2001 CVEs (page 2)
Page 2 of 16 — CVEs published in 2001, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2001-1514 | | 2001-12-31 | ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to (1)… | |
CVE-2001-1513 | | 2001-12-31 | Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the we… | |
CVE-2001-1512 | | 2001-12-31 | Unknown vulnerability in Allaire JRun 3.1 allows remote attackers to directly access the WEB-INF and META-INF directories and execute arbitrary JavaServer Page… | |
CVE-2001-1511 | | 2001-12-31 | JRun 3.0 and 3.1 running on JRun Web Server (JWS) and IIS allows remote attackers to read arbitrary JavaServer Pages (JSP) source code via a request URL contai… | |
CVE-2001-1510 | | 2001-12-31 | Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to r… | |
CVE-2001-1509 | | 2001-12-31 | geteuid in Itanium Architecture (IA) running on HP-UX 11.20 does not properly identify a user's effective user id, which could allow local users to gain privil… | |
CVE-2001-1508 | | 2001-12-31 | Buffer overflow in lpstat in SCO OpenServer 5.0 through 5.0.6a allows local users to execute arbitrary code as group bin via a long command line argument. | |
CVE-2001-1507 | | 2001-12-31 | OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged. | |
CVE-2001-1506 | | 2001-12-31 | Unknown vulnerability in the file system protection subsystem in HP Secure OS Software for Linux 1.0 allows additional user privileges on some files beyond wha… | |
CVE-2001-1505 | | 2001-12-31 | tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets. | |
CVE-2001-1504 | | 2001-12-31 | Lotus Notes R5 Client 4.6 allows remote attackers to execute arbitrary commands via a Lotus Notes object with code in an event, which is automatically executed… | |
CVE-2001-1503 | | 2001-12-31 | The finger daemon (in.fingerd) in Sun Solaris 2.5 through 8 and SunOS 5.5 through 5.8 allows remote attackers to list all accounts on a host by typing finger '… | |
CVE-2001-1502 | | 2001-12-31 | webcart.cgi in Mountain Network Systems WebCart 8.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEXTPAGE parameter. | |
CVE-2001-1501 | | 2001-12-31 | The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via comm… | |
CVE-2001-1500 | | 2001-12-31 | ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attack… | |
CVE-2001-1499 | | 2001-12-31 | Check Point VPN-1 4.1SP4 using SecuRemote returns different error messages for valid and invalid users, with prompts that vary depending on the authentication… | |
CVE-2001-1498 | | 2001-12-31 | Buffer overflow in mod_bf 0.2 allows local users to execute arbitrary commands via a long script. | |
CVE-2001-1497 | | 2001-12-31 | Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by… | |
CVE-2001-1496 | Critical | 9.8 | 2001-12-31 | Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of service and possibly exec… |
CVE-2001-1495 | | 2001-12-31 | network_query.php in Network Query Tool 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the target parameter. | |
CVE-2001-1494 | Medium | 5.5 | 2001-12-31 | script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any… |
CVE-2001-1491 | | 2001-12-31 | Opera 5.11 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images. | |
CVE-2001-1490 | | 2001-12-31 | Mozilla 0.9.6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images. | |
CVE-2001-1489 | | 2001-12-31 | Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of imag… | |
CVE-2001-1488 | | 2001-12-31 | Open Projects Network Internet Relay Chat (IRC) daemon u2.10.05.18 does not perform a double-reverse DNS lookup, which allows remote attackers to spoof any val… | |
CVE-2001-1487 | | 2001-12-31 | popauth utility in Qualcomm Qpopper 4.0 and earlier allows local users to overwrite arbitrary files and execute commands as the pop user via a symlink attack o… | |
CVE-2001-1484 | | 2001-12-31 | Alcatel ADSL modems allow remote attackers to access the Trivial File Transfer Protocol (TFTP) to modify firmware and configuration via a bounce attack from a… | |
