# CVEs published 1999-09-29

320 CVEs were published on September 29, 1999: 3 critical, 12 high. Days are UTC.

- [CVE-1999-0073](https://cve.now/CVE-1999-0073.md): Telnet allows a remote client to specify environment variables including LD\_LIBRARY\_PATH, allowing an attacker to bypass the normal system l (no CVSS)
- [CVE-1999-0002](https://cve.now/CVE-1999-0002.md): Buffer overflow in NFS mountd gives root access to remote attackers, mostly in Linux systems. (no CVSS)
- [CVE-1999-0003](https://cve.now/CVE-1999-0003.md): Execute commands as root via buffer overflow in Tooltalk database server (rpc.ttdbserverd). (no CVSS)
- [CVE-1999-0005](https://cve.now/CVE-1999-0005.md): Arbitrary command execution via IMAP buffer overflow in authenticate command. (no CVSS)
- [CVE-1999-0006](https://cve.now/CVE-1999-0006.md): Buffer overflow in POP servers based on BSD/Qualcomm's qpopper allows remote attackers to gain root access using a long PASS command. (CVSS 9.8)
- [CVE-1999-0007](https://cve.now/CVE-1999-0007.md): Information from SSL-encrypted sessions via PKCS #1. (no CVSS)
- [CVE-1999-0008](https://cve.now/CVE-1999-0008.md): Buffer overflow in NIS+, in Sun's rpc.nisd program. (no CVSS)
- [CVE-1999-0009](https://cve.now/CVE-1999-0009.md): Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. (no CVSS)
- [CVE-1999-0010](https://cve.now/CVE-1999-0010.md): Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages. (no CVSS)
- [CVE-1999-0011](https://cve.now/CVE-1999-0011.md): Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer. (CVSS 5.4)
- [CVE-1999-0012](https://cve.now/CVE-1999-0012.md): Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names. (CVSS 7.0)
- [CVE-1999-0013](https://cve.now/CVE-1999-0013.md): Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent u (CVSS 8.4)
- [CVE-1999-0014](https://cve.now/CVE-1999-0014.md): Unauthorized privileged access or denial of service via dtappgather program in CDE. (no CVSS)
- [CVE-1999-0016](https://cve.now/CVE-1999-0016.md): Land IP denial of service. (no CVSS)
- [CVE-1999-0017](https://cve.now/CVE-1999-0017.md): FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce. (no CVSS)
- [CVE-1999-0018](https://cve.now/CVE-1999-0018.md): Buffer overflow in statd allows root privileges. (no CVSS)
- [CVE-1999-0019](https://cve.now/CVE-1999-0019.md): Delete or create a file via rpc.statd, due to invalid information. (no CVSS)
- [CVE-1999-0021](https://cve.now/CVE-1999-0021.md): Arbitrary command execution via buffer overflow in Count.cgi (wwwcount) cgi-bin program. (no CVSS)
- [CVE-1999-0022](https://cve.now/CVE-1999-0022.md): Local user gains root privileges via buffer overflow in rdist, via expstr() function. (CVSS 7.8)
- [CVE-1999-0023](https://cve.now/CVE-1999-0023.md): Local user gains root privileges via buffer overflow in rdist, via lookup() function. (no CVSS)
- [CVE-1999-0024](https://cve.now/CVE-1999-0024.md): DNS cache poisoning via BIND, by predictable query IDs. (no CVSS)
- [CVE-1999-0025](https://cve.now/CVE-1999-0025.md): root privileges via buffer overflow in df command on SGI IRIX systems. (no CVSS)
- [CVE-1999-0026](https://cve.now/CVE-1999-0026.md): root privileges via buffer overflow in pset command on SGI IRIX systems. (no CVSS)
- [CVE-1999-0027](https://cve.now/CVE-1999-0027.md): root privileges via buffer overflow in eject command on SGI IRIX systems. (no CVSS)
- [CVE-1999-0028](https://cve.now/CVE-1999-0028.md): root privileges via buffer overflow in login/scheme command on SGI IRIX systems. (no CVSS)
- [CVE-1999-0029](https://cve.now/CVE-1999-0029.md): root privileges via buffer overflow in ordist command on SGI IRIX systems. (CVSS 8.4)
- [CVE-1999-0032](https://cve.now/CVE-1999-0032.md): Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C (cl (no CVSS)
- [CVE-1999-0034](https://cve.now/CVE-1999-0034.md): Buffer overflow in suidperl (sperl), Perl 4.x and 5.x. (no CVSS)
- [CVE-1999-0035](https://cve.now/CVE-1999-0035.md): Race condition in signal handling routine in ftpd, allowing read/write arbitrary files. (CVSS 5.4)
- [CVE-1999-0036](https://cve.now/CVE-1999-0036.md): IRIX login program with a nonzero LOCKOUT parameter allows creation or damage to files. (CVSS 8.4)
- [CVE-1999-0037](https://cve.now/CVE-1999-0037.md): Arbitrary command execution via metamail package using message headers, when user processes attacker's message using metamail. (no CVSS)
- [CVE-1999-0038](https://cve.now/CVE-1999-0038.md): Buffer overflow in xlock program allows local users to execute commands as root. (CVSS 8.4)
- [CVE-1999-0039](https://cve.now/CVE-1999-0039.md): webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc (CVSS 7.3)
- [CVE-1999-0040](https://cve.now/CVE-1999-0040.md): Buffer overflow in Xt library of X Windowing System allows local users to execute commands with root privileges. (no CVSS)
- [CVE-1999-0041](https://cve.now/CVE-1999-0041.md): Buffer overflow in NLS (Natural Language Service). (no CVSS)
- [CVE-1999-0042](https://cve.now/CVE-1999-0042.md): Buffer overflow in University of Washington's implementation of IMAP and POP servers. (no CVSS)
- [CVE-1999-0043](https://cve.now/CVE-1999-0043.md): Command execution via shell metachars in INN daemon (innd) 1.5 using "newgroup" and "rmgroup" control messages, and others. (CVSS 9.8)
- [CVE-1999-0044](https://cve.now/CVE-1999-0044.md): fsdump command in IRIX allows local users to obtain root access by modifying sensitive files. (no CVSS)
- [CVE-1999-0045](https://cve.now/CVE-1999-0045.md): List of arbitrary files on Web host via nph-test-cgi script. (no CVSS)
- [CVE-1999-0046](https://cve.now/CVE-1999-0046.md): Buffer overflow of rlogin program using TERM environmental variable. (no CVSS)
- [CVE-1999-0047](https://cve.now/CVE-1999-0047.md): MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. (no CVSS)
- [CVE-1999-0048](https://cve.now/CVE-1999-0048.md): Talkd, when given corrupt DNS information, can be used to execute arbitrary commands with root privileges. (no CVSS)
