2001 CVEs (page 7)
Page 7 of 16 — CVEs published in 2001, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2001-1019 | | 2001-09-08 | Directory traversal vulnerability in view_item CGI program in sglMerchant 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTML_FI… | |
CVE-2001-0985 | | 2001-09-08 | shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter. | |
CVE-2001-1138 | | 2001-09-07 | Directory traversal vulnerability in r.pl (aka r.cgi) of Randy Parker Power Up HTML 0.8033beta allows remote attackers to read arbitrary files and possibly exe… | |
CVE-2001-1099 | | 2001-09-07 | The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to identify the recipient's INBOX file path by sending an… | |
CVE-2001-1000 | | 2001-09-07 | rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to read arbitrary files via a symlink attack… | |
CVE-2001-1378 | | 2001-09-06 | fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files. | |
CVE-2001-1137 | | 2001-09-06 | D-Link DI-704 Internet Gateway firmware earlier than V2.56b6 allows remote attackers to cause a denial of service (reboot) via malformed IP datagram fragments. | |
CVE-2001-1152 | | 2001-09-05 | Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorize… | |
CVE-2001-1132 | | 2001-09-05 | Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty site or list password, which is not prope… | |
CVE-2001-1020 | | 2001-09-05 | edit_image.php in Vibechild Directory Manager before 0.91 allows remote attackers to execute arbitrary commands via shell metacharacters in the userfile_name p… | |
CVE-2001-1012 | | 2001-09-05 | Vulnerability in screen before 3.9.10, related to a multi-attach error, allows local users to gain root privileges when there is a subdirectory under /tmp/scre… | |
CVE-2001-0992 | | 2001-09-05 | shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" parameter. | |
CVE-2001-1456 | | 2001-09-04 | Buffer overflow in the (1) smap/smapd and (2) CSMAP daemons for Gauntlet Firewall 5.0 through 6.0 allows remote attackers to execute arbitrary code via a craft… | |
CVE-2001-1017 | | 2001-09-04 | rmuser utility in FreeBSD 4.2 and 4.3 creates a copy of the master.passwd file with world-readable permissions while updating the original file, which could al… | |
CVE-2001-1016 | | 2001-09-04 | PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invali… | |
CVE-2001-0994 | | 2001-09-04 | Marconi ForeThought 7.1 allows remote attackers to cause a denial of service by causing both telnet sessions to be locked via unusual input (e.g., from a port… | |
CVE-2001-0990 | | 2001-09-04 | Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a library, which allows… | |
CVE-2001-0979 | | 2001-09-03 | Buffer overflow in swverify in HP-UX 11.0, and possibly other programs, allows local users to gain privileges via a long command line argument. | |
CVE-2001-0978 | | 2001-09-03 | login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brute force password guessing attacks witho… | |
CVE-2001-1169 | | 2001-09-02 | keyinit in S/Key does not require authentication to initialize a one-time password sequence, which allows an attacker who has gained privileges to a user accou… | |
CVE-2001-0996 | | 2001-09-02 | POP3Lite before 0.2.4 does not properly quote a . (dot) in an email message, which could allow a remote attacker to append arbitrary text to the end of an emai… | |
CVE-2001-1452 | High | 7.5 | 2001-08-31 | By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to… |
CVE-2001-1073 | | 2001-08-31 | Webridge PX Application Suite allows remote attackers to obtain sensitive information via a malformed request that generates a server error message, which incl… | |
CVE-2001-1072 | | 2001-08-31 | Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested… | |
CVE-2001-1070 | | 2001-08-31 | Sage Software MAS 200 allows remote attackers to cause a denial of service by connecting to port 10000 and entering a series of control characters. | |
CVE-2001-1069 | | 2001-08-31 | libCoolType library as used in Adobe Acrobat (acroread) on Linux creates the AdobeFnt.lst file with world-writable permissions, which allows local users to mod… | |
CVE-2001-1068 | | 2001-08-31 | qpopper 4.01 with PAM based authentication on Red Hat systems generates different error messages when an invalid username is provided instead of a valid name… | |
CVE-2001-1067 | | 2001-08-31 | Buffer overflow in AOLserver 3.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via an HTTP request with a long Aut… | |
CVE-2001-1066 | | 2001-08-31 | ns6install installation script for Netscape 6.01 on Solaris, and other versions including 6.2.1 beta, allows local users to overwrite arbitrary files via a sym… | |
CVE-2001-1065 | | 2001-08-31 | Web-based configuration utility in Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap binds itself to port 80 even when web-based configuration servic… | |