CVE-2001-1483 | | 2001-12-31 | One-Time Passwords In Everything (a.k.a OPIE) 2.32 and 2.4 allows remote attackers to determine the existence of user accounts by printing random passphrases i… | |
CVE-2001-1482 | | 2001-12-31 | SQL injection vulnerability in bb_memberlist.php for phpBB 1.4.2 allows remote attackers to execute arbitrary SQL queries via the $sortby variable. | |
CVE-2001-1481 | Critical | 9.8 | 2001-12-31 | Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows re… |
CVE-2001-1480 | | 2001-12-31 | Java Runtime Environment (JRE) and SDK 1.2 through 1.3.0_04 allows untrusted applets to access the system clipboard. | |
CVE-2001-1479 | | 2001-12-31 | smcboot in Sun SMC (Sun Management Center) 2.0 in Solaris 8 allows local users to delete arbitrary files via a symlink attack on /tmp/smc$SMC_PORT. | |
CVE-2001-1478 | | 2001-12-31 | Buffer overflow in xlock in UnixWare 7.1.0 and 7.1.1 and Open Unix 8.0.0 allows local users to execute arbitrary code. | |
CVE-2001-1477 | | 2001-12-31 | The Domain gateway in BEA Tuxedo 7.1 does not perform authorization checks for imported services and qspaces on remote domains, even when an ACL exists, which… | |
CVE-2001-1211 | | 2001-12-31 | Ipswitch IMail 7.0.4 and earlier allows attackers with administrator privileges to read and modify user alias and mailing list information for other domains ho… | |
CVE-2001-1209 | | 2001-12-31 | Directory traversal vulnerability in zml.cgi allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. | |
CVE-2001-1208 | | 2001-12-31 | Format string vulnerability in DayDream BBS allows remote attackers to execute arbitrary code via format string specifiers in a file containing a ~#RA control… | |
CVE-2001-1466 | | 2001-12-30 | Buffer overflow in VanDyke SecureCRT before 3.4.2, when using the SSH-1 protocol, allows remote attackers to execute arbitrary code via a long (1) username or… | |
CVE-2001-1210 | | 2001-12-30 | Cisco ubr900 series routers that conform to the Data-over-Cable Service Interface Specifications (DOCSIS) standard must ship without SNMP access restrictions… | |
CVE-2001-1207 | | 2001-12-30 | Buffer overflows in DayDream BBS 2.9 through 2.13 allow remote attackers to possibly execute arbitrary code via the control codes (1) ~#MC, (2) ~#TF, or (3) ~#… | |
CVE-2001-1206 | | 2001-12-30 | Matrix CGI vault Last Lines 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the $error_log variable. | |
CVE-2001-1205 | | 2001-12-30 | Directory traversal vulnerability in lastlines.cgi for Last Lines 2.0 allows remote attackers to read arbitrary files via '..' sequences in the $error_log vari… | |
CVE-2001-1433 | | 2001-12-29 | Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain privileges via oth… | |
CVE-2001-1432 | | 2001-12-29 | Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. | |
CVE-2001-1204 | | 2001-12-28 | Directory traversal vulnerability in phprocketaddin in Total PC Solutions PHP Rocket Add-in for FrontPage 1.0 allows remote attackers to read arbitrary files v… | |
CVE-2001-1202 | | 2001-12-28 | Cross-site scripting vulnerability in DeleGate 7.7.0 and 7.7.1 does not quote scripting commands within a "403 Forbidden" error page, which allows remote attac… | |
CVE-2001-1352 | | 2001-12-27 | Cross-site scripting vulnerability in Namazu 2.0.9 and earlier allows remote attackers to execute arbitrary Javascript as other web users via an error message… | |
CVE-2001-1203 | | 2001-12-27 | Format string vulnerability in gpm-root in gpm 1.17.8 through 1.17.18 allows local users to gain root privileges. | |
CVE-2001-1225 | | 2001-12-26 | Hughes Technology Mini SQL 2.0.10 through 2.0.12 allows local users to cause a denial of service by creating a very large array in a table, which causes miniSQ… | |
CVE-2001-1223 | | 2001-12-26 | The web administration server for ELSA Lancom 1100 Office does not require authentication, which allows arbitrary remote attackers to gain administrative privi… | |
