(提案)集群misc - 2002 - 39的候选人

我提出集群misc - 2002 a,供编辑部评论和投票。名称:Misc - 2002 a描述:Misc罐从2002年6月到2002年8月尺寸:39通过修改这封邮件你可能投票的候选人投票,将它寄回给我,或通过使用CVE投票网站。中列出的候选人优先秩序。优先级1和优先级2的候选人都应对不同层次的供应商确认,所以他们应该易于检查和可以信任的,是真实的问题。总结的选票使用(“严重程度”的按升序)- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -接受——选民接受候选人提出的等待——选民对候选人没有意见修改选民想要改变一些小细节(例如参考/描述)审查-选民正在审查/研究候选人,或需要更多的信息,重塑候选人必须大幅修改,如分割或合并拒绝候选人不是“漏洞”,或重复等。1)请写你的投票在直线上,从“投票:”开始。如果你想添加评论或细节,在投票后将它们添加到线:线。2)如果你看到任何失踪的引用,请提及他们,使他们可以包括在内。在映射引用帮助极大。3)请注意,“修改”被视为一个“接受”当计算选票。所以如果你没有足够的信息对候选人但你不想等待,使用一个回顾。 ********** NOTE ********** NOTE ********** NOTE ********** NOTE ********** Please keep in mind that your vote and comments will be recorded and publicly viewable in the mailing list archives or in other formats. ====================================================== Candidate: CAN-2002-1410 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1410最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020727简单的留言板漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0356.html参考:报价:5341参考:网址:http://www.securityfocus.com/bid/5341参考:XF: easy-guestbook-gain-access(9697)参考:网址:http://www.iss.net/security_center/static/9697.php简单的留言板CGI程序不管理员进行身份验证,它允许远程攻击者(1)通过直接访问管理员删除条目。cgi或(2)重新配置通过直接访问config.cgi留言板。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1410 3供应商确认:内容决定:SF-LOC, SF-EXEC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1411网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1411最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020622 dpg允许任何文件被覆盖参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-06/0265.html参考:报价:5081参考:网址:http://www.securityfocus.com/bid/5081参考:XF: dpgs-dotdot-directory-traversal(9414)参考:网址:http://www.iss.net/security_center/static/9414.php目录遍历漏洞更新。在杜马dpg相册系统(dpg) 0.99.4允许远程攻击者读取任意文件通过. .(点点)序列id参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1411 3供应商确认:没有不支持投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1415网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1415最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020820咨询:DoS WebEasyMail +更多的可能吗?参考网址:http://online.securityfocus.com/archive/1/288222参考:报价:5518参考:网址:http://www.securityfocus.com/bid/5518参考:XF: webeasymail-smtp-service-dos(9924)参考:网址:http://www.iss.net/security_center/static/9924.php格式字符串漏洞在SMTP服务WebEasyMail 3.4.2.2早些时候,允许远程攻击者可能导致拒绝服务(崩溃)和执行任意代码通过在SMTP请求格式字符串。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1415 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1416网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1416最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020820咨询:DoS WebEasyMail +更多的可能吗?参考网址:http://online.securityfocus.com/archive/1/288222参考:XF: webeasymail-pop3-bruteforce(9925)参考:网址:http://www.iss.net/security_center/static/9925.php参考:报价:5519参考:网址:http://www.securityfocus.com/bid/5519的POP3服务WebEasyMail 3.4.2.2早些时候,为有效和无效的用户名生成不同的错误消息身份验证期间,这使得它更容易为远程攻击者进行强力攻击。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1416 3供应商确认:内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1421网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1421最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020818 FUDforum文件访问和SQL注入参考:网址:http://online.securityfocus.com/archive/1/288042参考:VULNWATCH: 20020818 FUDforum文件访问和SQL注入参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html参考:报价:5500参考:网址:http://www.securityfocus.com/bid/5500参考:XF: fudforum-sql-injection(9912)参考:网址:http://www.iss.net/security_center/static/9912.phpSQL注入漏洞在FUDforum 2.2.0允许远程攻击者通过(1)报告执行未经授权的数据库操作。(2)selmsg php。php和(3)showposts.php。