, which makes it easier for an attacker to guess passwords via a brute force or dictionary attack.
Published Sep 12, 2001 · Updated Aug 1, 2024
Directory traversal vulnerability in Jana proxy web server 1.40 allows remote attackers to ready arbitrary files via a "......" (modified dot dot) attack.
Published Sep 12, 2001 · Updated Aug 1, 2024
UNIX news readers tin and rtin create the /tmp/.tin_log file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of files writable by the user via a symlink attack.
Published Sep 12, 2001 · Updated Aug 1, 2024
Cisco Resource Manager (CRM) 1.1 and earlier creates certain files with insecure permissions that allow local users to obtain sensitive configuration information including usernames, passwords, and SNMP community strings, from (1) swim_swd.log, (2) swim_debug.log, (3) dbi_debug.log, and (4) temporary files whose names begin with "DPR_".
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in kppp in KDE allows local users to gain root access via a long -c (account_name) command line argument.
Published Sep 12, 2001 · Updated Aug 1, 2024
The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which is automatically executed on a system crash.
Published Sep 12, 2001 · Updated Aug 1, 2024
sort creates temporary files and follows symbolic links, which allows local users to modify arbitrary files that are writable by the user running sort, as observed in updatedb and other programs that use sort.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in Vue 3.0 in HP 9.x allows local users to gain root privileges, as fixed by PHSS_4038, PHSS_4055, and PHSS_4066.
Published Sep 12, 2001 · Updated Aug 1, 2024
Directory traversal vulnerability in Jana proxy web server 1.45 allows remote attackers to ready arbitrary files via a .. (dot dot) attack.
Published Sep 12, 2001 · Updated Aug 1, 2024
Novell 5 and earlier, when running over IPX with a packet signature level less than 3, allows remote attackers to gain administrator privileges by spoofing the MAC address in IPC fragmented packets that make NetWare Core Protocol (NCP) calls.
Published Sep 12, 2001 · Updated Aug 1, 2024
Directory traversal vulnerability in carbo.dll in iCat Carbo Server 3.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the icatcommand parameter.
Published Sep 12, 2001 · Updated Aug 1, 2024
Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an application that attempts to verify that the user wants to log out, which returns the attacker into the locked session.
Published Sep 12, 2001 · Updated Aug 1, 2024
CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in chsh command in HP-UX 9.X through 10.20 allows local users to gain privileges.
Published Sep 12, 2001 · Updated Aug 1, 2024
Excite for Web Servers (EWS) 1.1 installs the Architext.conf authentication file with world-writeable permissions, which allows local users to gain access to Excite accounts by modifying the file.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in ptrace in AIX 4.3 allows local users to gain privileges by attaching to a setgid program.
Published Sep 12, 2001 · Updated Aug 1, 2024
Oracle Webserver 2.1, when serving PL/SQL stored procedures, allows remote attackers to cause a denial of service via a long HTTP GET request.
Published Sep 12, 2001 · Updated Aug 1, 2024
Excite for Web Servers (EWS) 1.1 allows local users to gain privileges by obtaining the encrypted password from the world-readable Architext.conf authentication file and replaying the encrypted password in an HTTP request to AT-generated.cgi or AT-admin.cgi.
Published Sep 12, 2001 · Updated Aug 1, 2024
HP Laserjet printers with JetDirect cards, when configured with TCP/IP, can be configured without a password, which allows remote attackers to connect to the printer and change its IP address or disable logging.
Published Sep 12, 2001 · Updated Aug 1, 2024
The default configuration of FLEXlm license manager 6.0d, and possibly other versions, allows remote attackers to shut down the server via the lmdown command.
Published Sep 12, 2001 · Updated Aug 1, 2024
inetd in AIX 4.1.5 dynamically assigns a port N when starting ttdbserver (ToolTalk server), but also inadvertently listens on port N-1 without passing control to ttdbserver, which allows remote attackers to cause a denial of service via a large number of connections to port N-1, which are not properly closed by inetd.
Published Sep 12, 2001 · Updated Aug 1, 2024
Multiple buffer overflows in WindowMaker 0.52 through 0.60.0 allow attackers to cause a denial of service and possibly execute arbitrary commands by executing WindowMaker with a long program name (argv[0]).
