yahoo-inc/cve-impacts huggingface dataset:
CVE-1999-1301: A design flaw in the Z-Modem protocol allows the remote sender of a file to execute arbitrary programs on the client, as implemented in rz in the rzsz module of FreeBSD before 2.1.5, and possibly other programs.
Key phrases: execute arbitrary programs, execute arbitrary programs on the client, design flaw
CVE-1999-1302: Unspecified vulnerability in pt_chmod in SCO UNIX 4.2 and earlier allows local users to gain root access.
Key phrases: gain root access, unspecified, unspecified vulnerability
CVE-1999-1303: Vulnerability in prwarn in SCO UNIX 4.2 and earlier allows local users to gain root access.
Key phrases: gain root access
CVE-1999-1304: Vulnerability in login in SCO UNIX 4.2 and earlier allows local users to gain root access.
Key phrases: gain root access, vulnerability in login
CVE-1999-1305: Vulnerability in "at" program in SCO UNIX 4.2 and earlier allows local users to gain root access.
Key phrases: gain root access
CVE-1999-1306: Cisco IOS 9.1 and earlier does not properly handle extended IP access lists when the IP route cache is enabled and the "established" keyword is set, which could allow attackers to bypass filters.
Key phrases: bypass filters
CVE-1999-1307: Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.
Key phrases: gain root privileges
CVE-1999-1308: Certain programs in HP-UX 10.20 do not properly handle large user IDs (UID) or group IDs (GID) over 60000, which could allow local users to gain privileges.
Key phrases: gain privileges
CVE-1999-1309: Sendmail before 8.6.7 allows local users to gain root access via a large value in the debug (-d) command line option.
Key phrases: gain root access, gain root access via a large value in
CVE-1999-1311: Vulnerability in dtlogin and dtsession in HP-UX 10.20 and 10.10 allows local users to bypass authentication and gain privileges.
Key phrases: bypass authentication, gain privileges, bypass authentication and gain privileges, dtlogin, dtsession
CVE-1999-1312: Vulnerability in DEC OpenVMS VAX 5.5-2 through 5.0, and OpenVMS AXP 1.0, allows local users to gain system privileges.
Key phrases: gain system privileges
CVE-1999-1313: Manual page reader (man) in FreeBSD 2.2 and earlier allows local users to gain privileges via a sequence of commands.
Key phrases: gain privileges, gain privileges via a sequence of commands
CVE-1999-1314: Vulnerability in union file system in FreeBSD 2.2 and earlier, and possibly other operating systems, allows local users to cause a denial of service (system reload) via a series of certain mount_union commands.
Key phrases: denial of service (system reload), cause a denial of service (system reload
CVE-1999-1315: Vulnerabilities in DECnet/OSI for OpenVMS before 5.8 on DEC Alpha AXP and VAX/VMS systems allow local users to gain privileges or cause a denial of service.
Key phrases: gain privileges, gain privileges or cause a denial of service
CVE-1999-1316: Passfilt.dll in Windows NT SP2 allows users to create a password that contains the user's name, which could make it easier for an attacker to guess.
Key phrases: create a password that contains the user's
CVE-1999-1317: Windows NT 4.0 SP4 and earlier allows local users to gain privileges by modifying the symbolic link table in the \\\\?? object folder using a different case letter (upper or lower) to point to a different device.
Key phrases: gain privileges, gain privileges by modifying the symbolic link table
CVE-1999-1318: /usr/5bin/su in SunOS 4.1.3 and earlier uses a search path that includes the current working directory (.), which allows local users to gain privileges via Trojan horse programs.
Key phrases: gain privileges, gain privileges via Trojan horse programs
CVE-1999-1319: Vulnerability in object server program in SGI IRIX 5.2 through 6.1 allows remote attackers to gain root privileges in certain configurations.
Key phrases: gain root privileges, gain root privileges in certain configurations
CVE-1999-1320: Vulnerability in Novell NetWare 3.x and earlier allows local users to gain privileges via packet spoofing.
Key phrases: gain privileges, gain privileges via packet spoofing
CVE-1999-1321: Buffer overflow in ssh 1.2.26 client with Kerberos V enabled could allow remote attackers to cause a denial of service or execute arbitrary commands via a long DNS hostname that is not properly handled during TGT ticket passing.
Key phrases: execute arbitrary commands, cause a denial of service or execute arbitrary, buffer overflow
CVE-1999-1322: The installation of 1ArcServe Backup and Inoculan AV client modules for Exchange create a log file, exchverify.log, which contains usernames and passwords in plaintext.
Key phrases: plaintext
CVE-1999-1323: Norton AntiVirus for Internet Email Gateways (NAVIEG) 1.0.1.7 and earlier, and Norton AntiVirus for MS Exchange (NAVMSE) 1.5 and earlier, store the administrator password in cleartext in (1) the navieg.ini file for NAVIEG, and (2) the ModifyPassword registry key in NAVMSE.