- [CVE-1999-0049](https://cve.now/CVE-1999-0049.md): Csetup under IRIX allows arbitrary file creation or overwriting. (no CVSS)
- [CVE-1999-0050](https://cve.now/CVE-1999-0050.md): Buffer overflow in HP-UX newgrp program. (no CVSS)
- [CVE-1999-0051](https://cve.now/CVE-1999-0051.md): Arbitrary file creation and program execution using FLEXlm LicenseManager, from versions 4.0 to 5.0, in IRIX. (no CVSS)
- [CVE-1999-0052](https://cve.now/CVE-1999-0052.md): IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash. (CVSS 7.5)
- [CVE-1999-0053](https://cve.now/CVE-1999-0053.md): TCP RST denial of service in FreeBSD. (no CVSS)
- [CVE-1999-0054](https://cve.now/CVE-1999-0054.md): Sun's ftpd daemon can be subjected to a denial of service. (no CVSS)
- [CVE-1999-0055](https://cve.now/CVE-1999-0055.md): Buffer overflows in Sun libnsl allow root access. (no CVSS)
- [CVE-1999-0056](https://cve.now/CVE-1999-0056.md): Buffer overflow in Sun's ping program can give root access to local users. (no CVSS)
- [CVE-1999-0057](https://cve.now/CVE-1999-0057.md): Vacation program allows command execution by remote users through a sendmail command. (no CVSS)
- [CVE-1999-0058](https://cve.now/CVE-1999-0058.md): Buffer overflow in PHP cgi program, php.cgi allows shell access. (no CVSS)
- [CVE-1999-0059](https://cve.now/CVE-1999-0059.md): IRIX fam service allows an attacker to obtain a list of all files on the server. (CVSS 7.3)
- [CVE-1999-0060](https://cve.now/CVE-1999-0060.md): Attackers can cause a denial of service in Ascend MAX and Pipeline routers with a malformed packet to the discard port, which is used by the (no CVSS)
- [CVE-1999-0062](https://cve.now/CVE-1999-0062.md): The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage. (no CVSS)
- [CVE-1999-0063](https://cve.now/CVE-1999-0063.md): Cisco IOS 12.0 and other versions can be crashed by malicious UDP packets to the syslog port. (no CVSS)
- [CVE-1999-0064](https://cve.now/CVE-1999-0064.md): Buffer overflow in AIX lquerylv program gives root access to local users. (no CVSS)
- [CVE-1999-0065](https://cve.now/CVE-1999-0065.md): Multiple buffer overflows in how dtmail handles attachments allows a remote attacker to execute commands. (no CVSS)
- [CVE-1999-0066](https://cve.now/CVE-1999-0066.md): AnyForm CGI remote execution. (CVSS 9.8)
- [CVE-1999-0067](https://cve.now/CVE-1999-0067.md): phf CGI program allows remote command execution through shell metacharacters. (no CVSS)
- [CVE-1999-0068](https://cve.now/CVE-1999-0068.md): CGI PHP mylog script allows an attacker to read any file on the target server. (no CVSS)
- [CVE-1999-0069](https://cve.now/CVE-1999-0069.md): Solaris ufsrestore buffer overflow. (CVSS 8.4)
- [CVE-1999-0070](https://cve.now/CVE-1999-0070.md): test-cgi program allows an attacker to list files on the server. (no CVSS)
- [CVE-1999-0071](https://cve.now/CVE-1999-0071.md): Apache httpd cookie buffer overflow for versions 1.1.1 and earlier. (no CVSS)
- [CVE-1999-0072](https://cve.now/CVE-1999-0072.md): Buffer overflow in AIX xdat gives root access to local users. (no CVSS)
- [CVE-1999-0074](https://cve.now/CVE-1999-0074.md): Listening TCP ports are sequentially allocated, allowing spoofing attacks. (no CVSS)
- [CVE-1999-0075](https://cve.now/CVE-1999-0075.md): PASV core dump in wu-ftpd daemon when attacker uses a QUOTE PASV command after specifying a username and password. (no CVSS)
- [CVE-1999-0077](https://cve.now/CVE-1999-0077.md): Predictable TCP sequence numbers allow spoofing. (no CVSS)
- [CVE-1999-0079](https://cve.now/CVE-1999-0079.md): Remote attackers can cause a denial of service in FTP by issuing multiple PASV commands, causing the server to run out of available ports. (no CVSS)
- [CVE-1999-0080](https://cve.now/CVE-1999-0080.md): Certain configurations of wu-ftp FTP server 2.4 use a \_PATH\_EXECPATH setting to a directory with dangerous commands, such as /bin, which all (no CVSS)
- [CVE-1999-0081](https://cve.now/CVE-1999-0081.md): wu-ftp allows files to be overwritten via the rnfr command. (no CVSS)
- [CVE-1999-0082](https://cve.now/CVE-1999-0082.md): CWD ~root command in ftpd allows root access. (no CVSS)
- [CVE-1999-0083](https://cve.now/CVE-1999-0083.md): getcwd() file descriptor leak in FTP. (no CVSS)
- [CVE-1999-0084](https://cve.now/CVE-1999-0084.md): Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0. (CVSS 8.4)
- [CVE-1999-0085](https://cve.now/CVE-1999-0085.md): Buffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long h (no CVSS)
- [CVE-1999-0087](https://cve.now/CVE-1999-0087.md): Denial of service in AIX telnet can freeze a system and prevent users from accessing the server. (no CVSS)
- [CVE-1999-0090](https://cve.now/CVE-1999-0090.md): Buffer overflow in AIX rcp command allows local users to obtain root access. (no CVSS)
- [CVE-1999-0091](https://cve.now/CVE-1999-0091.md): Buffer overflow in AIX writesrv command allows local users to obtain root access. (no CVSS)
- [CVE-1999-0093](https://cve.now/CVE-1999-0093.md): AIX nslookup command allows local users to obtain root access by not dropping privileges correctly. (no CVSS)
- [CVE-1999-0094](https://cve.now/CVE-1999-0094.md): AIX piodmgrsu command allows local users to gain additional group privileges. (no CVSS)
- [CVE-1999-0095](https://cve.now/CVE-1999-0095.md): The debug command in Sendmail is enabled, allowing attackers to execute commands as root. (no CVSS)
- [CVE-1999-0096](https://cve.now/CVE-1999-0096.md): Sendmail decode alias can be used to overwrite sensitive files. (no CVSS)
- [CVE-1999-0097](https://cve.now/CVE-1999-0097.md): The AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. (no CVSS)
- [CVE-1999-0099](https://cve.now/CVE-1999-0099.md): Buffer overflow in syslog utility allows local or remote attackers to gain root privileges. (no CVSS)