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1421 3供应商确认:未知discloser-claimed内容决定:SF-LOC, SF-EXEC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1422网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1422最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020818 FUDforum文件访问和SQL注入参考:网址:http://online.securityfocus.com/archive/1/288042参考:VULNWATCH: 20020818 FUDforum文件访问和SQL注入参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html参考:XF: fudforum-admnbrowse-modify-files(9901)参考:网址:http://www.iss.net/security_center/static/9901.php参考:报价:5502参考:网址:http://www.securityfocus.com/bid/5502admbrowse。php在FUDforum 2.2.0通过url编码允许远程攻击者创建或删除文件路径名的坏蛋和dest参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1422 3供应商确认:未知discloser-claimed内容决定:SF-EXEC SF-LOC抽象:虽然tmp_view。php和admbrowse。php的问题似乎是相同类型的(文件检索通过/绝对路径名),admbrowse。php问题- URL编码,另一个方面表明,问题可能会略有不同。因此CD: SF-EXEC表明创建单独的候选人。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1423网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1423最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020818 FUDforum文件访问和SQL注入参考:网址:http://online.securityfocus.com/archive/1/288042参考:VULNWATCH: 20020818 FUDforum文件访问和SQL注入参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html参考:XF: fudforum-tmpview-download-files(9896)参考:网址:http://www.iss.net/security_center/static/9896.php参考:报价:5501参考:网址:http://www.securityfocus.com/bid/5501tmp_view。php在FUDforum 2.2.0允许远程攻击者读取任意文件通过文件的绝对路径名参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1423 3供应商确认:未知discloser-claimed内容决定:SF-EXEC SF-LOC抽象:虽然tmp_view。php和admbrowse。php的问题似乎是相同类型的(文件检索通过/绝对路径名),admbrowse。php问题- URL编码,另一个方面表明,问题可能会略有不同。因此CD: SF-EXEC表明创建单独的候选人。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1426网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1426最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 0815 Phenoelit咨询20020727 + + / +惠普ProCurve参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0338.html参考:MISC:http://www.phenoelit.de/stuff/HP_ProCurve.txt参考:报价:5336参考:网址:http://www.securityfocus.com/bid/5336参考:XF: hp-procurve-snmp-write-dos(9708)参考:网址:http://www.iss.net/security_center/static/9708.php惠普ProCurve开关4000 C.07.23允许远程攻击者造成拒绝服务(崩溃)通过SNMP写请求包含85个字符,可能引发缓冲区溢出。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1426 3供应商确认:未知discloser-claimed投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1427网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1427最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020727容易主页创造者脆弱性参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0350.html参考:报价:5340参考:网址:http://www.securityfocus.com/bid/5340参考:XF: easy-homepage-gain-access(9696)参考:网址:http://www.iss.net/security_center/static/9696.php在编辑的print_html_to_file函数。cgi方便主页创造者1.0不检查用户凭证,它允许远程攻击者修改其他用户的主页。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1427 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1428网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1428最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020728 php dotProject旁通认证参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0366.html参考:报价:5347参考:网址:http://www.securityfocus.com/bid/5347参考:XF: dotproject-admin-access(9720)参考:网址:http://www.iss.net/security_center/static/9720.php索引。php在dotProject 0.2.1.5允许远程攻击者绕过身份验证通过cookie或URL user_cookie参数设置为1。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1428 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1429网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1429最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020729 endity.com参考代码注入漏洞:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0389.html参考:MISC:http://endity.com/board/index.php?act=ST&f=3&t=68&s=363128162825b2d7fcf60c9cd2a292fe参考:XF: shoutbox-site-html-injection(9739)参考:网址:http://www.iss.net/security_center/static/9739.php参考:报价:5354参考:网址:http://www.securityfocus.com/bid/5354跨站点脚本漏洞在董事会。php endity.com的在线留言板允许远程攻击者通过网站在线留言板注入任意的HTML页面参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1429 3供应商确认:未知的模糊的承认:一篇用户委员会8月9日,2002年,“新下载更安全,因为它包含了安全补丁,“但它并没有说是否补丁Bugtraq邮报与否有关。一看的源代码。php确实表明变量被引用,但它是不清楚这个变化。