CVE-1999-0xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
980 records · Page 4 of 10
Denial of service in IP protocol logger (ippl) on Red Hat and Debian Linux.
Updated- CVE-1999-0697: SCO Doctor allows local users to gain root privileges through a Tools option. Unscored
SCO Doctor allows local users to gain root privileges through a Tools option.
Updated Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd).
UpdatedThe Sybase PowerDynamo personal web server allows attackers to read arbitrary files through a .. (dot dot) attack.
Updated- CVE-1999-0694: Denial of service in AIX ptrace system call allows local users to crash the system. Unscored
Denial of service in AIX ptrace system call allows local users to crash the system.
Updated Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges.
UpdatedThe default configuration of the Array Services daemon (arrayd) disables authentication, allowing remote users to gain root privileges.
UpdatedBuffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name.
UpdatedHP CDE program includes the current directory in root's PATH variable.
UpdatedThe CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack.
UpdatedBuffer overflows in HP Software Distributor (SD) for HPUX 10.x and 11.x.
UpdatedThe ToolTalk ttsession daemon uses weak RPC authentication, which allows a remote attacker to execute commands.
UpdatedDenial of service in Netscape Enterprise Server (NES) in HP Virtual Vault (VVOS) via a long URL.
Updated- CVE-1999-0685: Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option. Unscored
Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.
Updated Denial of service in Sendmail 8.8.6 in HPUX.
UpdatedDenial of service in Gauntlet Firewall via a malformed ICMP packet.
UpdatedMicrosoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled.
UpdatedBuffer overflow in Microsoft FrontPage Server Extensions (PWS) 3.0.2.926 on Windows 95, and possibly other versions, allows remote attackers to cause a denial of service via a long URL.
UpdatedWindows NT Terminal Server performs extra work when a client opens a new connection but before it is authenticated, allowing for a denial of service.
UpdatedBuffer overflow in hybrid-6 IRC server commonly used on EFnet allows remote attackers to execute commands via m_invite invite option.
UpdatedA default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.
UpdatedThe WebRamp web administration utility has a default password.
Updatedsdtcm_convert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.
UpdatedCheck Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host.
UpdatedThe BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.
UpdatedBuffer overflow in ALMail32 POP3 client via From: or To: headers.
UpdatedBuffer overflow in Fujitsu Chocoa IRC client via IRC channel topics.
UpdatedBuffer overflow in ToxSoft NextFTP client through CWD command.
UpdatedBuffer overflow in the Eyedog ActiveX control allows a remote attacker to execute arbitrary commands.
UpdatedThe Eyedog ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.
UpdatedThe scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.
UpdatedThe ARP protocol allows any host to spoof ARP replies and poison the ARP cache to conduct IP address spoofing or a denial of service.
UpdatedAn application-critical Windows NT registry key has an inappropriate value.
Updated- CVE-1999-0664: An application-critical Windows NT registry key has inappropriate permissions. Unscored
An application-critical Windows NT registry key has inappropriate permissions.
Updated A system-critical program, library, or file has a checksum or other integrity measurement that indicates that it has been modified.
UpdatedA system-critical program or library does not have the appropriate patch, hotfix, or service pack installed, or is outdated or obsolete.
UpdatedA system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive ftpd (wuftpd) 2.2 and 2.1f, (4) IRC client (ircII) ircII 2.2.9, (5) OpenSSH 3.4p1, or (6) Sendmail 8.12.6.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is not about any specific product, protocol, or design, so it is out of scope of CVE. It might be more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A hacker utility, back door, or Trojan Horse is installed on a system, e.g. NetBus, Back Orifice, Rootkit, etc.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A Windows NT Primary Domain Controller (PDC) or Backup Domain Controller (BDC) is present.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "DCOM is running.
Updated · Rejected recordWinGate is being used.
UpdatedThe ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is not about any specific product, protocol, or design, so it is out of scope of CVE. Notes: the former description is: "A service may include useful information in its banner or help function (such as the name and version), making it useful for information gathering activities.
Updated · Rejected recordThe OS/2 or POSIX subsystem in NT is enabled.
UpdatedA component service related to NIS+ is running.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A database service is running, e.g. a SQL server, Oracle, or mySQL.
Updated · Rejected recordThe rsh/rlogin service is running.
UpdatedThe netstat service is running, which provides sensitive information to remote attackers.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The FSP service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The X25 service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The bootparam (bootparamd) service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The LDAP service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The IRC service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The NNTP news service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The IMAP service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A POP service is running.
Updated · Rejected recordThe UUCP service is running.
UpdatedThe Gopher service is running.
UpdatedThe chargen service is running.
UpdatedThe daytime service is running.
UpdatedThe systat service is running.
UpdatedThe discard service is running.
UpdatedThe echo service is running.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The SSH service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The HTTP/WWW service is running.
Updated · Rejected recordThe RPC portmapper service is running.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The NFS service is running.
Updated · Rejected recordThe NT Alerter and Messenger services are running.
UpdatedThe ident/identd service is running.
Updated- CVE-1999-0628: The rwho/rwhod service is running, which exposes machine status and user information. Unscored
The rwho/rwhod service is running, which exposes machine status and user information.
Updated The rexd service is running, which uses weak authentication that can allow an attacker to execute commands.
UpdatedA version of rusers is running that exposes valid user information to any entity on the network.
UpdatedThe rpc.rquotad service is running.
UpdatedThe rstat/rstatd service is running.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The X Windows service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to DNS service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to NETBIOS is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to NIS is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The Telnet service is running.
Updated · Rejected recordThe rexec service is running.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The SMTP service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The TFTP service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The SNMP service is running.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The FTP service is running.
Updated · Rejected recordThe rpc.sprayd service is running.
UpdatedA version of finger is running that exposes valid user information to any entity on the network.
UpdatedA system-critical Windows NT registry key has an inappropriate value.
UpdatedAn incorrect configuration of the Webcart CGI program could disclose private information.
UpdatedAn incorrect configuration of the SoftCart CGI program "SoftCart.exe" could disclose private information.
UpdatedAn incorrect configuration of the PDG Shopping Cart CGI program "shopper.cgi" could disclose private information.
Updatedquikstore.cgi in QuikStore shopping cart stores quikstore.cfg under the web document root with insufficient access control, which allows remote attackers to obtain the cleartext administrator password and gain privileges.
UpdatedAn incorrect configuration of the EZMall 2000 shopping cart CGI program "mall2000.cgi" could disclose private information.
UpdatedAn incorrect configuration of the Order Form 1.0 shopping cart CGI program could disclose private information.
UpdatedAn incorrect configuration of the WebStore 1.0 shopping cart CGI program "web_store.cgi" could disclose private information.
UpdatedIn Windows NT, an inappropriate user is a member of a group, e.g. Administrator, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators, System Operators, etc.
UpdatedA network intrusion detection system (IDS) does not properly reassemble fragmented packets.
UpdatedA network intrusion detection system (IDS) does not properly handle data within TCP handshake packets.
Updated- CVE-1999-0600: A network intrusion detection system (IDS) does not verify the checksum on a packet. Unscored
A network intrusion detection system (IDS) does not verify the checksum on a packet.
Updated A network intrusion detection system (IDS) does not properly handle packets with improper sequence numbers.
UpdatedA network intrusion detection system (IDS) does not properly handle packets that are sent out of order, allowing an attacker to escape detection.
Updated