- [CVE-1999-0100](https://cve.now/CVE-1999-0100.md): Remote access in AIX innd 1.5.1, using control messages. (no CVSS)
- [CVE-1999-0102](https://cve.now/CVE-1999-0102.md): Buffer overflow in SLmail 3.x allows attackers to execute commands using a large FROM line. (no CVSS)
- [CVE-1999-0103](https://cve.now/CVE-1999-0103.md): Echo and chargen, or other combinations of UDP services, can be used in tandem to flood the server, a.k.a. (no CVSS)
- [CVE-1999-0108](https://cve.now/CVE-1999-0108.md): The printers program in IRIX has a buffer overflow that gives root access to local users. (no CVSS)
- [CVE-1999-0109](https://cve.now/CVE-1999-0109.md): Buffer overflow in ffbconfig in Solaris 2.5.1. (no CVSS)
- [CVE-1999-0111](https://cve.now/CVE-1999-0111.md): RIP v1 is susceptible to spoofing. (no CVSS)
- [CVE-1999-0112](https://cve.now/CVE-1999-0112.md): Buffer overflow in AIX dtterm program for the CDE. (no CVSS)
- [CVE-1999-0113](https://cve.now/CVE-1999-0113.md): Some implementations of rlogin allow root access if given a -froot parameter. (no CVSS)
- [CVE-1999-0116](https://cve.now/CVE-1999-0116.md): Denial of service when an attacker sends many SYN packets to create multiple connections without ever sending an ACK to complete the connect (no CVSS)
- [CVE-1999-0117](https://cve.now/CVE-1999-0117.md): AIX passwd allows local users to gain root access. (no CVSS)
- [CVE-1999-0120](https://cve.now/CVE-1999-0120.md): Sun/Solaris utmp file allows local users to gain root access if it is writable by users other than root. (no CVSS)
- [CVE-1999-0122](https://cve.now/CVE-1999-0122.md): Buffer overflow in AIX lchangelv gives root access. (no CVSS)
- [CVE-1999-0125](https://cve.now/CVE-1999-0125.md): Buffer overflow in SGI IRIX mailx program. (no CVSS)
- [CVE-1999-0126](https://cve.now/CVE-1999-0126.md): SGI IRIX buffer overflow in xterm and Xaw allows root access. (no CVSS)
- [CVE-1999-0128](https://cve.now/CVE-1999-0128.md): Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death. (no CVSS)
- [CVE-1999-0129](https://cve.now/CVE-1999-0129.md): Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file. (no CVSS)
- [CVE-1999-0130](https://cve.now/CVE-1999-0130.md): Local users can start Sendmail in daemon mode and gain root privileges. (no CVSS)
- [CVE-1999-0131](https://cve.now/CVE-1999-0131.md): Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users. (no CVSS)
- [CVE-1999-0132](https://cve.now/CVE-1999-0132.md): Expreserve, as used in vi and ex, allows local users to overwrite arbitrary files and gain root access. (no CVSS)
- [CVE-1999-0133](https://cve.now/CVE-1999-0133.md): fm\_fls license server for Adobe Framemaker allows local users to overwrite arbitrary files and gain root access. (no CVSS)
- [CVE-1999-0134](https://cve.now/CVE-1999-0134.md): vold in Solaris 2.x allows local users to gain root access. (no CVSS)
- [CVE-1999-0135](https://cve.now/CVE-1999-0135.md): admintool in Solaris allows a local user to write to arbitrary files and gain root access. (no CVSS)
- [CVE-1999-0136](https://cve.now/CVE-1999-0136.md): Kodak Color Management System (KCMS) on Solaris allows a local user to write to arbitrary files and gain root access. (no CVSS)
- [CVE-1999-0137](https://cve.now/CVE-1999-0137.md): The dip program on many Linux systems allows local users to gain root access via a buffer overflow. (no CVSS)
- [CVE-1999-0138](https://cve.now/CVE-1999-0138.md): The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access. (no CVSS)
- [CVE-1999-0139](https://cve.now/CVE-1999-0139.md): Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access. (no CVSS)
- [CVE-1999-0141](https://cve.now/CVE-1999-0141.md): Java Bytecode Verifier allows malicious applets to execute arbitrary commands as the user of the applet. (no CVSS)
- [CVE-1999-0143](https://cve.now/CVE-1999-0143.md): Kerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys. (no CVSS)
- [CVE-1999-0146](https://cve.now/CVE-1999-0146.md): The campas CGI program provided with some NCSA web servers allows an attacker to execute arbitrary commands via encoded carriage return char (no CVSS)
- [CVE-1999-0147](https://cve.now/CVE-1999-0147.md): The aglimpse CGI program of the Glimpse package allows remote execution of arbitrary commands. (no CVSS)
- [CVE-1999-0148](https://cve.now/CVE-1999-0148.md): The handler CGI program in IRIX allows arbitrary command execution. (no CVSS)
- [CVE-1999-0149](https://cve.now/CVE-1999-0149.md): The wrap CGI program in IRIX allows remote attackers to view arbitrary directory listings via a .. (no CVSS)
- [CVE-1999-0150](https://cve.now/CVE-1999-0150.md): The Perl fingerd program allows arbitrary command execution from remote users. (no CVSS)
- [CVE-1999-0152](https://cve.now/CVE-1999-0152.md): The DG/UX finger daemon allows remote command execution through shell metacharacters. (no CVSS)
- [CVE-1999-0153](https://cve.now/CVE-1999-0153.md): Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke. (no CVSS)
- [CVE-1999-0155](https://cve.now/CVE-1999-0155.md): The ghostscript command with the -dSAFER option allows remote attackers to execute commands. (no CVSS)
- [CVE-1999-0157](https://cve.now/CVE-1999-0157.md): Cisco PIX firewall and CBAC IP fragmentation attack results in a denial of service. (no CVSS)
- [CVE-1999-0158](https://cve.now/CVE-1999-0158.md): Cisco PIX firewall manager (PFM) on Windows NT allows attackers to connect to port 8080 on the PFM server and retrieve any file whose name a (no CVSS)
- [CVE-1999-0159](https://cve.now/CVE-1999-0159.md): Attackers can crash a Cisco IOS router or device, provided they can get to an interactive prompt (such as a login). (CVSS 3.5)
- [CVE-1999-0160](https://cve.now/CVE-1999-0160.md): Some classic Cisco IOS devices have a vulnerability in the PPP CHAP authentication to establish unauthorized PPP connections. (no CVSS)
- [CVE-1999-0161](https://cve.now/CVE-1999-0161.md): In Cisco IOS 10.3, with the tacacs-ds or tacacs keyword, an extended IP access control list could bypass filtering. (no CVSS)