CVE-2001-1064 | | 2001-08-31 | Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap allows remote attackers to cause a denial of service via multiple connections to the router on the… | |
CVE-2001-1063 | | 2001-08-31 | Buffer overflow in uidadmin in Caldera Open Unix 8.0.0 and UnixWare 7 allows local users to gain root privileges via a long -S (scheme) command line argument. | |
CVE-2001-1062 | | 2001-08-31 | Buffer overflow in mana in OpenServer 5.0.6a and earlier allows local users to execute arbitrary code. | |
CVE-2001-1061 | | 2001-08-31 | Vulnerability in lsmcode in unknown versions of AIX, possibly related to a usage error. | |
CVE-2001-1041 | | 2001-08-31 | oracle program in Oracle 8.0.x, 8.1.x and 9.0.1 allows local users to overwrite arbitrary files via a symlink attack on an Oracle log trace (.trc) file that is… | |
CVE-2001-1040 | | 2001-08-31 | HP LaserJet, and possibly other JetDirect devices, resets the admin password when the device is turned off, which could allow remote attackers to access the de… | |
CVE-2001-1039 | | 2001-08-31 | The JetAdmin web interface for HP JetDirect does not set a password for the telnet interface when the admin password is changed, which allows remote attackers… | |
CVE-2001-1036 | | 2001-08-31 | GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an e… | |
CVE-2001-1027 | | 2001-08-31 | Buffer overflow in WindowMaker (aka wmaker) 0.64 and earlier allows remote attackers to execute arbitrary code via a long window title. | |
CVE-2001-1025 | | 2001-08-31 | PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" variable when calling any scripts that do not already define… | |
CVE-2001-1009 | | 2001-08-31 | Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain pr… | |
CVE-2001-1008 | | 2001-08-31 | Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities v… | |
CVE-2001-1007 | | 2001-08-31 | Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered… | |
CVE-2001-1006 | | 2001-08-31 | Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA does not encrypt sensitive files and relies solely on its password feature to restrict access, which… | |
CVE-2001-1005 | | 2001-08-31 | Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have a… | |
CVE-2001-1004 | | 2001-08-31 | Cross-site scripting (CSS) vulnerability in gnut Gnutella client before 0.4.27 allows remote attackers to execute arbitrary script on other clients by sharing… | |
CVE-2001-1003 | | 2001-08-31 | Respondus 1.1.2 for WebCT uses weak encryption to remember usernames and passwords, which allows local users who can read the WEBCT.SVR file to decrypt the pas… | |
CVE-2001-1002 | | 2001-08-31 | The default configuration of the DVI print filter (dvips) in Red Hat Linux 7.0 and earlier does not run dvips in secure mode when dvips is executed by lpd, whi… | |
CVE-2001-0995 | | 2001-08-31 | PHProjekt before 2.4a allows remote attackers to perform actions as other PHProjekt users by modifying the ID number in an HTTP request to PHProjekt CGI progra… | |
CVE-2001-0983 | | 2001-08-31 | UltraEdit uses weak encryption to record FTP passwords in the uedit32.ini file, which allows local users who can read the file to decrypt the passwords and gai… | |
CVE-2001-0981 | | 2001-08-31 | HP CIFS/9000 Server (SAMBA) A.01.07 and earlier with the "unix password sync" option enabled calls the passwd program without specifying the username of the us… | |
CVE-2001-0976 | | 2001-08-31 | Vulnerability in HP Process Resource Manager (PRM) C.01.08.2 and earlier, as used by HP-UX Workload Manager (WLM), allows local users to gain root privileges v… | |
CVE-2001-0973 | | 2001-08-31 | BSCW groupware system 3.3 through 4.0.2 beta allows remote attackers to read or modify arbitrary files by uploading and extracting a tar file with a symlink in… | |
CVE-2001-0972 | | 2001-08-31 | Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculatin… | |
CVE-2001-0971 | | 2001-08-31 | Directory traversal vulnerability in ACI 4d webserver allows remote attackers to read arbitrary files via a .. (dot dot) or drive letter (e.g., C:) in an HTTP… | |
CVE-2001-0970 | | 2001-08-31 | Cross-site scripting vulnerability in TDForum 1.2 CGI script (tdforum12.cgi) allows remote attackers to execute arbitrary script on other clients via a forum m… | |
CVE-2001-0969 | | 2001-08-31 | ipfw in FreeBSD does not properly handle the use of "me" in its rules when point to point interfaces are used, which causes ipfw to allow connections from arbi… | |
CVE-2001-0968 | | 2001-08-31 | Knox Arkeia server 4.2, and possibly other versions, installs its root user with a null password by default, which allows local and remote users to gain privil… | |
CVE-2001-0967 | Critical | 9.8 | 2001-08-31 | Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an at… |