Key phrases: cleartext
CVE-1999-1324: VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts, which makes it easier for attackers to conduct brute force password guessing.
Key phrases: break-in limit threshold, brute force password guessing
CVE-1999-1325: SAS System 5.18 on VAX/VMS is installed with insecure permissions for its directories and startup file, which allows local users to gain privileges.
Key phrases: gain privileges, insecure permissions
CVE-1999-1326: wu-ftpd 2.4 FTP server does not properly drop privileges when an ABOR (abort file transfer) command is executed during a file transfer, which causes a signal to be handled incorrectly and allows local and possibly remote attackers to read arbitrary files.
Key phrases: read arbitrary files
CVE-1999-1327: Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable.
Key phrases: gain root privileges, gain root privileges via a long LANG environmental, buffer overflow
CVE-1999-1328: linuxconf before 1.11.r11-rh3 on Red Hat Linux 5.1 allows local users to overwrite arbitrary files and gain root access via a symlink attack.
Key phrases: overwrite arbitrary files, gain root access, overwrite arbitrary files and gain root access via, symlink
CVE-1999-1329: Buffer overflow in SysVInit in Red Hat Linux 5.1 and earlier allows local users to gain privileges.
Key phrases: gain privileges, buffer overflow
CVE-1999-1330: The snprintf function in the db library 1.85.4 ignores the size parameter, which could allow attackers to exploit buffer overflows that would be prevented by a properly implemented snprintf.
Key phrases: exploit buffer overflows that would be prevented by
CVE-1999-1331: netcfg 2.16-1 in Red Hat Linux 4.2 allows the Ethernet interface to be controlled by users on reboot when an option is set, which allows local users to cause a denial of service by shutting down the interface.
Key phrases: be controlled by users on reboot when an, cause a denial of service by shutting down
CVE-1999-1332: gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file.
Key phrases: overwrite files of other users via a symlink
CVE-1999-1333: automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the, automatic download option
CVE-1999-1334: Multiple buffer overflows in filter command in Elm 2.4 allows attackers to execute arbitrary commands via (1) long From: headers, (2) long Reply-To: headers, or (3) via a long -f (filterfile) command line argument.
Key phrases: execute arbitrary commands, execute arbitrary commands via (1) long, buffer overflows
CVE-1999-1335: snmpd server in cmu-snmp SNMP package before 3.3-1 in Red Hat Linux 4.0 is configured to allow remote attackers to read and write sensitive information.
Key phrases: read and write sensitive information
CVE-1999-1336: 3Com HiPer Access Router Card (HiperARC) 4.0 through 4.2.29 allows remote attackers to cause a denial of service (reboot) via a flood of IAC packets to the telnet port.
Key phrases: denial of service (reboot), cause a denial of service (reboot)
CVE-1999-1337: FTP client in Midnight Commander (mc) before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable history file, which allows other local users to gain privileges.
Key phrases: gain privileges, world-readable history file
CVE-1999-1338: Delegate proxy 5.9.3 and earlier creates files and directories in the DGROOT with world-writable permissions.
Key phrases: world-writable permissions
CVE-1999-1339: Vulnerability when Network Address Translation (NAT) is enabled in Linux 2.2.10 and earlier with ipchains, or FreeBSD 3.2 with ipfw, allows remote attackers to cause a denial of service (kernel panic) via a ping -R (record route) command.
Key phrases: denial of service (kernel panic), cause a denial of service (kernel panic
CVE-1999-1340: Buffer overflow in faxalter in hylafax 4.0.2 allows local users to gain privileges via a long -m command line argument.
Key phrases: gain privileges, gain privileges via a long -m command line, buffer overflow
CVE-1999-1341: Linux kernel before 2.3.18 or 2.2.13pre15, with SLIP and PPP options, allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices.
Key phrases: forge IP packets via the TIOCSETD option on
CVE-1999-1342: ICQ ActiveList Server allows remote attackers to cause a denial of service (crash) via malformed packets to the server's UDP port.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed packets
CVE-1999-1343: HTTP server for Xerox DocuColor 4 LP allows remote attackers to cause a denial of service (hang) via a long URL that contains a large number of . characters.
Key phrases: denial of service (hang), cause a denial of service (hang), long url
CVE-1999-1344: Auto_FTP.pl script in Auto_FTP 0.2 stores usernames and passwords in plaintext in the auto_ftp.conf configuration file.
Key phrases: plaintext
CVE-1999-1345: Auto_FTP.pl script in Auto_FTP 0.2 uses the /tmp/ftp_tmp as a shared directory with insecure permissions, which allows local users to (1) send arbitrary files to the remote server by placing them in the directory, and (2) view files that are being transferred.
Key phrases: send arbitrary files, (1) send arbitrary files to the, insecure permissions
CVE-1999-1346: PAM configuration file for rlogin in Red Hat Linux 6.1 and earlier includes a less restrictive rule before a more restrictive one, which allows users to access the host via rlogin even if rlogin has been explicitly disabled using the /etc/nologin file.
