CVE-1999-0xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
980 records · Page 9 of 10
in.rshd allows users to login with a NULL username and execute commands.
UpdatedWindows NT crashes or locks up when a Samba client executes a "cd .." command on a file share.
UpdatedBuffer overflow in the win-c-sample program (win-c-sample.exe) in the WebSite web server 1.1e allows remote attackers to execute arbitrary code via a long query string.
UpdatedThe uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs.
UpdatedThe Webgais program allows a remote user to execute arbitrary commands.
UpdatedThe convert.bas program in the Novell web server allows a remote attackers to read any file on the system that is internally accessible by the web server.
UpdatedThe view-source CGI program allows remote attackers to read arbitrary files via a .. (dot dot) attack.
UpdatedFormMail CGI program can be used by web servers other than the host server that the program resides on.
UpdatedFormMail CGI program allows remote execution of commands.
Updated- CVE-1999-0171: Denial of service in syslog by sending it a large number of superfluous messages. Unscored
Denial of service in syslog by sending it a large number of superfluous messages.
Updated Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list.
UpdatedNFS allows attackers to read and write any file on the system by specifying a false UID.
UpdatedThe portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, possibly bypassing authentication that would otherwise have taken place. For example, NFS file systems could be mounted through the portmapper despite export restrictions.
UpdatedIn SunOS, NFS file handles could be guessed, giving unauthorized access to the exported file system.
UpdatedNFS allows users to use a "cd .." command to access other directories besides the exported file system.
Updated- CVE-1999-0165: NFS cache poisoning. Unscored
NFS cache poisoning.
Updated A race condition in the Solaris ps command allows an attacker to overwrite critical files.
UpdatedIn older versions of Sendmail, an attacker could use a pipe character to execute root commands.
UpdatedThe "established" keyword in some Cisco IOS software allowed an attacker to bypass filtering.
UpdatedIn Cisco IOS 10.3, with the tacacs-ds or tacacs keyword, an extended IP access control list could bypass filtering.
UpdatedSome classic Cisco IOS devices have a vulnerability in the PPP CHAP authentication to establish unauthorized PPP connections.
UpdatedAttackers can crash a Cisco IOS router or device, provided they can get to an interactive prompt (such as a login). This applies to some IOS 9.x, 10.x, and 11.x releases.
UpdatedCisco PIX firewall manager (PFM) on Windows NT allows attackers to connect to port 8080 on the PFM server and retrieve any file whose name and location is known.
Updated- CVE-1999-0157: Cisco PIX firewall and CBAC IP fragmentation attack results in a denial of service. Unscored
Cisco PIX firewall and CBAC IP fragmentation attack results in a denial of service.
Updated wu-ftpd FTP daemon allows any user and password combination.
UpdatedThe ghostscript command with the -dSAFER option allows remote attackers to execute commands.
UpdatedIIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL.
UpdatedWindows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.
Updated- CVE-1999-0152: The DG/UX finger daemon allows remote command execution through shell metacharacters. Unscored
The DG/UX finger daemon allows remote command execution through shell metacharacters.
Updated The SATAN session key may be disclosed if the user points the web browser to other sites, possibly allowing root access.
Updated- CVE-1999-0150: The Perl fingerd program allows arbitrary command execution from remote users. Unscored
The Perl fingerd program allows arbitrary command execution from remote users.
Updated The wrap CGI program in IRIX allows remote attackers to view arbitrary directory listings via a .. (dot dot) attack.
UpdatedThe handler CGI program in IRIX allows arbitrary command execution.
UpdatedThe aglimpse CGI program of the Glimpse package allows remote execution of arbitrary commands.
UpdatedThe campas CGI program provided with some NCSA web servers allows an attacker to execute arbitrary commands via encoded carriage return characters in the query string, as demonstrated by reading the password file.
UpdatedSendmail WIZ command enabled, allowing root access.
UpdatedDenial of service in Qmail by specifying a large number of recipients with the RCPT command.
UpdatedKerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys.
UpdatedThe Java Applet Security Manager implementation in Netscape Navigator 2.0 and Java Developer's Kit 1.0 allows an applet to connect to arbitrary hosts.
UpdatedJava Bytecode Verifier allows malicious applets to execute arbitrary commands as the user of the applet.
UpdatedDenial of service in RAS/PPTP on NT systems.
Updated- CVE-1999-0139: Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access. Unscored
Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access.
Updated The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.
UpdatedThe dip program on many Linux systems allows local users to gain root access via a buffer overflow.
UpdatedKodak Color Management System (KCMS) on Solaris allows a local user to write to arbitrary files and gain root access.
Updatedadmintool in Solaris allows a local user to write to arbitrary files and gain root access.
Updatedvold in Solaris 2.x allows local users to gain root access.
