CVE-1999-1377

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Matt Wright's download.cgi 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 9, 1999
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 1999

CVE-1999-13785.0dbmlparser.exe CGI guestbook program does not perform a chroot operation properly, which allows remote attackers to read arbitrary files.CVE-1999-13795.0DNS allows remote attackers to use DNS name servers as traffic amplifiers via a UDP DNS query with a spoofed source address, which produces CVE-1999-13827.2NetWare NFS mode 1 and 2 implements the "Read Only" flag in Unix by changing the ownership of a file to root, which allows local users to gaCVE-1999-13865.5Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via CVE-1999-13934.6Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security byCVE-1999-13942.1BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutable and append-only flags for fileCVE-1999-13977.5Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose perCVE-1999-14002.1The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the CVE-1999-140510.0snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directoCVE-1999-14125.0A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash)CVE-1999-14147.2IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs wCVE-1999-14185.0ICQ99 ICQ web server build 1701 with "Active Homepage" enabled generates allows remote attackers to determine the existence of files on the
CVE-1999-1377: Medium severity, CVSS 5.0 | Vulnix