Key phrases: access the host via rlogin even if rlogin
CVE-1999-1347: Xsession in Red Hat Linux 6.1 and earlier can allow local users with restricted accounts to bypass execution of the .xsession file by starting kde, gnome or anotherlevel from kdm.
Key phrases: bypass execution of the .xsession file by starting kde
CVE-1999-1348: Linuxconf on Red Hat Linux 6.0 and earlier does not properly disable PAM-based access to the shutdown command, which could allow local users to cause a denial of service.
Key phrases: cause a denial of service, pam-based access
CVE-1999-1349: NFS daemon (nfsd.exe) for Omni-NFS/X 6.1 allows remote attackers to cause a denial of service (resource exhaustion) via certain packets, possibly with the Urgent (URG) flag set, to port 111.
Key phrases: denial of service (resource exhaustion), cause a denial of service (resource exhaustion
CVE-1999-1350: ARCAD Systemhaus 0.078-5 installs critical programs and files with world-writeable permissions, which could allow local users to gain privileges by replacing a program with a Trojan horse.
Key phrases: gain privileges, gain privileges by replacing a program with a, world-writeable permissions
CVE-1999-1351: Directory traversal vulnerability in KVIrc IRC client 0.9.0 with the "Listen to !nick <soundname> requests" option enabled allows remote attackers to read arbitrary files via a .. (dot dot) in a DCC GET request.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-1999-1352: mknod in Linux 2.2 follows symbolic links, which could allow local users to overwrite files or gain privileges.
Key phrases: gain privileges, overwrite files or gain privileges, symbolic links
CVE-1999-1353: Nosque MsgCore 2.14 stores passwords in cleartext: (1) the administrator password in the AdmPasswd registry key, and (2) user passwords in the Userbase.dbf data file, which could allow local users to gain privileges.
Key phrases: gain privileges, cleartext
CVE-1999-1354: E-mail client in Softarc FirstClass Internet Server 5.506 and earlier stores usernames and passwords in cleartext in the files (1) home.fc for version 5.506, (2) network.fc for version 3.5, or (3) FCCLIENT.LOG when logging is enabled.
Key phrases: cleartext
CVE-1999-1355: BMC Patrol component, when installed with Compaq Insight Management Agent 4.23 and earlier, or Management Agents for Servers 4.40 and earlier, creates a PFCUser account with a default password and potentially dangerous privileges.
Key phrases: default password, potentially dangerous privileges
CVE-1999-1356: Compaq Integration Maintenance Utility as used in Compaq Insight Manager agent before SmartStart 4.50 modifies the legal notice caption (LegalNoticeCaption) and text (LegalNoticeText) in Windows NT, which could produce a legal notice that is in violation of the security policy.
CVE-1999-1357: Netscape Communicator 4.04 through 4.7 (and possibly other versions) in various UNIX operating systems converts the 0x8b character to a "<" sign, and the 0x9b character to a ">" sign, which could allow remote attackers to attack other clients via cross-site scripting (CSS) in CGI programs that do not filter these characters.
Key phrases: attack other clients via cross-site scripting, cross-site scripting (css)
CVE-1999-1358: When an administrator in Windows NT or Windows 2000 changes a user policy, the policy is not properly updated if the local ntconfig.pol is not writable by the user, which could allow local users to bypass restrictions that would otherwise be enforced by the policy, possibly by changing the policy file to be read-only.
Key phrases: bypass restrictions, bypass restrictions that would otherwise be enforced by, file read
CVE-1999-1359: When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies.
Key phrases: bypass restrictions, bypass restrictions that were intended by those policies
CVE-1999-1360: Windows NT 4.0 allows local users to cause a denial of service via a user mode application that closes a handle that was opened in kernel mode, which causes a crash when the kernel attempts to close the handle.
Key phrases: cause a denial of service via a user, crash
CVE-1999-1361: Windows NT 3.51 and 4.0 running WINS (Windows Internet Name Service) allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed packets, which causes the server to slow down and fill the event logs with error messages.
Key phrases: denial of service (resource exhaustion), cause a denial of service (resource exhaustion, slow down, error messages
CVE-1999-1362: Win32k.sys in Windows NT 4.0 before SP2 allows local users to cause a denial of service (crash) by calling certain WIN32K functions with incorrect parameters.
Key phrases: denial of service (crash), cause a denial of service (crash), incorrect parameters
CVE-1999-1363: Windows NT 3.51 and 4.0 allow local users to cause a denial of service (crash) by running a program that creates a large number of locks on a file, which exhausts the NonPagedPool.
Key phrases: denial of service (crash), cause a denial of service (crash), locks
CVE-1999-1364: Windows NT 4.0 allows local users to cause a denial of service (crash) via an illegal kernel mode address to the functions (1) GetThreadContext or (2) SetThreadContext.