CVE-2001-1351 | | 2001-12-25 | Cross-site scripting vulnerability in Namazu 2.0.8 and earlier allows remote attackers to execute arbitrary Javascript as other web users via the index file na… | |
CVE-2001-1226 | | 2001-12-25 | AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database. | |
CVE-2001-1224 | | 2001-12-23 | get_input in adrotate.pm for Les VanBrunt AdRotate Pro 2.0 allows remote attackers to modify the database and possibly execute arbitrary commands via a SQL cod… | |
CVE-2001-1440 | | 2001-12-21 | Unknown vulnerability in login for AIX 5.1L, when using loadable authentication modules, allows remote attackers to gain access to the system. | |
CVE-2001-1221 | | 2001-12-21 | D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point uses a default SNMP community string of 'public' which allows remote attackers to gain sensiti… | |
CVE-2001-1220 | | 2001-12-21 | D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plaintext in the default Management Information Base (MI… | |
CVE-2001-1217 | | 2001-12-21 | Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a… | |
CVE-2001-1216 | | 2001-12-21 | Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page. | |
CVE-2001-0888 | | 2001-12-21 | Atmel Firmware 1.3 Wireless Access Point (WAP) allows remote attackers to cause a denial of service via a SNMP request with (1) a community string other than "… | |
CVE-2001-0886 | | 2001-12-21 | Buffer overflow in glob function of glibc allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a glob pattern that end… | |
CVE-2001-0884 | | 2001-12-21 | Cross-site scripting vulnerability in Mailman email archiver before 2.08 allows attackers to obtain sensitive information or authentication credentials via a m… | |
CVE-2001-0873 | | 2001-12-21 | uuxqt in Taylor UUCP package does not properly remove dangerous long options, which allows local users to gain privileges by calling uux and specifying an alte… | |
CVE-2001-0872 | | 2001-12-21 | OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain r… | |
CVE-2001-0871 | | 2001-12-21 | Directory traversal vulnerability in HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP… | |
CVE-2001-0870 | | 2001-12-21 | HTTP server in Alchemy Eye and Alchemy Network Monitor 1.9x through 2.6.18 is enabled without authentication by default, which allows remote attackers to obtai… | |
CVE-2001-0869 | | 2001-12-21 | Format string vulnerability in the default logging callback function _sasl_syslog in common.c in Cyrus SASL library (cyrus-sasl) may allow remote attackers to… | |
CVE-2001-1219 | | 2001-12-20 | Microsoft Internet Explorer 6.0 and earlier allows malicious website operators to cause a denial of service (client crash) via JavaScript that continually refr… | |
CVE-2001-1218 | | 2001-12-20 | Microsoft Internet Explorer for Unix 5.0SP1 allows local users to possibly cause a denial of service (crash) in CDE or the X server on Solaris 2.6 by rapidly s… | |
CVE-2001-1215 | | 2001-12-20 | Format string vulnerability in PFinger 0.7.5 through 0.7.7 allows remote attackers to execute arbitrary code via format string specifiers in a .plan file. | |
CVE-2001-0879 | | 2001-12-20 | Format string vulnerability in the C runtime functions in SQL Server 7.0 and 2000 allows attackers to cause a denial of service. | |
CVE-2001-0877 | | 2001-12-20 | Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service via (1) a spoofed SSDP advertisement that c… | |
CVE-2001-0876 | | 2001-12-20 | Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with… | |
CVE-2001-0542 | | 2001-12-20 | Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror… | |
CVE-2001-0889 | | 2001-12-19 | Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow… | |
CVE-2001-1213 | | 2001-12-18 | The default configuration of DataWizard FtpXQ 2.0 and 2.1 includes a default username and password, which allows remote attackers to read and write arbitrary f… | |
CVE-2001-1212 | | 2001-12-18 | Cross-site scripting vulnerability in catgy.cgi for Aktivate 1.03 allows remote attackers to execute arbitrary Javascript via the desc parameter. | |