Published Sep 12, 2001 · Updated Aug 1, 2024
HP Laserjet printers with JetDirect cards, when configured with TCP/IP, allow remote attackers to bypass print filters by directly sending PostScript documents to TCP ports 9099 and 9100.
Published Sep 12, 2001 · Updated Aug 1, 2024
Palm Pilot HotSync Manager 3.0.4 in Windows 98 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long string to port 14238 while the manager is in network mode.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in ping CGI program in Xylogics Annex terminal service allows remote attackers to cause a denial of service via a long query parameter.
Published Sep 12, 2001 · Updated Aug 1, 2024
SGI MachineInfo CGI program, installed by default on some web servers, prints potentially sensitive system status information, which could be used by remote attackers for information gathering activities.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in Vermillion FTP Daemon VFTPD 1.23 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via several long CWD commands.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in Tetrix TetriNet daemon 1.13.16 allows remote attackers to cause a denial of service and possibly execute arbitrary commands by connecting to port 31457 from a host with a long DNS hostname.
Published Sep 12, 2001 · Updated Aug 1, 2024
counter.exe 2.70 allows a remote attacker to cause a denial of service (hang) via a long argument.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerabilities in (1) ipxchk and (2) ipxlink in NetWare Client 1.0 on IRIX 6.3 and 6.4 allows local users to gain root access via a modified IFS environmental variable.
Published Sep 12, 2001 · Updated Aug 1, 2024
counter.exe 2.70 allows a remote attacker to cause a denial of service (hang) via an HTTP request that ends in %0A (newline), which causes a malformed entry in the counter log that produces an access violation.
Published Sep 12, 2001 · Updated Aug 1, 2024
Microsoft FrontPage stores form results in a default location in /_private/form_results.txt, which is world-readable and accessible in the document root, which allows remote attackers to read possibly sensitive information submitted by other users.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in Apple AppleShare Mail Server 5.0.3 on MacOS 8.1 and earlier allows a remote attacker to cause a denial of service (crash) via a long HELO command.
Published Sep 12, 2001 · Updated Aug 1, 2024
Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the reply_message_attach attachment parameter, or (2) by specifying the filename as a template.
Published Sep 12, 2001 · Updated Aug 1, 2024
Vulnerability in (1) diskalign and (2) diskperf in IRIX 6.4 patches 2291 and 2848 allow a local user to create root-owned files leading to a root compromise.
Published Sep 12, 2001 · Updated Aug 1, 2024
COPS 1.04 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files in (1) res_diff, (2) ca.src, and (3) mail.chk.
Published Sep 12, 2001 · Updated Aug 1, 2024
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
Published Sep 12, 2001 · Updated Aug 1, 2024
Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote attackers to read arbitrary files via the reply_message_attach attachment parameter.
Published Sep 12, 2001 · Updated Aug 1, 2024
Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote attackers to cause a denial of service (application error).
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in mscreen on SCO OpenServer 5.0 and SCO UNIX 3.2v4 allows a local user to gain root access via (1) a long TERM environmental variable and (2) a long entry in the .mscreenrc file.
Published Sep 12, 2001 · Updated Aug 1, 2024
Tiger 2.2.3 allows local users to overwrite arbitrary files via a symlink attack on various temporary files in Tiger's default working directory, as defined by the WORKDIR variable.
Published Sep 12, 2001 · Updated Aug 1, 2024
ip_print procedure in Tcpdump 3.4a allows remote attackers to cause a denial of service via a packet with a zero length header, which causes an infinite loop and core dump when tcpdump prints the packet.
Published Sep 12, 2001 · Updated Aug 1, 2024
SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs.
Published Sep 12, 2001 · Updated Aug 1, 2024
Buffer overflow in IMonitor in IMail 5.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long string to port 8181.
Published Sep 12, 2001 · Updated Aug 1, 2024
useradd in Solaris 7.0 does not properly interpret certain date formats as specified in the "-e" (expiration date) argument, which could allow users to login after their accounts have expired.
Published Sep 12, 2001 · Updated Aug 1, 2024