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1431网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1431最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020609 IP报告-贝尔金电缆/ DSL路由器的问题参考:网址:http://online.securityfocus.com/archive/1/276256参考:报价:4982参考:网址:http://www.securityfocus.com/bid/4982参考:XF: belkin-incorrect-ip(9324)参考:网址:http://www.iss.net/security_center/static/9324.phpBelkin F5D5230-4并电缆/ DSL网关路由器1.20.000修改内部的源IP地址数据包的路由器的外部接口转发请求时内部主机内部web服务器,它允许远程攻击者隐藏的主机被用于访问web服务器。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1431 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1432网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1432最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:CF参考:BUGTRAQ: 20020807 MidiCart购物车软件数据库漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0074.html参考:报价:5438参考:网址:http://www.securityfocus.com/bid/5438参考:XF: shopping-cart-database-access(9816)参考:网址:http://www.iss.net/security_center/static/9816.phpMidiCart存储MidiCart。mdb数据库文件在Web文档根目录下,它允许远程攻击者窃取敏感信息通过直接请求数据库。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1432 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1433网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1433最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020819 Kerio邮件服务器多个安全漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0183.html参考:XF: kerio-mailserver-syn-dos(9904)参考:网址:http://www.iss.net/security_center/static/9904.php参考:报价:5505参考:网址:http://www.securityfocus.com/bid/5505Kerio服务器5.0允许远程攻击者造成拒绝服务(挂)通过SYN包支持的网络服务。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1433 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1434网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1434最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020819 Kerio邮件服务器多个安全漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0183.html参考:报价:5507参考:网址:http://www.securityfocus.com/bid/5507参考:XF: kerio-webserver-webmail-xss(9905)参考:网址:http://www.iss.net/security_center/static/9905.php多个跨站点脚本(XSS)漏洞Kerio Web邮件模块的服务器5.0允许远程攻击者执行HTML脚本,其他用户通过特定的url。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1434 3供应商确认:内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1440网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1440最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020814小根妥协网关gs - 400 NAS服务器参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0126.html参考:XF: gateway-gs400-default-password(9864)参考:网址:http://www.iss.net/security_center/static/9864.php参考:报价:5472参考:网址:http://www.securityfocus.com/bid/5472网关gs - 400服务器有一个默认的根密码“0001 n”不能改变通过管理界面,可允许攻击者获得根权限。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1440 3供应商确认:未知discloser-claimed内容决定:CF-PASS投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1441网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1441最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020819多个缓冲区溢出漏洞SteelArrow (# NISR19082002B)参考:网址:http://online.securityfocus.com/archive/1/288013参考:VULNWATCH: 20020819多个缓冲区溢出漏洞SteelArrow (# NISR19082002B)参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0085.html参考:MISC:http://www.steelarrow.com/参考:MISC:http://www.nextgenss.com/advisories/steel-arrow-bo.txt参考:MISC:http://www.nextgenss.com/vna/tom-saro.txt参考:XF: steelarrow-userident-bo(9888)参考:网址:http://www.iss.net/security_center/static/9888.php参考:XF: steelarrow-long-aro-bo(9889)参考:网址:http://www.iss.net/security_center/static/9889.php参考:XF: steelarrow-chunked-aro-bo(9890)参考:网址:http://www.iss.net/security_center/static/9890.php参考:报价:4860参考:网址:http://www.securityfocus.com/bid/4860参考:报价:5494参考:网址:http://www.securityfocus.com/bid/5494参考:报价:5496参考:网址:http://www.securityfocus.com/bid/5496参考:报价:5495参考:网址:http://www.securityfocus.com/bid/5495多个缓冲区溢位在4.5前Tomahawk SteelArrow允许远程攻击者执行任意代码通过(1)SteelArrow服务(Steelarrow.exe)使用一个长UserIdent饼干头,(2)DLLHOST。