Key phrases: denial of service (crash), cause a denial of service (crash), illegal kernel mode address
CVE-1999-1365: Windows NT searches a user's home directory (%systemroot% by default) before other directories to find critical programs such as NDDEAGNT.EXE, EXPLORER.EXE, USERINIT.EXE or TASKMGR.EXE, which could allow local users to bypass access restrictions or gain privileges by placing a Trojan horse program into the root directory, which is writable by default.
Key phrases: bypass access restrictions, gain privileges, bypass access restrictions or gain privileges by placing, writable
CVE-1999-1366: Pegasus e-mail client 3.0 and earlier uses weak encryption to store POP3 passwords in the pmail.ini file, which allows local users to easily decrypt the passwords and read e-mail.
Key phrases: easily decrypt the passwords and read e-, weak encryption, decrypt password
CVE-1999-1367: Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users.
Key phrases: access restricted web sites that were visited by
CVE-1999-1368: AV Option for MS Exchange Server option for InoculateIT 4.53, and possibly other versions, only scans the Inbox folder tree of a Microsoft Exchange server, which could allow viruses to escape detection if a user's rules cause the message to be moved to a different mailbox.
Key phrases: escape detection if a user's rules cause
CVE-1999-1369: Real Media RealServer (rmserver) 6.0.3.353 stores a password in plaintext in the world-readable rmserver.cfg file, which allows local users to gain privileges.
Key phrases: gain privileges, world-readable
CVE-1999-1370: The setup wizard (ie5setup.exe) for Internet Explorer 5.0 disables (1) the screen saver, which could leave the system open to users with physical access if a failure occurs during an unattended installation, and (2) the Task Scheduler Service, which might prevent the scheduled execution of security-critical programs.
Key phrases: physical access
CVE-1999-1371: Buffer overflow in /usr/bin/write in Solaris 2.6 and 7 allows local users to gain privileges via a long string in the terminal name argument.
Key phrases: gain privileges, gain privileges via a long string in the, buffer overflow
CVE-1999-1372: Triactive Remote Manager with Basic authentication enabled stores the username and password in cleartext in registry keys, which could allow local users to gain privileges.
Key phrases: gain privileges, cleartext
CVE-1999-1373: FORE PowerHub before 5.0.1 allows remote attackers to cause a denial of service (hang) via a TCP SYN scan with TCP/IP OS fingerprinting, e.g. via nmap.
Key phrases: denial of service (hang), cause a denial of service (hang)
CVE-1999-1374: perlshop.cgi shopping cart program stores sensitive customer information in directories and files that are under the web root, which allows remote attackers to obtain that information via an HTTP request.
Key phrases: obtain that information, obtain that information via an HTTP request
CVE-1999-1375: FileSystemObject (FSO) in the showfile.asp Active Server Page (ASP) allows remote attackers to read arbitrary files by specifying the name in the file parameter.
Key phrases: read arbitrary files, read arbitrary files by specifying the name in, filesystemobject (fso)
CVE-1999-1376: Buffer overflow in fpcount.exe in IIS 4.0 with FrontPage Server Extensions allows remote attackers to execute arbitrary commands.
Key phrases: execute arbitrary commands, buffer overflow
CVE-1999-1377: Matt Wright's download.cgi 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot
CVE-1999-1378: dbmlparser.exe CGI guestbook program does not perform a chroot operation properly, which allows remote attackers to read arbitrary files.
Key phrases: read arbitrary files
CVE-1999-1379: DNS allows remote attackers to use DNS name servers as traffic amplifiers via a UDP DNS query with a spoofed source address, which produces more traffic to the victim than was sent by the attacker.
Key phrases: use DNS name servers as traffic amplifiers via, spoofed source address, spoofing
CVE-1999-1380: Symantec Norton Utilities 2.0 for Windows 95 marks the TUNEOCX.OCX ActiveX control as safe for scripting, which allows remote attackers to execute arbitrary commands via the run option through malicious web pages that are accessed by browsers such as Internet Explorer 3.0.
Key phrases: execute arbitrary commands, execute arbitrary commands via the run option through
CVE-1999-1381: Buffer overflow in dbadmin CGI program 1.0.1 on Linux allows remote attackers to execute arbitrary commands.
Key phrases: execute arbitrary commands, buffer overflow
CVE-1999-1382: NetWare NFS mode 1 and 2 implements the "Read Only" flag in Unix by changing the ownership of a file to root, which allows local users to gain root privileges by creating a setuid program and setting it to "Read Only," which NetWare-NFS changes to a setuid root program.
Key phrases: gain root privileges, gain root privileges by creating a setuid program
CVE-1999-1383: (1) bash before 1.14.7, and (2) tcsh 6.05 allow local users to gain privileges via directory names that contain shell metacharacters (` back-tick), which can cause the commands enclosed in the directory name to be executed when the shell expands filenames using the \\\\w option in the PS1 variable.
Key phrases: gain privileges, gain privileges via directory names that contain shell, shell metacharacters
CVE-1999-1384: Indigo Magic System Tour in the SGI system tour package (systour) for IRIX 5.x through 6.3 allows local users to gain root privileges via a Trojan horse .exitops program, which is called by the inst command that is executed by the RemoveSystemTour program.