- [CVE-1999-0162](https://cve.now/CVE-1999-0162.md): The "established" keyword in some Cisco IOS software allowed an attacker to bypass filtering. (no CVSS)
- [CVE-1999-0164](https://cve.now/CVE-1999-0164.md): A race condition in the Solaris ps command allows an attacker to overwrite critical files. (no CVSS)
- [CVE-1999-0166](https://cve.now/CVE-1999-0166.md): NFS allows users to use a "cd .." command to access other directories besides the exported file system. (no CVSS)
- [CVE-1999-0167](https://cve.now/CVE-1999-0167.md): In SunOS, NFS file handles could be guessed, giving unauthorized access to the exported file system. (no CVSS)
- [CVE-1999-0168](https://cve.now/CVE-1999-0168.md): The portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, pos (no CVSS)
- [CVE-1999-0170](https://cve.now/CVE-1999-0170.md): Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list. (no CVSS)
- [CVE-1999-0172](https://cve.now/CVE-1999-0172.md): FormMail CGI program allows remote execution of commands. (no CVSS)
- [CVE-1999-0173](https://cve.now/CVE-1999-0173.md): FormMail CGI program can be used by web servers other than the host server that the program resides on. (no CVSS)
- [CVE-1999-0174](https://cve.now/CVE-1999-0174.md): The view-source CGI program allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-1999-0175](https://cve.now/CVE-1999-0175.md): The convert.bas program in the Novell web server allows a remote attackers to read any file on the system that is internally accessible by t (no CVSS)
- [CVE-1999-0176](https://cve.now/CVE-1999-0176.md): The Webgais program allows a remote user to execute arbitrary commands. (no CVSS)
- [CVE-1999-0177](https://cve.now/CVE-1999-0177.md): The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs. (no CVSS)
- [CVE-1999-0178](https://cve.now/CVE-1999-0178.md): Buffer overflow in the win-c-sample program (win-c-sample.exe) in the WebSite web server 1.1e allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-1999-0179](https://cve.now/CVE-1999-0179.md): Windows NT crashes or locks up when a Samba client executes a "cd .." command on a file share. (no CVSS)
- [CVE-1999-0180](https://cve.now/CVE-1999-0180.md): in.rshd allows users to login with a NULL username and execute commands. (no CVSS)
- [CVE-1999-0181](https://cve.now/CVE-1999-0181.md): The wall daemon can be used for denial of service, social engineering attacks, or to execute remote commands. (no CVSS)
- [CVE-1999-0182](https://cve.now/CVE-1999-0182.md): Samba has a buffer overflow which allows a remote attacker to obtain root access by specifying a long password. (no CVSS)
- [CVE-1999-0183](https://cve.now/CVE-1999-0183.md): Linux implementations of TFTP would allow access to files outside the restricted directory. (no CVSS)
- [CVE-1999-0184](https://cve.now/CVE-1999-0184.md): When compiled with the -DALLOW\_UPDATES option, bind allows dynamic updates to the DNS server, allowing for malicious modification of DNS rec (no CVSS)
- [CVE-1999-0185](https://cve.now/CVE-1999-0185.md): In SunOS or Solaris, a remote user could connect from an FTP server's data port to an rlogin server on a host that trusts the FTP server, al (no CVSS)
- [CVE-1999-0188](https://cve.now/CVE-1999-0188.md): The passwd command in Solaris can be subjected to a denial of service. (no CVSS)
- [CVE-1999-0190](https://cve.now/CVE-1999-0190.md): Solaris rpcbind can be exploited to overwrite arbitrary files and gain root access. (no CVSS)
- [CVE-1999-0191](https://cve.now/CVE-1999-0191.md): IIS newdsn.exe CGI script allows remote users to overwrite files. (no CVSS)
- [CVE-1999-0192](https://cve.now/CVE-1999-0192.md): Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable. (no CVSS)
- [CVE-1999-0194](https://cve.now/CVE-1999-0194.md): Denial of service in in.comsat allows attackers to generate messages. (no CVSS)
- [CVE-1999-0196](https://cve.now/CVE-1999-0196.md): websendmail in Webgais 1.0 allows a remote user to access arbitrary files and execute arbitrary code via the receiver parameter ($VAR\_receiv (no CVSS)
- [CVE-1999-0201](https://cve.now/CVE-1999-0201.md): A quote cwd command on FTP servers can reveal the full path of the home directory of the "ftp" user. (no CVSS)
- [CVE-1999-0202](https://cve.now/CVE-1999-0202.md): The GNU tar command, when used in FTP sessions, may allow an attacker to execute arbitrary commands. (no CVSS)
- [CVE-1999-0204](https://cve.now/CVE-1999-0204.md): Sendmail 8.6.9 allows remote attackers to execute root commands, using ident. (no CVSS)
- [CVE-1999-0206](https://cve.now/CVE-1999-0206.md): MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access. (no CVSS)
- [CVE-1999-0207](https://cve.now/CVE-1999-0207.md): Remote attacker can execute commands through Majordomo using the Reply-To field and a "lists" command. (no CVSS)
- [CVE-1999-0208](https://cve.now/CVE-1999-0208.md): rpc.ypupdated (NIS) allows remote users to execute arbitrary commands. (no CVSS)
- [CVE-1999-0209](https://cve.now/CVE-1999-0209.md): The SunView (SunTools) selection\_svc facility allows remote users to read files. (no CVSS)
- [CVE-1999-0214](https://cve.now/CVE-1999-0214.md): Denial of service by sending forged ICMP unreachable packets. (no CVSS)
- [CVE-1999-0215](https://cve.now/CVE-1999-0215.md): Routed allows attackers to append data to files. (no CVSS)
- [CVE-1999-0217](https://cve.now/CVE-1999-0217.md): Malicious option settings in UDP packets could force a reboot in SunOS 4.1.3 systems. (no CVSS)
- [CVE-1999-0218](https://cve.now/CVE-1999-0218.md): Livingston portmaster machines could be rebooted via a series of commands. (no CVSS)
- [CVE-1999-0219](https://cve.now/CVE-1999-0219.md): Buffer overflow in FTP Serv-U 2.5 allows remote authenticated users to cause a denial of service (crash) via a long (1) CWD or (2) LS (list) (no CVSS)
