CVE-1999-1049

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

ARCserve NT agents use weak encryption (XOR) for passwords, which allows remote attackers to sniff the authentication request to port 6050 and decrypt the password.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

No affected versions have been published.

Timeline

Published: Feb 21, 1999
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 1999

CVE-1999-10505.0Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot do CVE-1999-10515.0Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts acce CVE-1999-10525.0Microsoft FrontPage stores form results in a default location in /_private/form_results.txt, which is world-readable and accessible in the d CVE-1999-10537.5guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to exec CVE-1999-10557.5Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by CVE-1999-10587.5Buffer overflow in Vermillion FTP Daemon VFTPD 1.23 allows remote attackers to cause a denial of service, and possibly execute arbitrary com CVE-1999-10605.0Buffer overflow in Tetrix TetriNet daemon 1.13.16 allows remote attackers to cause a denial of service and possibly execute arbitrary comman CVE-1999-106310.0CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.CVE-1999-106410.0Multiple buffer overflows in WindowMaker 0.52 through 0.60.0 allow attackers to cause a denial of service and possibly execute arbitrary com CVE-1999-10657.5Palm Pilot HotSync Manager 3.0.4 in Windows 98 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands CVE-1999-10665.0Quake 1 server responds to an initial UDP game connection request with a large amount of traffic, which allows remote attackers to use the s CVE-1999-10747.5Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attacker