CVE-2001-1448 | | 2001-12-17 | Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on tempor… | |
CVE-2001-1201 | | 2001-12-17 | Buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file. | |
CVE-2001-1200 | | 2001-12-17 | Microsoft Windows XP allows local users to bypass a locked screen and run certain programs that are associated with Hot Keys. | |
CVE-2001-1199 | | 2001-12-17 | Cross-site scripting vulnerability in agora.cgi for Agora 3.0a through 4.0g, when debug mode is enabled, allows remote attackers to execute Javascript on other… | |
CVE-2001-1196 | | 2001-12-17 | Directory traversal vulnerability in edit_action.cgi of Webmin Directory 0.91 allows attackers to gain privileges via a '..' (dot dot) in the argument. | |
CVE-2001-1214 | | 2001-12-15 | manual.php in Marcus S. Xenakis Unix Manual 1.0 allows remote attackers to execute arbitrary code via a URL that contains shell metacharacters. | |
CVE-2001-1198 | | 2001-12-15 | RLPDaemon in HP-UX 10.20 and 11.0 allows local users to overwrite arbitrary files and gain privileges by specifying the target file in the -L option. | |
CVE-2001-1195 | | 2001-12-15 | Novell Groupwise 5.5 and 6.0 Servlet Gateway is installed with a default username and password for the servlet manager, which allows remote attackers to gain p… | |
CVE-2001-1197 | | 2001-12-14 | klprfax_filter in KDE2 KDEUtils allows local users to overwrite arbitrary files via a symlink attack on the klprfax.filter temporary file. | |
CVE-2001-1194 | | 2001-12-14 | Zyxel Prestige 681 and 1600 SDSL Routers allow remote attackers to cause a denial of service via malformed packets with (1) an IP length less than actual packe… | |
CVE-2001-0727 | | 2001-12-14 | Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that cause… | |
CVE-2001-1193 | | 2001-12-13 | Directory traversal vulnerability in EFTP 2.0.8.346 allows local users to read directories via a ... (modified dot dot) in the CWD command. | |
CVE-2001-1192 | | 2001-12-13 | Citrix Independent Computing Architecture (ICA) Client for Windows 6.1 allows remote malicious web sites to execute arbitrary code via a .ICA file, which is do… | |
CVE-2001-1189 | | 2001-12-13 | IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the password… | |
CVE-2001-0874 | | 2001-12-13 | Internet Explorer 5.5 and 6.0 allow remote attackers to read certain files via HTML that passes information from a frame in the client's domain to a frame in t… | |
CVE-2001-1190 | | 2001-12-12 | The default PAM files included with passwd in Mandrake Linux 8.1 do not support MD5 passwords, which could result in a lower level of password security than in… | |
CVE-2001-0797 | | 2001-12-12 | Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments thro… | |
CVE-2001-1191 | | 2001-12-11 | WebSeal in IBM Tivoli SecureWay Policy Director 3.8 allows remote attackers to cause a denial of service (crash) via a URL that ends in %2e. | |
CVE-2001-1188 | | 2001-12-11 | mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier allows remote attackers to send SPAM e-mail through remote servers by modifying the sendto, email, serve… | |
CVE-2001-1187 | | 2001-12-11 | csvform.pl 0.1 allows remote attackers to execute arbitrary commands via metacharacters in the file parameter. | |
CVE-2001-1186 | | 2001-12-11 | Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the requ… | |
CVE-2001-0890 | | 2001-12-11 | Certain backend drivers in the SANE library 1.0.3 and earlier, as used in frontend software such as XSane, allows local users to modify files via a symlink att… | |
CVE-2001-1185 | | 2001-12-10 | Some AIO operations in FreeBSD 4.4 may be delayed until after a call to execve, which could allow a local user to overwrite memory of the new process and gain… | |
CVE-2001-1184 | | 2001-12-08 | wrshdsp.exe in Denicomp Winsock RSHD/NT 2.21.00 and earlier allows remote attackers to cause a denial of service (CPU consumption) via (1) in 2.20.00 and earli… |