- [CVE-1999-0221](https://cve.now/CVE-1999-0221.md): Denial of service of Ascend routers through port 150 (remote administration). (no CVSS)
- [CVE-1999-0224](https://cve.now/CVE-1999-0224.md): Denial of service in Windows NT messenger service through a long username. (no CVSS)
- [CVE-1999-0227](https://cve.now/CVE-1999-0227.md): Access violation in LSASS.EXE (LSA/LSARPC) program in Windows NT allows a denial of service. (no CVSS)
- [CVE-1999-0228](https://cve.now/CVE-1999-0228.md): Denial of service in RPCSS.EXE program (RPC Locator) in Windows NT. (no CVSS)
- [CVE-1999-0230](https://cve.now/CVE-1999-0230.md): Buffer overflow in Cisco 7xx routers through the telnet service. (no CVSS)
- [CVE-1999-0234](https://cve.now/CVE-1999-0234.md): Bash treats any character with a value of 255 as a command separator. (no CVSS)
- [CVE-1999-0236](https://cve.now/CVE-1999-0236.md): ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. (no CVSS)
- [CVE-1999-0237](https://cve.now/CVE-1999-0237.md): Remote execution of arbitrary commands through Guestbook CGI program. (no CVSS)
- [CVE-1999-0239](https://cve.now/CVE-1999-0239.md): Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET. (no CVSS)
- [CVE-1999-0244](https://cve.now/CVE-1999-0244.md): Livingston RADIUS code has a buffer overflow which can allow remote execution of commands as root. (no CVSS)
- [CVE-1999-0245](https://cve.now/CVE-1999-0245.md): Some configurations of NIS+ in Linux allowed attackers to log in as the user "+". (no CVSS)
- [CVE-1999-0251](https://cve.now/CVE-1999-0251.md): Denial of service in talk program allows remote attackers to disrupt a user's display. (no CVSS)
- [CVE-1999-0252](https://cve.now/CVE-1999-0252.md): Buffer overflow in listserv allows arbitrary command execution. (no CVSS)
- [CVE-1999-0256](https://cve.now/CVE-1999-0256.md): Buffer overflow in War FTP allows remote execution of commands. (no CVSS)
- [CVE-1999-0260](https://cve.now/CVE-1999-0260.md): The jj CGI program allows command execution via shell metacharacters. (no CVSS)
- [CVE-1999-0262](https://cve.now/CVE-1999-0262.md): Hylafax faxsurvey CGI script on Linux allows remote attackers to execute arbitrary commands via shell metacharacters in the query string. (no CVSS)
- [CVE-1999-0263](https://cve.now/CVE-1999-0263.md): Solaris SUNWadmap can be exploited to obtain root access. (no CVSS)
- [CVE-1999-0264](https://cve.now/CVE-1999-0264.md): htmlscript CGI program allows remote read access to files. (no CVSS)
- [CVE-1999-0265](https://cve.now/CVE-1999-0265.md): ICMP redirect messages may crash or lock up a host. (no CVSS)
- [CVE-1999-0266](https://cve.now/CVE-1999-0266.md): The info2www CGI script allows remote file access or remote command execution. (no CVSS)
- [CVE-1999-0267](https://cve.now/CVE-1999-0267.md): Buffer overflow in NCSA HTTP daemon v1.3 allows remote command execution. (no CVSS)
- [CVE-1999-0269](https://cve.now/CVE-1999-0269.md): Netscape Enterprise servers may list files through the PageServices query. (no CVSS)
- [CVE-1999-0272](https://cve.now/CVE-1999-0272.md): Denial of service in Slmail v2.5 through the POP3 port. (no CVSS)
- [CVE-1999-0273](https://cve.now/CVE-1999-0273.md): Denial of service through Solaris 2.5.1 telnet by sending ^D characters. (no CVSS)
- [CVE-1999-0274](https://cve.now/CVE-1999-0274.md): Denial of service in Windows NT DNS servers through malicious packet which contains a response to a query that wasn't made. (no CVSS)
- [CVE-1999-0276](https://cve.now/CVE-1999-0276.md): mSQL v2.0.1 and below allows remote execution through a buffer overflow. (no CVSS)
- [CVE-1999-0277](https://cve.now/CVE-1999-0277.md): The WorkMan program can be used to overwrite any file to get root access. (no CVSS)
- [CVE-1999-0278](https://cve.now/CVE-1999-0278.md): In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. (no CVSS)
- [CVE-1999-0279](https://cve.now/CVE-1999-0279.md): Excite for Web Servers (EWS) allows remote command execution via shell metacharacters. (no CVSS)
- [CVE-1999-0281](https://cve.now/CVE-1999-0281.md): Denial of service in IIS using long URLs. (no CVSS)
- [CVE-1999-0288](https://cve.now/CVE-1999-0288.md): The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invali (no CVSS)
- [CVE-1999-0289](https://cve.now/CVE-1999-0289.md): The Apache web server for Win32 may provide access to restricted files when a . (no CVSS)
- [CVE-1999-0292](https://cve.now/CVE-1999-0292.md): Denial of service through Winpopup using large user names. (no CVSS)
- [CVE-1999-0293](https://cve.now/CVE-1999-0293.md): AAA authentication on Cisco systems allows attackers to execute commands without authorization. (no CVSS)
- [CVE-1999-0294](https://cve.now/CVE-1999-0294.md): All records in a WINS database can be deleted through SNMP for a denial of service. (no CVSS)
- [CVE-1999-0295](https://cve.now/CVE-1999-0295.md): Solaris sysdef command allows local users to read kernel memory, potentially leading to root privileges. (no CVSS)
- [CVE-1999-0296](https://cve.now/CVE-1999-0296.md): Solaris volrmmount program allows attackers to read any file. (no CVSS)
- [CVE-1999-0299](https://cve.now/CVE-1999-0299.md): Buffer overflow in FreeBSD lpd through long DNS hostnames. (no CVSS)
- [CVE-1999-0300](https://cve.now/CVE-1999-0300.md): nis\_cachemgr for Solaris NIS+ allows attackers to add malicious NIS+ servers. (no CVSS)
- [CVE-1999-0301](https://cve.now/CVE-1999-0301.md): Buffer overflow in SunOS/Solaris ps command. (no CVSS)
- [CVE-1999-0302](https://cve.now/CVE-1999-0302.md): SunOS/Solaris FTP clients can be forced to execute arbitrary commands from a malicious FTP server. (no CVSS)
- [CVE-1999-0303](https://cve.now/CVE-1999-0303.md): Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames. (no CVSS)
- [CVE-1999-0305](https://cve.now/CVE-1999-0305.md): The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, do (no CVSS)
- [CVE-1999-0308](https://cve.now/CVE-1999-0308.md): HP-UX gwind program allows users to modify arbitrary files. (no CVSS)