EXE长.aro (Steelarrow.dll)通过请求文件,或(3)DLLHOST。EXE通过分块传输编码的请求。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1441 3供应商确认:未知的模糊的内容决定:SF-EXEC确认:供应商的首页包括一个项目日期为2002年8月,州”版本[4.5]也消除了一个缓冲区溢出问题发现在4.1版本中,“但因为它并不信贷NGSSoftware(揭露者),它只提到一个溢出而不是3,它不能确定修复的问题确定候选人。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1442网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1442最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020808利用Google工具栏(GM # 001 - mc)参考:网址:http://online.securityfocus.com/archive/1/286527参考:NTBUGTRAQ: 20020808利用Google工具栏(GM # 001 - mc)参考:网址:http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0066.html参考:MISC:http://sec.greymagic.com/adv/gm001-mc/参考:报价:5424参考:网址:http://www.securityfocus.com/bid/5424谷歌工具栏1.1.58早些时候,允许远程网站执行未经授权的工具栏操作包括脚本执行和文件阅读等其他区域的“我的电脑”,打开一个窗口tools.google.com或res:协议,然后使用脚本修改窗口的位置到工具栏的配置URL,绕过原点验证检查。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1442 3供应商确认:未知discloser-claimed投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1444网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1444最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020815 IE(安装了Google工具栏)崩溃参考:网址:http://online.securityfocus.com/archive/1/287498参考:MISC:http://www.sztolnia.pl/hack/googIE/googIE.html参考:XF: ie-google-toolbar-dos(9883)参考:网址:http://www.iss.net/security_center/static/9883.php参考:报价:5477参考:网址:http://www.securityfocus.com/bid/5477谷歌工具栏1.1.60,Internet Explorer 5.5和6.0上运行时,允许远程攻击者造成拒绝服务(oleaut32.dll崩溃与例外)通过恶意的HTML,可能与小宽度和高度参数或不正确的调用Google.Search()函数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1444 3供应商确认:未知discloser-claimed准确性:揭露者没有提供诊断的问题在哪里,或“利用代码”的哪些部分是畸形的。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1445网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1445最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020811欧洲核子研究中心代理服务器:跨站点脚本漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0097.html参考:报价:5447参考:网址:http://www.securityfocus.com/bid/5447参考:XF: cern-proxy-xss(9834)参考:网址:http://www.iss.net/security_center/static/9834.php跨站点脚本(XSS)脆弱性在欧洲核子研究中心代理服务器允许远程攻击者执行脚本和其他用户通过一个链接到一个不存在的页面的名字包含的脚本,这是插入到生成的错误页面。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1445 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1449网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1449最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020730 Eupload引用错误:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0412.html参考:报价:5369参考:网址:http://online.securityfocus.com/bid/5369参考:XF: eupload-passwordtxt-overwrite-files(9733)参考:网址:http://www.iss.net/security_center/static/9733.phpeUpload 1.0存储密码。txt明文密码文件在web文档根,它允许远程攻击者通过阅读password.txt覆盖任意文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1449 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1450网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1450最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020731 TZ顾问——缓冲区溢出在IBM U2宇宙ODBC参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0442.html参考:XF: ibm-universe-invalid-query-dos(9736)参考:网址:http://www.iss.net/security_center/static/9736.phpIBM宇宙与紫外线/ ODBC允许攻击者造成拒绝服务(客户端崩溃或服务器CPU消耗)通过查询与无效的联系表,可能通过缓冲区溢出。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1450 3供应商确认:没有准确性:原来的Bugtraq帖子的主题包括“缓冲区溢出”,这个词的揭露者提供了很少的信息指示溢出。确认:搜索“脆弱性”或“缓冲区”http://www - 3. ibm.com/software/data/u2/universe/support/没有产生结果。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1451网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1451最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020824 Blazix 1.2 jsp视图和自由保护文件夹访问参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0259.html参考:报价:5566参考:网址:http://www.securityfocus.com/bid/5566参考:XF: blazix-unauth-file-access(9952)参考:网址:http://www.iss.net/security_center/static/9952.php参考:报价:5567参考:网址:http://www.securityfocus.com/bid/5567Blazix 1.2.2允许远程攻击者之前阅读源代码的JSP脚本或限制web目录列表通过一个HTTP请求,以(1)“+”或(2)(反斜杠)字符“\”。