Key phrases: gain root privileges, gain root privileges via a Trojan horse .exitops
CVE-1999-1385: Buffer overflow in ppp program in FreeBSD 2.1 and earlier allows local users to gain privileges via a long HOME environment variable.
Key phrases: gain privileges, gain privileges via a long HOME environment variable, buffer overflow
CVE-1999-1386: Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on, symbolic links
CVE-1999-1387: Windows NT 4.0 SP2 allows remote attackers to cause a denial of service (crash), possibly via malformed inputs or packets, such as those generated by a Linux smbmount command that was compiled on the Linux 2.0.29 kernel but executed on Linux 2.0.25.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed inputs
CVE-1999-1388: passwd in SunOS 4.1.x allows local users to overwrite arbitrary files via a symlink attack and the -F command line argument.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack and
CVE-1999-1389: US Robotics/3Com Total Control Chassis with Frame Relay between 3.6.22 and 3.7.24 does not properly enforce access filters when the "set host prompt" setting is made for a port, which allows attackers to bypass restrictions by providing the hostname twice at the "host: " prompt.
Key phrases: bypass restrictions, bypass restrictions by providing the hostname twice at
CVE-1999-1390: suidexec in suidmanager 0.18 on Debian 2.0 allows local users to gain root privileges by specifying a malicious program on the command line.
Key phrases: gain root privileges, gain root privileges by specifying a malicious program, suidexec
CVE-1999-1391: Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a combination of the npd program and weak directory permissions.
Key phrases: gain privileges, gain privileges via a combination of the npd, weak directory permissions
CVE-1999-1392: Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.
Key phrases: gain root privileges
CVE-1999-1393: Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security by booting it with an emergency startup disk and using a disk editor to modify the on/off toggle or password in the aaaaaaaAPWD file, which is normally inaccessible.
Key phrases: bypass the security by booting it with an emergency startup disk, the machine to bypass the security by booting, physical access, bypass security
CVE-1999-1394: BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutable and append-only flags for files by unmounting the file system and using a file system editor such as fsdb to directly modify the file through a device.
Key phrases: clear the immutable and append-only flags
CVE-1999-1395: Vulnerability in Monitor utility (SYS$SHARE:SPISHR.EXE) in VMS 5.0 through 5.4-2 allows local users to gain privileges.
Key phrases: gain privileges
CVE-1999-1396: Vulnerability in integer multiplication emulation code on SPARC architectures for SunOS 4.1 through 4.1.2 allows local users to gain root access or cause a denial of service (crash).
Key phrases: denial of service (crash), gain root access, gain root access or cause a denial of
CVE-1999-1397: Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\\\\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
Key phrases: obtain the physical paths of directories that are
CVE-1999-1398: Vulnerability in xfsdump in SGI IRIX may allow local users to obtain root privileges via the bck.log log file, possibly via a symlink attack.
Key phrases: obtain root privileges, obtain root privileges via the bck.log log file
CVE-1999-1399: spaceball program in SpaceWare 7.3 v1.0 in IRIX 6.2 allows local users to gain root privileges by setting the HOSTNAME environmental variable to contain the commands to be executed.
Key phrases: gain root privileges, gain root privileges by setting the HOSTNAME environmental
CVE-1999-1400: The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the screen saver and read files by running Internet Explorer while the screen is still locked.
Key phrases: bypass the screen, the machine to bypass the screen saver and
CVE-1999-1401: Vulnerability in Desktop searchbook program in IRIX 5.0.x through 6.2 sets insecure permissions for certain user files (iconbook and searchbook).
CVE-1999-1402: The access permissions for a UNIX domain socket are ignored in Solaris 2.x and SunOS 4.x, and other BSD-based operating systems before 4.4, which could allow local users to connect to the socket and possibly disrupt or control the operations of the program using that socket.
Key phrases: connect to the socket and possibly disrupt or
CVE-1999-1403: IBM/Tivoli OPC Tracker Agent version 2 release 1 creates files, directories, and IPC message queues with insecure permissions (world-readable and world-writable), which could allow local users to disrupt operations and possibly gain privileges by modifying or deleting files.
Key phrases: gain privileges, disrupt operations and possibly gain privileges by modifying, insecure permissions
CVE-1999-1404: IBM/Tivoli OPC Tracker Agent version 2 release 1 allows remote attackers to cause a denial of service (resource exhaustion) via malformed data to the localtracker client port (5011), which prevents the connection from being closed properly.
Key phrases: denial of service (resource exhaustion), cause a denial of service (resource exhaustion, malformed data
CVE-1999-1405: snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directory when snap -a is executed, which could allow local users to access the shadowed password file by creating /tmp/ibmsupt/general/passwd before root runs snap -a.