- [CVE-1999-0309](https://cve.now/CVE-1999-0309.md): HP-UX vgdisplay program gives root access to local users. (no CVSS)
- [CVE-1999-0310](https://cve.now/CVE-1999-0310.md): SSH 1.2.25 on HP-UX allows access to new user accounts. (no CVSS)
- [CVE-1999-0311](https://cve.now/CVE-1999-0311.md): fpkg2swpk in HP-UX allows local users to gain root access. (no CVSS)
- [CVE-1999-0312](https://cve.now/CVE-1999-0312.md): HP ypbind allows attackers with root privileges to modify NIS data. (no CVSS)
- [CVE-1999-0313](https://cve.now/CVE-1999-0313.md): disk\_bandwidth on SGI IRIX 6.4 S2MP for Origin/Onyx2 allows local users to gain root access using relative pathnames. (no CVSS)
- [CVE-1999-0314](https://cve.now/CVE-1999-0314.md): ioconfig on SGI IRIX 6.4 S2MP for Origin/Onyx2 allows local users to gain root access using relative pathnames. (no CVSS)
- [CVE-1999-0315](https://cve.now/CVE-1999-0315.md): Buffer overflow in Solaris fdformat command gives root access to local users. (no CVSS)
- [CVE-1999-0316](https://cve.now/CVE-1999-0316.md): Buffer overflow in Linux splitvt command gives root access to local users. (no CVSS)
- [CVE-1999-0320](https://cve.now/CVE-1999-0320.md): SunOS rpc.cmsd allows attackers to obtain root access by overwriting arbitrary files. (no CVSS)
- [CVE-1999-0321](https://cve.now/CVE-1999-0321.md): Buffer overflow in Solaris kcms\_configure command allows local users to gain root access. (no CVSS)
- [CVE-1999-0324](https://cve.now/CVE-1999-0324.md): ppl program in HP-UX allows local users to create root files through symlinks. (no CVSS)
- [CVE-1999-0325](https://cve.now/CVE-1999-0325.md): vhe\_u\_mnt program in HP-UX allows local users to create root files through symlinks. (no CVSS)
- [CVE-1999-0326](https://cve.now/CVE-1999-0326.md): Vulnerability in HP-UX mediainit program. (no CVSS)
- [CVE-1999-0327](https://cve.now/CVE-1999-0327.md): SGI syserr program allows local users to corrupt files. (no CVSS)
- [CVE-1999-0328](https://cve.now/CVE-1999-0328.md): SGI permissions program allows local users to gain root privileges. (no CVSS)
- [CVE-1999-0329](https://cve.now/CVE-1999-0329.md): SGI mediad program allows local users to gain root access. (no CVSS)
- [CVE-1999-0332](https://cve.now/CVE-1999-0332.md): Buffer overflow in NetMeeting allows denial of service and remote command execution. (no CVSS)
- [CVE-1999-0334](https://cve.now/CVE-1999-0334.md): In Solaris 2.2 and 2.3, when fsck fails on startup, it allows a local user with physical access to obtain root access. (no CVSS)
- [CVE-1999-0337](https://cve.now/CVE-1999-0337.md): AIX batch queue (bsh) allows local and remote users to gain additional privileges when network printing is enabled. (no CVSS)
- [CVE-1999-0338](https://cve.now/CVE-1999-0338.md): AIX Licensed Program Product performance tools allow local users to gain root access. (no CVSS)
- [CVE-1999-0339](https://cve.now/CVE-1999-0339.md): Buffer overflow in the libauth library in Solaris allows local users to gain additional privileges, possibly root access. (no CVSS)
- [CVE-1999-0340](https://cve.now/CVE-1999-0340.md): Buffer overflow in Linux Slackware crond program allows local users to gain root access. (no CVSS)
- [CVE-1999-0341](https://cve.now/CVE-1999-0341.md): Buffer overflow in the Linux mail program "deliver" allows local users to gain root access. (no CVSS)
- [CVE-1999-0342](https://cve.now/CVE-1999-0342.md): Linux PAM modules allow local users to gain root access using temporary files. (no CVSS)
- [CVE-1999-0344](https://cve.now/CVE-1999-0344.md): NT users can gain debug-level access on a system process using the Sechole exploit. (no CVSS)
- [CVE-1999-0346](https://cve.now/CVE-1999-0346.md): CGI PHP mlog script allows an attacker to read any file on the target server. (no CVSS)
- [CVE-1999-0348](https://cve.now/CVE-1999-0348.md): IIS ASP caching problem releases sensitive information when two virtual servers share the same physical directory. (no CVSS)
- [CVE-1999-0349](https://cve.now/CVE-1999-0349.md): A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of service and, in some cases, execute arb (no CVSS)
- [CVE-1999-0350](https://cve.now/CVE-1999-0350.md): Race condition in the db\_loader program in ClearCase gives local users root access by setting SUID bits. (no CVSS)
- [CVE-1999-0351](https://cve.now/CVE-1999-0351.md): FTP PASV "Pizza Thief" denial of service and unauthorized data access. (no CVSS)
- [CVE-1999-0353](https://cve.now/CVE-1999-0353.md): rpc.pcnfsd in HP gives remote root access by changing the permissions on the main printer spool directory. (no CVSS)
- [CVE-1999-0355](https://cve.now/CVE-1999-0355.md): Local or remote users can force ControlIT 4.5 to reboot or force a user to log out, resulting in a denial of service. (no CVSS)
- [CVE-1999-0357](https://cve.now/CVE-1999-0357.md): Windows 98 and other operating systems allows remote attackers to cause a denial of service via crafted "oshare" packets, possibly involving (no CVSS)
- [CVE-1999-0362](https://cve.now/CVE-1999-0362.md): WS\_FTP server remote denial of service through cwd command. (no CVSS)
- [CVE-1999-0363](https://cve.now/CVE-1999-0363.md): SuSE 5.2 PLP lpc program has a buffer overflow that leads to root compromise. (no CVSS)
- [CVE-1999-0365](https://cve.now/CVE-1999-0365.md): The metamail package allows remote command execution using shell metacharacters that are not quoted in a mailcap entry. (no CVSS)
- [CVE-1999-0366](https://cve.now/CVE-1999-0366.md): In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT (no CVSS)
- [CVE-1999-0367](https://cve.now/CVE-1999-0367.md): NetBSD netstat command allows local users to access kernel memory. (no CVSS)
- [CVE-1999-0368](https://cve.now/CVE-1999-0368.md): Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. (no CVSS)
- [CVE-1999-0369](https://cve.now/CVE-1999-0369.md): The Sun sdtcm\_convert calendar utility for OpenWindows has a buffer overflow which can gain root access. (no CVSS)