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1451 3供应商确认:未知discloser-claimed内容决定:SF-LOC电子邮件查询发送到support@desisoft.com 11月18日,2002年。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1452网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1452最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:VULNWATCH: 20020814新bug MyWebServer参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0077.html参考:BUGTRAQ: 20020814新bug MyWebServer参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102935720109934&w=2参考:XF: mywebserver-search-bo(9859)参考:网址:http://www.iss.net/security_center/static/9859.php参考:报价:5469参考:网址:http://www.securityfocus.com/bid/5469缓冲区溢出的搜索功能MyWebServer 1.0.2允许远程攻击者通过一个长searchTarget参数执行任意代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1452 3供应商确认:没有内容决策:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1453网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1453最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:VULNWATCH: 20020814新bug MyWebServer参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0077.html参考:BUGTRAQ: 20020814新bug MyWebServer参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102935720109934&w=2参考:报价:5470参考:网址:http://www.securityfocus.com/bid/5470参考:XF: mywebserver-long-http-xss(9861)参考:网址:http://www.iss.net/security_center/static/9861.php跨站点脚本(XSS)脆弱性MyWebServer 1.0.2允许远程攻击者通过很长的请求插入脚本和HTML的恶意脚本,这是回荡在一条错误消息返回给用户。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1453 3供应商确认:没有内容决策:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1454网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1454最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:VULNWATCH: 20020814新bug MyWebServer参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0077.html参考:BUGTRAQ: 20020814新bug MyWebServer参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102935720109934&w=2参考:XF: mywebserver-invalid-path-disclosure(9862)参考:网址:http://www.iss.net/security_center/static/9862.php参考:报价:5471参考:网址:http://www.securityfocus.com/bid/5471MyWebServer 1.0.2允许远程攻击者来决定网络的绝对路径通过请求文档根目录不存在,泄漏路径名的一条错误消息。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1454 3供应商确认:没有内容决策:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1455网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1455最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020825 OmniHTTPd测试。shtml跨站点脚本问题参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0264.html参考:BUGTRAQ: 20020825 OmniHTTPd测试。php跨站点脚本问题参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0263.html参考参考:BUGTRAQ: 20020825多OmniHTTPd问题:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0266.html多个跨站点脚本(XSS)漏洞OmniHTTPd允许远程攻击者插入脚本或HTML web页面通过(1)测试。php,(2)测试。shtml,或(3)redir.exe。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1455 3供应商确认:没有内容决策:SF-EXEC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1456网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1456最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: uuuppz.com -咨询002 - 20020827美元mIRC asctime溢出参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=103046375002380&w=2参考:NTBUGTRAQ: 20020827 uuuppz.com咨询002 - mIRC asctime溢出参考美元:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=103046138631893&w=2参考:VULNWATCH: 20020827 uuuppz.com咨询002 - mIRC asctime溢出参考美元:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0092.html参考:MISC:http://www.mirc.co.uk/whatsnew.txt参考:XF: mirc-asctime-bo(9970)参考:报价:5576参考:网址:http://online.securityfocus.com/bid/5576缓冲区溢出的mIRC 6.0.2和早些时候允许远程攻击者执行任意代码通过一个长asctime美元价值。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1456 3供应商确认:未知的模糊的确认:供应商变更2.0.3太模糊的知道的解决漏洞;它只是指“asctime()美元的错误。”