Key phrases: access the shadowed password file by creating /tmp, world-readable permissions
CVE-1999-1406: dumpreg in Red Hat Linux 5.1 opens /dev/mem with O_RDWR access, which allows local users to cause a denial of service (crash) by redirecting fd 1 (stdout) to the kernel.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-1999-1407: ifdhcpc-done script for configuring DHCP on Red Hat Linux 5 allows local users to append text to arbitrary files via a symlink attack on the dhcplog file.
Key phrases: append text to arbitrary files via a symlink
CVE-1999-1408: Vulnerability in AIX 4.1.4 and HP-UX 10.01 and 9.05 allows local users to cause a denial of service (crash) by using a socket to connect to a port on the localhost, calling shutdown to clear the socket, then using the same socket to connect to a different port on localhost.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-1999-1409: The at program in IRIX 6.2 and NetBSD 1.3.2 and earlier allows local users to read portions of arbitrary files by submitting the file to at with the -f argument, which generates error messages that at sends to the user via e-mail.
Key phrases: read portions of arbitrary files by submitting the
CVE-1999-1410: addnetpr in IRIX 5.3 and 6.2 allows local users to overwrite arbitrary files and possibly gain root privileges via a symlink attack on the printers temporary file.
Key phrases: overwrite arbitrary files, gain root privileges, overwrite arbitrary files and possibly gain root privileges, addnetpr, symlink
CVE-1999-1411: The installation of the fsp package 2.71-10 in Debian GNU/Linux 2.0 adds the anonymous FTP user without notifying the administrator, which could automatically enable anonymous FTP on some servers such as wu-ftp.
Key phrases: anonymous ftp user
CVE-1999-1412: A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.
Key phrases: denial of service (crash), cause a denial of service (crash), large number of processes
CVE-1999-1413: Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg.
Key phrases: dump core even if the real user i, overwrite or create files at higher privileges by, set-gid programs
CVE-1999-1414: IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs with system level privileges.
Key phrases: gain administrator privileges, gain administrator privileges by starting programs from the
CVE-1999-1415: Vulnerability in /usr/bin/mail in DEC ULTRIX before 4.2 allows local users to gain privileges.
Key phrases: gain privileges
CVE-1999-1416: AnswerBook2 (AB2) web server dwhttpd 3.1a4 allows remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large content-length.
Key phrases: denial of service (resource exhaustion), cause a denial of service (resource exhaustion
CVE-1999-1417: Format string vulnerability in AnswerBook2 (AB2) web server dwhttpd 3.1a4 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via encoded % characters in an HTTP request, which is improperly logged.
Key phrases: execute arbitrary commands, cause a denial of service and possibly execute, format string
CVE-1999-1418: ICQ99 ICQ web server build 1701 with "Active Homepage" enabled generates allows remote attackers to determine the existence of files on the server by comparing server responses when a file exists ("404 Forbidden") versus when a file does not exist ("404 not found").
Key phrases: determine the existence of files on the server, active homepage
CVE-1999-1419: Buffer overflow in nss_nisplus.so.1 library in NIS+ in Solaris 2.3 and 2.4 allows local users to gain root privileges.
Key phrases: gain root privileges, buffer overflow
CVE-1999-1420: NBase switches NH2012, NH2012R, NH2015, and NH2048 have a back door password that cannot be disabled, which allows remote attackers to modify the switch's configuration.
Key phrases: modify the switch's configuration, back door password
CVE-1999-1421: NBase switches NH208 and NH215 run a TFTP server which allows remote attackers to send software updates to modify the switch or cause a denial of service (crash) by guessing the target filenames, which have default names.
Key phrases: denial of service (crash), send software updates to modify the switch or, target filenames, default names
CVE-1999-1422: The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users.
Key phrases: create Trojan horse programs that are inadvertently executed
CVE-1999-1423: ping in Solaris 2.3 through 2.6 allows local users to cause a denial of service (crash) via a ping request to a multicast address through the loopback interface, e.g. via ping -i.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-1999-1424: Solaris Solstice AdminSuite (AdminSuite) 2.1 uses unsafe permissions when adding new users to the NIS+ password table, which allows local users to gain root access by modifying their password table entries.
Key phrases: gain root access, gain root access by modifying their password table, unsafe permissions
CVE-1999-1425: Solaris Solstice AdminSuite (AdminSuite) 2.1 incorrectly sets write permissions on source files for NIS maps, which could allow local users to gain privileges by modifying /etc/passwd.
Key phrases: gain privileges, gain privileges by modifying /etc/passwd, write permissions
CVE-1999-1426: Solaris Solstice AdminSuite (AdminSuite) 2.1 follows symbolic links when updating an NIS database, which allows local users to overwrite arbitrary files.
Key phrases: overwrite arbitrary files, symbolic links
CVE-1999-1427: Solaris Solstice AdminSuite (AdminSuite) 2.1 and 2.2 create lock files insecurely, which allows local users to gain root privileges.
Key phrases: gain root privileges
CVE-1999-1428: Solaris Solstice AdminSuite (AdminSuite) 2.1 and 2.2 allows local users to gain privileges via the save option in the Database Manager, which is running with setgid bin privileges.