- [CVE-1999-0371](https://cve.now/CVE-1999-0371.md): Lynx allows a local user to overwrite sensitive files through /tmp symlinks. (no CVSS)
- [CVE-1999-0372](https://cve.now/CVE-1999-0372.md): The installer for BackOffice Server includes account names and passwords in a setup file (reboot.ini) which is not deleted. (no CVSS)
- [CVE-1999-0373](https://cve.now/CVE-1999-0373.md): Buffer overflow in the "Super" utility in Debian GNU/Linux, and other operating systems, allows local users to execute commands as root. (no CVSS)
- [CVE-1999-0374](https://cve.now/CVE-1999-0374.md): Debian GNU/Linux cfengine package is susceptible to a symlink attack. (no CVSS)
- [CVE-1999-0375](https://cve.now/CVE-1999-0375.md): Buffer overflow in webd in Network Flight Recorder (NFR) 2.0.2-Research allows remote attackers to execute commands. (no CVSS)
- [CVE-1999-0376](https://cve.now/CVE-1999-0376.md): Local users in Windows NT can obtain administrator privileges by changing the KnownDLLs list to reference malicious programs. (no CVSS)
- [CVE-1999-0377](https://cve.now/CVE-1999-0377.md): Process table attack in Unix systems allows a remote attacker to perform a denial of service by filling a machine's process tables through m (no CVSS)
- [CVE-1999-0379](https://cve.now/CVE-1999-0379.md): Microsoft Taskpads allows remote web sites to execute commands on the visiting user's machine via certain methods that are marked as Safe fo (no CVSS)
- [CVE-1999-0382](https://cve.now/CVE-1999-0382.md): The screen saver in Windows NT does not verify that its security context has been changed properly, allowing attackers to run programs with (no CVSS)
- [CVE-1999-0383](https://cve.now/CVE-1999-0383.md): ACC Tigris allows public access without a login. (no CVSS)
- [CVE-1999-0384](https://cve.now/CVE-1999-0384.md): The Forms 2.0 ActiveX control (included with Visual Basic for Applications 5.0) can be used to read text from a user's clipboard when the us (no CVSS)
- [CVE-1999-0385](https://cve.now/CVE-1999-0385.md): The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute command (no CVSS)
- [CVE-1999-0386](https://cve.now/CVE-1999-0386.md): Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read files on the server (no CVSS)
- [CVE-1999-0388](https://cve.now/CVE-1999-0388.md): DataLynx suGuard trusts the PATH environment variable to execute the ps command, allowing local users to execute commands as root. (no CVSS)
- [CVE-1999-0391](https://cve.now/CVE-1999-0391.md): The cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response an (no CVSS)
- [CVE-1999-0392](https://cve.now/CVE-1999-0392.md): Buffer overflow in Thomas Boutell's cgic library version up to 1.05. (no CVSS)
- [CVE-1999-0396](https://cve.now/CVE-1999-0396.md): A race condition between the select() and accept() calls in NetBSD TCP servers allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-1999-0402](https://cve.now/CVE-1999-0402.md): wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself. (no CVSS)
- [CVE-1999-0404](https://cve.now/CVE-1999-0404.md): Buffer overflow in the Mail-Max SMTP server for Windows systems allows remote command execution. (no CVSS)
- [CVE-1999-0405](https://cve.now/CVE-1999-0405.md): A buffer overflow in lsof allows local users to obtain root privilege. (no CVSS)
- [CVE-1999-0410](https://cve.now/CVE-1999-0410.md): The cancel command in Solaris 2.6 (i386) has a buffer overflow that allows local users to obtain root access. (no CVSS)
- [CVE-1999-0412](https://cve.now/CVE-1999-0412.md): In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension. (no CVSS)
- [CVE-1999-0413](https://cve.now/CVE-1999-0413.md): A buffer overflow in the SGI X server allows local users to gain root access through the X server font path. (no CVSS)
- [CVE-1999-0414](https://cve.now/CVE-1999-0414.md): In Linux before version 2.0.36, remote attackers can spoof a TCP connection and pass data to the application layer before fully establishing (no CVSS)
- [CVE-1999-0417](https://cve.now/CVE-1999-0417.md): 64 bit Solaris 7 procfs allows local users to perform a denial of service. (no CVSS)
- [CVE-1999-0420](https://cve.now/CVE-1999-0420.md): umapfs allows local users to gain root privileges by changing their uid through a malicious mount\_umap program. (no CVSS)
- [CVE-1999-0422](https://cve.now/CVE-1999-0422.md): In some cases, NetBSD 1.3.3 mount allows local users to execute programs in some file systems that have the "noexec" flag set. (no CVSS)
- [CVE-1999-0423](https://cve.now/CVE-1999-0423.md): Vulnerability in hpterm on HP-UX 10.20 allows local users to gain additional privileges. (no CVSS)
- [CVE-1999-0424](https://cve.now/CVE-1999-0424.md): talkback in Netscape 4.5 allows a local user to overwrite arbitrary files of another user whose Netscape crashes. (no CVSS)
- [CVE-1999-0425](https://cve.now/CVE-1999-0425.md): talkback in Netscape 4.5 allows a local user to kill an arbitrary process of another user whose Netscape crashes. (no CVSS)
- [CVE-1999-0430](https://cve.now/CVE-1999-0430.md): Cisco Catalyst LAN switches running Catalyst 5000 supervisor software allows remote attackers to perform a denial of service by forcing the (no CVSS)
- [CVE-1999-0432](https://cve.now/CVE-1999-0432.md): ftp on HP-UX 11.00 allows local users to gain privileges. (no CVSS)
- [CVE-1999-0433](https://cve.now/CVE-1999-0433.md): XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing (no CVSS)
- [CVE-1999-0436](https://cve.now/CVE-1999-0436.md): Domain Enterprise Server Management System (DESMS) in HP-UX allows local users to gain privileges. (no CVSS)
- [CVE-1999-0437](https://cve.now/CVE-1999-0437.md): Remote attackers can perform a denial of service in WebRamp systems by sending a malicious string to the HTTP port. (no CVSS)
- [CVE-1999-0438](https://cve.now/CVE-1999-0438.md): Remote attackers can perform a denial of service in WebRamp systems by sending a malicious UDP packet to port 5353, changing its IP address. (no CVSS)