投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1457网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1457最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:VULNWATCH: 20020813 L-Forum漏洞- SQL注入参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0074.html参考:XF: lforum-search-sql-injection(9837)参考:网址:http://www.iss.net/security_center/static/9837.php参考:报价:5468参考:网址:http://www.securityfocus.com/bid/5468SQL注入漏洞在搜索。php 2.40 L-Forum允许远程攻击者执行任意SQL语句通过搜索参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1457 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1458网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1458最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020813 L-Forum XSS和上传欺骗参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0115.html参考:MISC:http://sourceforge.net/tracker/download.php?group_id=53716&atid=471343&file_id=26687&aid=579278参考:XF: lforum-html-message-xss(9838)参考:网址:http://www.iss.net/security_center/static/9838.php参考:报价:5462参考:网址:http://www.securityfocus.com/bid/5462早些时候在L-Forum 2.40和跨站点脚本漏洞,当“启用HTML消息”选项,允许远程攻击者通过消息字段插入任意脚本或HTML包括(1),(2)电子邮件,(3)和(4)的身体主题。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1458 3供应商确认:没有内容决策:SF-LOC抽象:CD: SF-LOC表明分割的物品如果一项出现在一个比另一个不同的版本。正如Bugtraq邮报和供应商确认,“启用HTML”选项的错误* *是固定的,但相关的错误当“启用HTML”* *并不固定。因此这些物品应该分裂。确认:供应商提供的补丁时清楚地表明它只删除XSS问题“启用HTML”* *。因此,供应商没有固定的问题上“启用HTML”时,并没有确认。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1461网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1461最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020815网络商店经理安全漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0130.html参考:MISC:http://www.securiteam.com/security万博下载包news/5KP0G0080E.html参考:报价:5474参考:网址:http://www.securityfocus.com/bid/5474参考:XF: webshop-manager-execute-commands(9817)参考:网址:http://www.iss.net/security_center/static/9817.phpWeb 1.1商店经理允许远程攻击者通过执行任意命令shell元字符在搜索框。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1461 3供应商确认:没有确认:调查发布到供应商的形式http://www.webscriptworld.com/contact.phtml2002年11月18日。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1462网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1462最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020815输入验证攻击在php-affiliate-v1.0参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0141.html参考:报价:5482参考:网址:http://www.securityfocus.com/bid/5482参考:XF: phpaffiliate-details-account-access(9858)参考:网址:http://www.iss.net/security_center/static/9858.phpdetails2。php在OrganicPHP PHP-affiliate 1.0,可能以后的版本,允许远程攻击者修改其他用户的信息通过修改某些隐藏的表单字段。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1462 3供应商确认:没有供应商无法确认:没有明确的确认。在供应商的网站http://www.organicphp.com/包括一个项目1.1,说有“发现的某些缺陷,”和1.2说两个脚本”是错误的。”But there is no way to know whether these bugs were security-related. The site requires registration to obtain the software, and there is no email POC, so the possibility of acknowledgement was not investigated further. Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2002-1464 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1464最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:VULNWATCH: 20020813多个漏洞CafeLog Weblog包参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html参考:BUGTRAQ: 20020813多个漏洞CafeLog Weblog软件包参考:网址:http://online.securityfocus.com/archive/1/287228参考:报价:5455参考:网址:http://www.securityfocus.com/bid/5455参考:XF: b2-gpc-xss(9835)参考:网址:http://www.iss.net/security_center/static/9835.php跨站点脚本(XSS)脆弱性CafeLog b2博客工具允许远程攻击者通过GPC变量插入任意的HTML或脚本。