Key phrases: gain privileges, gain privileges via the save option in the, setgid bin privileges
CVE-1999-1429: DIT TransferPro installs devices with world-readable and world-writable permissions, which could allow local users to damage disks through the ff device driver.
Key phrases: damage disks through the ff device driver, world-readable, world-writable permissions
CVE-1999-1430: PIM software for Royal daVinci does not properly password-protext access to data stored in the .mdb (Microsoft Access) file, which allows local users to read the data without a password by directly accessing the files with a different application, such as Access.
Key phrases: read the data without a password by directly
CVE-1999-1431: ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing software into the TEMP directory, and changing the name to that for an allowed application, such as Winword.exe.
Key phrases: bypass the "Run only allowed apps" policy
CVE-1999-1432: Power management (Powermanagement) on Solaris 2.4 through 2.6 does not start the xlock process until after the sys-suspend has completed, which allows an attacker with physical access to input characters to the last active application from the keyboard for a short period after the system is restoring, which could lead to increased privileges.
Key phrases: input characters to the last active application from, physical access, increased privileges
CVE-1999-1433: HP JetAdmin D.01.09 on Solaris allows local users to change the permissions of arbitrary files via a symlink attack on the /tmp/jetadmin.log file.
Key phrases: change the permissions of arbitrary files via a, symlink
CVE-1999-1434: login in Slackware Linux 3.2 through 3.5 does not properly check for an error when the /etc/group file is missing, which prevents it from dropping privileges, causing it to assign root privileges to any local user who logs on to the server.
Key phrases: root privilege
CVE-1999-1435: Buffer overflow in libsocks5 library of Socks 5 (socks5) 1.0r5 allows local users to gain privileges via long environmental variables.
Key phrases: gain privileges, gain privileges via long environmental variables, buffer overflow
CVE-1999-1436: Ray Chan WWW Authorization Gateway 0.1 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "user" parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-1999-1437: ePerl 2.2.12 allows remote attackers to read arbitrary files and possibly execute certain commands by specifying a full pathname of the target file as an argument to bar.phtml.
Key phrases: read arbitrary files, read arbitrary files and possibly execute certain commands
CVE-1999-1438: Vulnerability in /bin/mail in SunOS 4.1.1 and earlier allows local users to gain root privileges via certain command line arguments.
Key phrases: gain root privileges, gain root privileges via certain command line arguments
CVE-1999-1439: gcc 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary .i, .s, or .o files.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-1999-1440: Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send an executable file with a long name that contains so many spaces that the .exe extension is not displayed, which could make the user believe that the file is safe to open from the client.
Key phrases: send an executable file with a long name, long filenames
CVE-1999-1441: Linux 2.0.34 does not properly prevent users from sending SIGIO signals to arbitrary processes, which allows local users to cause a denial of service by sending SIGIO to processes that do not catch it.
Key phrases: cause a denial of service by sending SIGIO
CVE-1999-1442: Bug in AMD K6 processor on Linux 2.0.x and 2.1.x kernels allows local users to cause a denial of service (crash) via a particular sequence of instructions, possibly related to accessing addresses outside of segments.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-1999-1443: Micah Software Full Armor Network Configurator and Zero Administration allow local users with physical access to bypass the desktop protection by (1) using <CTRL><ALT><DEL> and kill the process using the task manager, (2) booting the system from a separate disk, or (3) interrupting certain processes that execute while the system is booting.
Key phrases: bypass the desktop protection, bypass the desktop protection by (1)
CVE-1999-1444: genkey utility in Alibaba 2.0 generates RSA key pairs with an exponent of 1, which results in transactions that are sent in cleartext.
Key phrases: cleartext
CVE-1999-1445: Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords.
Key phrases: cause a core dump via a short sequence
CVE-1999-1446: Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which are not cleared when the user selects the "Clear History" option, and are not visible when the user browses the folders because of tailored displays.
CVE-1999-1447: Internet Explorer 4.0 allows remote attackers to cause a denial of service (crash) via HTML code that contains a long CLASSID parameter in an OBJECT tag.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-1999-1448: Eudora and Eudora Light before 3.05 allows remote attackers to cause a crash and corrupt the user's mailbox via an e-mail message with certain dates, such as (1) dates before 1970, which cause a Divide By Zero error, or (2) dates that are 100 years after the current date, which causes a segmentation fault.
Key phrases: cause a crash and corrupt the user's, segmentation fault
CVE-1999-1449: SunOS 4.1.4 on a Sparc 20 machine allows local users to cause a denial of service (kernel panic) by reading from the /dev/tcx0 TCX device.
Key phrases: denial of service (kernel panic), cause a denial of service (kernel panic
CVE-1999-1450: Vulnerability in (1) rlogin daemon rshd and (2) scheme on SCO UNIX OpenServer 5.0.5 and earlier, and SCO UnixWare 7.0.1 and earlier, allows remote attackers to gain privileges.