- [CVE-1999-0441](https://cve.now/CVE-1999-0441.md): Remote attackers can perform a denial of service in WinGate machines using a buffer overflow in the Winsock Redirector Service. (no CVSS)
- [CVE-1999-0442](https://cve.now/CVE-1999-0442.md): Solaris ff.core allows local users to modify files. (no CVSS)
- [CVE-1999-0445](https://cve.now/CVE-1999-0445.md): In Cisco routers under some versions of IOS 12.0 running NAT, some packets may not be filtered by input access list filters. (no CVSS)
- [CVE-1999-0446](https://cve.now/CVE-1999-0446.md): Local users can perform a denial of service in NetBSD 1.3.3 and earlier versions by creating an unusual symbolic link with the ln command, t (no CVSS)
- [CVE-1999-0447](https://cve.now/CVE-1999-0447.md): Local users can gain privileges using the debug utility in the MPE/iX operating system. (no CVSS)
- [CVE-1999-0448](https://cve.now/CVE-1999-0448.md): IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request (no CVSS)
- [CVE-1999-0449](https://cve.now/CVE-1999-0449.md): The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsea (no CVSS)
- [CVE-1999-0457](https://cve.now/CVE-1999-0457.md): Linux ftpwatch program allows local users to gain root privileges. (no CVSS)
- [CVE-1999-0458](https://cve.now/CVE-1999-0458.md): L0phtcrack 2.5 used temporary files in the system TEMP directory which could contain password information. (no CVSS)
- [CVE-1999-0463](https://cve.now/CVE-1999-0463.md): Remote attackers can perform a denial of service using IRIX fcagent. (no CVSS)
- [CVE-1999-0466](https://cve.now/CVE-1999-0466.md): The SVR4 /dev/wabi special device file in NetBSD 1.3.3 and earlier allows a local user to read or write arbitrary files on the disk associat (no CVSS)
- [CVE-1999-0468](https://cve.now/CVE-1999-0468.md): Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component. (CVSS 8.2)
- [CVE-1999-0471](https://cve.now/CVE-1999-0471.md): The remote proxy server in Winroute allows a remote attacker to reconfigure the proxy without authentication through the "cancel" button. (no CVSS)
- [CVE-1999-0472](https://cve.now/CVE-1999-0472.md): The SNMP default community name "public" is not properly removed in NetApps C630 Netcache, even if the administrator tries to disable it. (no CVSS)
- [CVE-1999-0473](https://cve.now/CVE-1999-0473.md): The rsync command before rsync 2.3.1 may inadvertently change the permissions of the client's working directory to the permissions of the di (no CVSS)
- [CVE-1999-0474](https://cve.now/CVE-1999-0474.md): The ICQ Webserver allows remote attackers to use .. (no CVSS)
- [CVE-1999-0475](https://cve.now/CVE-1999-0475.md): A race condition in how procmail handles .procmailrc files allows a local user to read arbitrary files available to the user who is running (no CVSS)
- [CVE-1999-0478](https://cve.now/CVE-1999-0478.md): Denial of service in HP-UX sendmail 8.8.6 related to accepting connections. (no CVSS)
- [CVE-1999-0479](https://cve.now/CVE-1999-0479.md): Denial of service Netscape Enterprise Server with VirtualVault on HP-UX VVOS systems. (no CVSS)
- [CVE-1999-0481](https://cve.now/CVE-1999-0481.md): Denial of service in "poll" in OpenBSD. (no CVSS)
- [CVE-1999-0482](https://cve.now/CVE-1999-0482.md): OpenBSD kernel crash through TSS handling, as caused by the crashme program. (no CVSS)
- [CVE-1999-0483](https://cve.now/CVE-1999-0483.md): OpenBSD crash using nlink value in FFS and EXT2FS filesystems. (no CVSS)
- [CVE-1999-0484](https://cve.now/CVE-1999-0484.md): Buffer overflow in OpenBSD ping. (no CVSS)
- [CVE-1999-0485](https://cve.now/CVE-1999-0485.md): Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD. (no CVSS)
- [CVE-1999-0487](https://cve.now/CVE-1999-0487.md): The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files. (no CVSS)
- [CVE-1999-0494](https://cve.now/CVE-1999-0494.md): Denial of service in WinGate proxy through a buffer overflow in POP3. (no CVSS)
- [CVE-1999-0496](https://cve.now/CVE-1999-0496.md): A Windows NT 4.0 user can gain administrative rights by forcing NtOpenProcessToken to succeed regardless of the user's permissions, aka GetA (no CVSS)
- [CVE-1999-0513](https://cve.now/CVE-1999-0513.md): ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service. (no CVSS)
- [CVE-1999-0514](https://cve.now/CVE-1999-0514.md): UDP messages to broadcast addresses are allowed, allowing for a Fraggle attack that can cause a denial of service by flooding the target. (no CVSS)
- [CVE-1999-0526](https://cve.now/CVE-1999-0526.md): An X server's access control is disabled (e.g. (no CVSS)
- [CVE-1999-0551](https://cve.now/CVE-1999-0551.md): HP OpenMail can be misconfigured to allow users to run arbitrary commands using malicious print requests. (no CVSS)
- [CVE-1999-0566](https://cve.now/CVE-1999-0566.md): An attacker can write to syslog files from any location, causing a denial of service by filling up the logs, and hiding activities. (no CVSS)
- [CVE-1999-0612](https://cve.now/CVE-1999-0612.md): A version of finger is running that exposes valid user information to any entity on the network. (no CVSS)
- [CVE-1999-0626](https://cve.now/CVE-1999-0626.md): A version of rusers is running that exposes valid user information to any entity on the network. (no CVSS)
- [CVE-1999-0627](https://cve.now/CVE-1999-0627.md): The rexd service is running, which uses weak authentication that can allow an attacker to execute commands. (no CVSS)
- [CVE-1999-0628](https://cve.now/CVE-1999-0628.md): The rwho/rwhod service is running, which exposes machine status and user information. (no CVSS)
- [CVE-1999-0211](https://cve.now/CVE-1999-0211.md): Extra long export lists over 256 characters in some mount daemons allows NFS directories to be mounted by anyone. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/1999-09-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.