Updatedfm_fls license server for Adobe Framemaker allows local users to overwrite arbitrary files and gain root access.
UpdatedExpreserve, as used in vi and ex, allows local users to overwrite arbitrary files and gain root access.
UpdatedBuffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users.
UpdatedLocal users can start Sendmail in daemon mode and gain root privileges.
UpdatedSendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.
Updated- CVE-1999-0128: Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death. Unscored
Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.
Updated swinstall and swmodify commands in SD-UX package in HP-UX systems allow local users to create or overwrite arbitrary files to gain root access.
UpdatedSGI IRIX buffer overflow in xterm and Xaw allows root access.
UpdatedBuffer overflow in SGI IRIX mailx program.
UpdatedVulnerabilities in UMN gopher and gopher+ versions 1.12 and 2.0x allow an intruder to read any files that can be accessed by the gopher daemon.
Updated- CVE-1999-0123: Race condition in Linux mailx command allows local users to read user files. Unscored
Race condition in Linux mailx command allows local users to read user files.
Updated Buffer overflow in AIX lchangelv gives root access.
UpdatedBuffer overflow in dtaction command gives root access.
UpdatedSun/Solaris utmp file allows local users to gain root access if it is writable by users other than root.
UpdatedWindows NT 4.0 beta allows users to read and delete shares.
UpdatedAIX infod allows local users to gain root access through an X display.
UpdatedAIX passwd allows local users to gain root access.
UpdatedDenial of service when an attacker sends many SYN packets to create multiple connections without ever sending an ACK to complete the connection, aka SYN flood.
UpdatedAIX bugfiler program allows local users to gain root access.
UpdatedLocal users can execute commands as other users, and read other users' files, through the filter command in the Elm elm-2.4 mail package using a symlink attack.
Updated- CVE-1999-0113: Some implementations of rlogin allow root access if given a -froot parameter. Unscored
Some implementations of rlogin allow root access if given a -froot parameter.
Updated Buffer overflow in AIX dtterm program for the CDE.
UpdatedRIP v1 is susceptible to spoofing.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0315. Reason: This candidate's original description had a typo that delayed it from being detected as a duplicate of CVE-1999-0315. Notes: All CVE users should reference CVE-1999-0315 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Updated · Rejected recordBuffer overflow in ffbconfig in Solaris 2.5.1.
UpdatedThe printers program in IRIX has a buffer overflow that gives root access to local users.
UpdatedBuffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.
UpdatedFinger redirection allows finger bombs.
Updatedfinger allows recursive searches by using a long string of @ symbols.
Updated- CVE-1999-0104: A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2. Unscored
A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2.
Updated Echo and chargen, or other combinations of UDP services, can be used in tandem to flood the server, a.k.a. UDP bomb or UDP packet storm.
UpdatedBuffer overflow in SLmail 3.x allows attackers to execute commands using a large FROM line.
UpdatedBuffer overflow in AIX and Solaris "gethostbyname" library call allows root access through corrupt DNS host names.
UpdatedRemote access in AIX innd 1.5.1, using control messages.
UpdatedBuffer overflow in syslog utility allows local or remote attackers to gain root privileges.
UpdatedBuffer overflow in SMTP HELO command in Sendmail allows a remote attacker to hide activities.
UpdatedThe AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. a pipe character).
UpdatedSendmail decode alias can be used to overwrite sensitive files.
UpdatedThe debug command in Sendmail is enabled, allowing attackers to execute commands as root.
Updated- CVE-1999-0094: AIX piodmgrsu command allows local users to gain additional group privileges. Unscored
AIX piodmgrsu command allows local users to gain additional group privileges.
Updated AIX nslookup command allows local users to obtain root access by not dropping privileges correctly.
UpdatedVarious vulnerabilities in the AIX portmir command allows local users to obtain root access.
Updated- CVE-1999-0091: Buffer overflow in AIX writesrv command allows local users to obtain root access. Unscored
Buffer overflow in AIX writesrv command allows local users to obtain root access.
Updated - CVE-1999-0090: Buffer overflow in AIX rcp command allows local users to obtain root access. Unscored
Buffer overflow in AIX rcp command allows local users to obtain root access.
Updated - CVE-1999-0089: Buffer overflow in AIX libDtSvc library can allow local users to gain root access. Unscored
Buffer overflow in AIX libDtSvc library can allow local users to gain root access.
Updated IRIX and AIX automountd services (autofsd) allow remote users to execute root commands.
UpdatedDenial of service in AIX telnet can freeze a system and prevent users from accessing the server.
UpdatedAIX routed allows remote users to modify sensitive files.
UpdatedBuffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long hostname.
UpdatedCertain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.
Updatedgetcwd() file descriptor leak in FTP.
UpdatedCWD ~root command in ftpd allows root access.
Updatedwu-ftp allows files to be overwritten via the rnfr command.
Updated