Key phrases: gain privileges
CVE-1999-1451: The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files.
Key phrases: read arbitrary files
CVE-1999-1452: GINA in Windows NT 4.0 allows attackers with physical access to display a portion of the clipboard of the user who has locked the workstation by pasting (CTRL-V) the contents into the username prompt.
Key phrases: display a portion of the clipboard of the, gina
CVE-1999-1453: Internet Explorer 4 allows remote attackers (malicious web site operators) to read the contents of the clipboard via the Internet WebBrowser ActiveX object.
Key phrases: read the contents of the clipboard via the
CVE-1999-1454: Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass the password prompt by pressing the ESC (Escape) key.
Key phrases: bypass the password prompt by pressing the ESC, the machine to bypass the password prompt by
CVE-1999-1455: RSH service utility RSHSVC in Windows NT 3.5 through 4.0 does not properly restrict access as specified in the .Rhosts file when a user comes from an authorized host, which could allow unauthorized users to access the service by logging in from an authorized host.
Key phrases: access the service by logging in from an
CVE-1999-1456: thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.
Key phrases: read arbitrary files, read arbitrary files via a GET request with
CVE-1999-1457: Buffer overflow in thttpd HTTP server before 2.04-31 allows remote attackers to execute arbitrary commands via a long date string, which is not properly handled by the tdate_parse function.
Key phrases: execute arbitrary commands, execute arbitrary commands via a long date string, buffer overflow
CVE-1999-1458: Buffer overflow in at program in Digital UNIX 4.0 allows local users to gain root privileges via a long command line argument.
Key phrases: gain root privileges, gain root privileges via a long command line, buffer overflow
CVE-1999-1459: BMC PATROL Agent before 3.2.07 allows local users to gain root privileges via a symlink attack on a temporary file.
Key phrases: gain root privileges, gain root privileges via a symlink attack on, temporary file
CVE-1999-1460: BMC PATROL SNMP Agent before 3.2.07 allows local users to create arbitrary world-writeable files as root by specifying the target file as the second argument to the snmpmagt program.
Key phrases: create arbitrary world, create arbitrary world-writeable files as root
CVE-1999-1461: inpview in InPerson on IRIX 5.3 through IRIX 6.5.10 trusts the PATH environmental variable to find and execute the ttsession program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse ttsession program.
Key phrases: obtain root access, obtain root access by modifying the PATH to
CVE-1999-1462: Vulnerability in bb-hist.sh CGI History module in Big Brother 1.09b and 1.09c allows remote attackers to read portions of arbitrary files.
Key phrases: read portions of arbitrary files
CVE-1999-1463: Windows NT 4.0 before SP3 allows remote attackers to bypass firewall restrictions or cause a denial of service (crash) by sending improperly fragmented IP packets without the first fragment, which the TCP/IP stack incorrectly reassembles into a valid session.
Key phrases: denial of service (crash), bypass firewall restrictions, bypass firewall restrictions or cause a denial of
CVE-1999-1464: Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabled, as described by Cisco bug CSCdk35564.
Key phrases: bypass certain access control, bypass certain access control lists when the router
CVE-1999-1465: Vulnerability in Cisco IOS 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical subinterface, as described by Cisco bug CSCdk43862.
Key phrases: bypass certain access control, bypass certain access control lists when the router
CVE-1999-1466: Vulnerability in Cisco routers versions 8.2 through 9.1 allows remote attackers to bypass access control lists when extended IP access lists are used on certain interfaces, the IP route cache is enabled, and the access list uses the "established" keyword.
Key phrases: bypass access control, bypass access control lists when extended IP access
CVE-1999-1467: Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root, possibly related to the configuration of the nobody user.
Key phrases: execute arbitrary commands, execute arbitrary commands as root
CVE-1999-1468: rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.
Key phrases: gain root privileges, gain root privileges by modifying the IFS (
CVE-1999-1469: Buffer overflow in w3-auth CGI program in miniSQL package allows remote attackers to execute arbitrary commands via an HTTP request with (1) a long URL, or (2) a long User-Agent MIME header.
Key phrases: execute arbitrary commands, execute arbitrary commands via an HTTP request with, buffer overflow
CVE-1999-1470: Eastman Work Management 3.21 stores passwords in cleartext in the COMMON and LOCATOR registry keys, which could allow local users to gain privileges.
Key phrases: gain privileges, cleartext
CVE-1999-1471: Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.
Key phrases: gain root privileges, gain root privileges by specifying a long shell, buffer overflow
CVE-1999-1472: Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynamic HTML (DHTML) to send the data to the attacker, aka the Freiburg text-viewing issue.
Key phrases: read arbitrary text, read arbitrary text and HTML files on the, freiburg text-viewing issue
CVE-1999-1473: When a Web site redirects the browser to another site, Internet Explorer 3.02 and 4.0 automatically resends authentication information to the second site, aka the "Page Redirect Issue."
Key phrases: page redirect issue