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1464 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1465网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1465最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:VULNWATCH: 20020813多个漏洞CafeLog Weblog包参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html参考:BUGTRAQ: 20020813多个漏洞CafeLog Weblog软件包参考:网址:http://online.securityfocus.com/archive/1/287228参考:报价:5456参考:网址:http://www.securityfocus.com/bid/5456参考:XF: b2-tableposts-sql-injection(9836)参考:网址:http://www.iss.net/security_center/static/9836.phpSQL注入漏洞在CafeLog b2博客工具允许远程攻击者通过tablehosts变量执行任意SQL代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1465 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1466网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1466最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:VULNWATCH: 20020813多个漏洞CafeLog Weblog包参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html参考:BUGTRAQ: 20020813多个漏洞CafeLog Weblog软件包参考:网址:http://online.securityfocus.com/archive/1/2872282.06 pre4 CafeLog b2博客工具,启用了allow_fopen_url,允许远程攻击者通过b2inc变量执行任意的PHP代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1466 3供应商确认:内容决定:包含精度/包含:这可能是一个的重复或变体可以- 2002 - 0734。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1470网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1470最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020806命运研究实验室咨询:检索SHOUTcast Admin密码通过GET /参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0017.html参考:XF: shoutcast-scservlog-world-readable(9775)参考:网址:http://www.iss.net/security_center/static/9775.php参考:报价:5414参考:网址:http://www.securityfocus.com/bid/5414SHOUTcast 1.8.9早些时候,允许本地用户获得明文通过GET请求8001端口管理密码,导致密码记录在全局sc_serv的。日志文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1470 3供应商确认:没有争议的投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1498网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1498最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020828 SWServer 2.2目录遍历错误引用:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0307.html参考:报价:5590参考:网址:http://www.securityfocus.com/bid/5590参考:XF: swserver-encoded-directory-traversal(9981)参考:网址:http://www.iss.net/security_center/static/9981.php目录遍历脆弱性SWServer 2.2和更早的允许远程攻击者读取任意文件通过一个URL包含. .序列与“/”或“\”的角色。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1498 3供应商确认:未知discloser-claimed投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1499网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1499最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020831 FactoSystem CMS包含多个漏洞参考:网址:http://online.securityfocus.com/archive/1/290021参考:VULNWATCH: 20020830 FactoSystem CMS包含多个漏洞参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0097.html参考:MISC:http://sourceforge.net/tracker/index.php?func=detail&aid=602711&group_id=12668&atid=112668参考:XF: factosystem-asp-sql-injection(10000)参考:网址:http://www.iss.net/security_center/static/10000.php参考:报价:5600参考:网址:http://www.securityfocus.com/bid/5600多个SQL注入漏洞FactoSystem CMS允许远程攻击者执行未经授权的数据库操作通过(1)在作者authornumber参数。asp,(2)在讨论discussblurbid参数。asp, (3) holdcomment名称参数。asp,(4)电子邮件在holdcomment.asp参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1499 3供应商确认:没有内容决策:SF-LOC, SF-EXEC bug报告提交,但截至2003年1月,缺陷状态仍是“开放”。Therefore it cannot be certain whether the developer has acknowledged the vulnerability. Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2002-1506 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1506最终决定:阶段性裁决:修改:建议:20030317分配:20030205类别:科幻参考:BUGTRAQ: 20020828 iDEFENSE安全顾问:linuxdonf当地可利用的缓冲区溢位参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-08/0304.html参考:VULNWATCH: 20020828 iDEFENSE安全顾问:linuxdonf当地可利用的缓冲区溢位参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0093.html参考:MISC:http://www.solucorp.qc.ca/changes.hc?projet=linuxconf&version=1.28r4参考:报价:5585参考:网址:http://www.securityfocus.com/bid/5585参考:XF: linuxconf-linuxconflang-env-bo(9980)参考:网址:http://www.iss.net/security_center/static/9980.php缓冲区溢位在1.28前linuxdonf r4允许本地用户执行任意代码通过一个长LINUXCONF_LANG环境变量,而溢出字符串生成一个错误。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1506 3供应商确认:未知的模糊的确认:供应商更改日志1.28 r4讨论了“修复本地安全利用”,但没有提供细节。日志日期为8月18日;然而,iDEFENSE披露时间表说供应商直到19世纪才通知。虽然这可能似乎是一个小矛盾,认为结合供应商的含糊不清的语句时,这个更新日志不能被视为结论性的证据表明供应商固定这个特殊的脆弱性。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论: