CVE-1999-0xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
980 records · Page 3 of 10
Buffer overflow in bootpd 2.4.3 and earlier via a long boot file location.
UpdatedBuffer overflow in bootpd on OpenBSD, FreeBSD, and Linux systems via a malformed header type.
UpdatedNIS finger allows an attacker to conduct a denial of service via a large number of finger requests, resulting in a large number of NIS queries.
Updated- CVE-1999-0796: FreeBSD T/TCP Extensions for Transactions can be subjected to spoofing attacks. Unscored
FreeBSD T/TCP Extensions for Transactions can be subjected to spoofing attacks.
Updated The NIS+ rpc.nisd server allows remote attackers to execute certain RPC calls without authentication to obtain system information, disable logging, or modify caches.
UpdatedMicrosoft Excel does not warn a user when a macro is present in a Symbolic Link (SYLK) format file.
UpdatedInternet Explorer allows remote attackers to read files by redirecting data to a Javascript applet.
UpdatedROUTERmate has a default SNMP community name which allows remote attackers to modify its configuration.
UpdatedHybrid Network cable modems do not include an authentication mechanism for administration, allowing remote attackers to compromise the system through the HSMP protocol.
Updated- CVE-1999-0790: A remote attacker can read information from a Netscape user's cache via JavaScript. Unscored
A remote attacker can read information from a Netscape user's cache via JavaScript.
Updated Buffer overflow in AIX ftpd in the libc library.
UpdatedArkiea nlservd allows remote attackers to conduct a denial of service.
UpdatedThe SSH authentication agent follows symlinks via a UNIX domain socket.
UpdatedThe dynamic linker in Solaris allows a local user to create arbitrary files via the LD_PROFILE environmental variable and a symlink attack.
UpdatedThe INN inndstart program allows local users to gain root privileges via the "pathrun" parameter in the inn.conf file.
UpdatedDenial of service in Oracle TNSLSNR SQL*Net Listener via a malformed string to the listener port, aka NERP.
UpdatedFreeBSD allows local users to conduct a denial of service by creating a hard link from a device special file to a file on an NFS file system.
UpdatedKDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable.
UpdatedKDE allows local users to execute arbitrary commands by setting the KDEDIR environmental variable to modify the search path that KDE uses to locate its executables.
UpdatedKDE klock allows local users to kill arbitrary processes by specifying an arbitrary PID in the .kss.pid file.
UpdatedDenial of service in HP-UX SharedX recserv program.
UpdatedBuffer overflow in Xi Graphics Accelerated-X server allows local users to gain root access via a long display or query parameter.
UpdatedIIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions.
Updated- CVE-1999-0776: Alibaba HTTP server allows remote attackers to read files via a .. (dot dot) attack. Unscored
Alibaba HTTP server allows remote attackers to read files via a .. (dot dot) attack.
Updated Cisco Gigabit Switch routers running IOS allow remote attackers to forward unauthorized packets due to improper handling of the "established" keyword in an access list.
UpdatedBuffer overflows in Mars NetWare Emulation (NWE, mars_nwe) package via long directory names.
Updated- CVE-1999-0773: Buffer overflow in Solaris lpset program allows local users to gain root access. Unscored
Buffer overflow in Solaris lpset program allows local users to gain root access.
Updated Denial of service in Compaq Management Agents and the Compaq Survey Utility via a long string sent to port 2301.
UpdatedThe web components of Compaq Management Agents and the Compaq Survey Utility allow a remote attacker to read arbitrary files via a .. (dot dot) attack.
UpdatedFirewall-1 sets a long timeout for connections that begin with ACK or other packets except SYN, allowing an attacker to conduct a denial of service via a large number of connection attempts to unresponsive systems.
UpdatedVixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable.
UpdatedBuffer overflow in Vixie Cron on Red Hat systems via the MAILTO environmental variable.
UpdatedBuffer overflow in Solaris libc, ufsrestore, and rcp via LC_MESSAGES environmental variable.
UpdatedThe Microsoft Java Virtual Machine allows a malicious Java applet to execute arbitrary commands outside of the sandbox environment.
UpdatedSGI IRIX midikeys program allows local users to modify arbitrary files via a text editor.
UpdatedNetBSD allows ARP packets to overwrite static ARP entries.
UpdatedNetBSD on a multi-homed host allows ARP packets on one network to modify ARP entries on another connected network.
UpdatedWhen Javascript is embedded within the TITLE tag, Netscape Communicator allows a remote attacker to use the "about" protocol to gain access to browser information.
UpdatedBuffer overflow in FreeBSD fts library routines allows local user to modify arbitrary files via the periodic program.
UpdatedUndocumented ColdFusion Markup Language (CFML) tags and functions in the ColdFusion Administrator allow users to gain additional privileges.
UpdatedBuffer overflow in FuseMAIL POP service via long USER and PASS commands.
UpdatedNetscape Enterprise 3.5.1 and FastTrack 3.01 servers allow a remote attacker to view source code to scripts by appending a %20 to the script's URL.
UpdatedThe ColdFusion CFCRYPT program for encrypting CFML templates has weak encryption, allowing attackers to decrypt the templates.
UpdatedColdFusion Administrator with Advanced Security enabled allows remote users to stop the ColdFusion server via the Start/Stop utility.
UpdatedWindows NT RRAS and RAS clients cache a user's password even if the user has not selected the "Save password" option.
UpdatedThe INN inndstart program allows local users to gain privileges by specifying an alternate configuration file using the INNCONF environmental variable.
UpdatedThe w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories.
UpdatedDenial of service in Netscape Enterprise Server via a buffer overflow in the SSL handshake.
UpdatedBuffer overflow in Accept command in Netscape Enterprise Server 3.6 with the SSL Handshake Patch.
UpdatedHotmail allows Javascript to be executed via the HTML STYLE tag, allowing remote attackers to execute commands on the user's Hotmail account.
UpdatedBuffer overflow in Microsoft Telnet client in Windows 95 and Windows 98 via a malformed Telnet argument.
UpdatedBuffer overflows in Red Hat net-tools package.
UpdatedDenial of service in BSDi Symmetric Multiprocessing (SMP) when an fstat call is made when the system has a high CPU load.
UpdatedA default configuration of in.identd in SuSE Linux waits 120 seconds between requests, allowing a remote attacker to conduct a denial of service.
UpdatedBuffer overflow in Source Code Browser Program Database Name Server Daemon (pdnsd) for the IBM AIX C Set ++ compiler.
UpdatedBuffer overflow in Netscape Enterprise Server and FastTrask Server allows remote attackers to gain privileges via a long HTTP GET request.
UpdatedTrn allows local users to overwrite other users' files via symlinks.
UpdatedThe Debian mailman package uses weak authentication, which allows attackers to gain privileges.
Updated- CVE-1999-0741: QMS CrownNet Unix Utilities for 2060 allows root to log on without a password. Unscored
QMS CrownNet Unix Utilities for 2060 allows root to log on without a password.
Updated Remote attackers can cause a denial of service on Linux in.telnetd telnet daemon through a malformed TERM environmental variable.
UpdatedThe codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.
UpdatedThe code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.
UpdatedThe viewcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.
UpdatedThe showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.
UpdatedKDE K-Mail allows local users to gain privileges via a symlink attack in temporary user directories.
UpdatedA default configuration of CiscoSecure Access Control Server (ACS) allows remote users to modify the server database without authentication.
Updated- CVE-1999-0733: Buffer overflow in VMWare 1.0.1 for Linux via a long HOME environmental variable. Unscored
Buffer overflow in VMWare 1.0.1 for Linux via a long HOME environmental variable.
Updated The logging facility of the Debian smtp-refuser package allows local users to delete arbitrary files using symbolic links.
Updated- CVE-1999-0731: The KDE klock program allows local users to unlock a session using malformed input. Unscored
The KDE klock program allows local users to unlock a session using malformed input.
Updated The zsoelim program in the Debian man-db package allows local users to overwrite files via a symlink attack.
UpdatedBuffer overflow in Lotus Notes LDAP (NLDAP) allows an attacker to conduct a denial of service through the ldap_search request.
UpdatedA Windows NT user can disable the keyboard or mouse by directly calling the IOCTLs which control them.
Updated- CVE-1999-0727: A kernel leak in the OpenBSD kernel allows IPsec packets to be sent unencrypted. Unscored
A kernel leak in the OpenBSD kernel allows IPsec packets to be sent unencrypted.
Updated An attacker can conduct a denial of service in Windows NT by executing a program with a malformed file image header.
UpdatedWhen IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a. "Double Byte Code Page".
UpdatedBuffer overflow in OpenBSD procfs and fdescfs file systems via uio_offset in the readdir() function.
UpdatedThe Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input.
UpdatedThe default configuration of Cobalt RaQ2 servers allows remote users to install arbitrary software packages.
UpdatedDenial of service in Windows NT Local Security Authority (LSA) through a malformed LSA request.
UpdatedThe pt_chown command in Linux allows local users to modify TTY terminal devices that belong to other users.
UpdatedThe Guile plugin for the Gnumeric spreadsheet package allows attackers to execute arbitrary code.
UpdatedIBM GINA, when used for OS/2 domain authentication of Windows NT users, allows local users to gain administrator privileges by changing the GroupMapping registry key.
Updated- CVE-1999-0717: A remote attacker can disable the virus warning mechanism in Microsoft Excel 97. Unscored
A remote attacker can disable the virus warning mechanism in Microsoft Excel 97.
Updated - CVE-1999-0716: Buffer overflow in Windows NT 4.0 help file utility via a malformed help file. Unscored
Buffer overflow in Windows NT 4.0 help file utility via a malformed help file.
Updated Buffer overflow in Remote Access Service (RAS) client allows an attacker to execute commands or cause a denial of service via a malformed phonebook entry.
UpdatedVulnerability in Compaq Tru64 UNIX edauth command.
Updated- CVE-1999-0713: The dtlogin program in Compaq Tru64 UNIX allows local users to gain root privileges. Unscored
The dtlogin program in Compaq Tru64 UNIX allows local users to gain root privileges.
Updated A vulnerability in Caldera Open Administration System (COAS) allows the /etc/shadow password file to be made world-readable.
UpdatedThe oratclsh interpreter in Oracle 8.x Intelligent Agent for Unix allows local users to execute Tcl commands as root.
UpdatedThe Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems.
UpdatedBuffer overflow in cfingerd allows local users to gain root privileges via a long GECOS field.
UpdatedThe default FTP configuration in HP Visualize Conference allows conference users to send a file to other participants without authorization.
UpdatedLinux xmonisdn package allows local users to gain root privileges by modifying the IFS or PATH environmental variables.
UpdatedBuffer overflow in INN inews program.
UpdatedBuffer overflow in Berkeley automounter daemon (amd) logging facility provided in the Linux am-utils package and others.
UpdatedOpenBSD, BSDI, and other Unix operating systems allow users to set chflags and fchflags on character and block devices.
UpdatedInternet Explorer 5.0 and 5.01 allows remote attackers to modify or execute files via the Import/Export Favorites feature, aka the "ImportExportFavorites" vulnerability.
UpdatedAfter an unattended installation of Windows NT 4.0, an installation file could include sensitive information such as the local Administrator password.
UpdatedBuffer overflow in Microsoft Phone Dialer (dialer.exe), via a malformed dialer entry in the dialer.ini file.
UpdatedThe Bluestone Sapphire web server allows session hijacking via easily guessable session IDs.
Updated