CVE-2001-0966 | | 2001-08-31 | Directory traversal vulnerability in Nudester 1.10 and earlier allows remote attackers to read or write arbitrary files via a .. (dot dot) in the CD (CWD) comm… | |
CVE-2001-0965 | | 2001-08-31 | glFTPD 1.23 allows remote attackers to cause a denial of service (CPU consumption) via a LIST command with an argument that contains a large number of * (aster… | |
CVE-2001-0943 | | 2001-08-31 | dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands, which… | |
CVE-2001-0711 | | 2001-08-31 | Cisco IOS 11.x and 12.0 with ATM support allows attackers to cause a denial of service via the undocumented Interim Local Management Interface (ILMI) SNMP comm… | |
CVE-2001-1154 | | 2001-08-30 | Cyrus 2.0.15, 2.0.16, and 1.6.24 on BSDi 4.2, with IMAP enabled, allows remote attackers to cause a denial of service (hang) using PHP IMAP clients. | |
CVE-2001-1389 | | 2001-08-29 | Multiple vulnerabilities in xinetd 2.3.0 and earlier, and additional variants until 2.3.3, may allow remote attackers to cause a denial of service or execute a… | |
CVE-2001-1379 | | 2001-08-29 | The PostgreSQL authentication modules (1) mod_auth_pgsql 0.9.5, and (2) mod_auth_pgsql_sys 0.9.4, allow remote attackers to bypass authentication and execute a… | |
CVE-2001-1168 | | 2001-08-29 | Directory traversal vulnerability in index.php in PhpMyExplorer before 1.2.1 allows remote attackers to read arbitrary files via a ..%2F (modified dot dot) in… | |
CVE-2001-0682 | Medium | 5.5 | 2001-08-29 | ZoneAlarm and ZoneAlarm Pro allows a local attacker to cause a denial of service by running a trojan to initialize a ZoneAlarm mutex object which prevents Zone… |
CVE-2001-1153 | | 2001-08-28 | lpsystem in OpenUnix 8.0.0 allows local users to cause a denial of service and possibly execute arbitrary code via a long command line argument. | |
CVE-2001-1444 | | 2001-08-27 | The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption options sent from the… | |
CVE-2001-1443 | | 2001-08-27 | KTH Kerberos IV and Kerberos V (Heimdal) for Telnet clients do not encrypt connections if the server does not support the requested encryption, which allows re… | |
CVE-2001-1455 | | 2001-08-24 | Netegrity SiteMinder 3.6 through 4.5.1 allows remote attackers to bypass filtering via URLs containing Unicode characters. | |
CVE-2001-1155 | Critical | 9.8 | 2001-08-23 | TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which… |
CVE-2001-1091 | | 2001-08-23 | The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the… | |
CVE-2001-1294 | | 2001-08-22 | Buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier allows remote attackers to cause a denial of service (crash) in the Webmail interface via a long user… | |
CVE-2001-1150 | | 2001-08-22 | Vulnerability in cgiWebupdate.exe in Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.5.2 through 3.5.4 allows remote attackers to read arbitrary… | |
CVE-2001-1140 | | 2001-08-22 | BadBlue Personal Edition v1.02 beta allows remote attackers to read source code for executable programs by appending a %00 (null byte) to the request. | |
CVE-2001-1139 | | 2001-08-22 | Directory traversal vulnerability in ASCII NT WinWrapper Professional allows remote attackers to read arbitrary files via a .. (dot dot) in the server request. | |
CVE-2001-0634 | | 2001-08-22 | Sun Chili!Soft ASP has weak permissions on various configuration files, which allows a local attacker to gain additional privileges and create a denial of serv… | |
CVE-2001-0633 | | 2001-08-22 | Directory traversal vulnerability in Sun Chili!Soft ASP on multiple Unixes allows a remote attacker to read arbitrary files above the web root via a '..' (dot… | |
CVE-2001-0632 | | 2001-08-22 | Sun Chili!Soft 3.5.2 on Linux and 3.6 on AIX creates a default admin username and password in the default installation, which can allow a remote attacker to ga… | |
CVE-2001-0631 | | 2001-08-22 | Centrinity First Class Internet Services 5.50 allows for the circumventing of the default 'spam' filters via the presence of '<@>' in the 'From:' field, which… | |
CVE-2001-0630 | | 2001-08-22 | Directory traversal vulnerability in MIMAnet viewsrc.cgi 2.0 allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in the 'loc' variable. | |
CVE-2001-0627 | | 2001-08-22 | vi as included with SCO OpenServer 5.0 - 5.0.6 allows a local attacker to overwrite arbitrary files via a symlink attack. | |
CVE-2001-0626 | | 2001-08-22 | O'Reilly Website Professional 2.5.4 and earlier allows remote attackers to determine the physical path to the root directory via a URL request containing a ":"… | |
CVE-2001-0625 | | 2001-08-22 | ftpdownload in Computer Associates InoculateIT 6.0 allows a local attacker to overwrite arbitrary files via a symlink attack on /tmp/ftpdownload.log . | |
CVE-2001-0617 | | 2001-08-22 | Allied Telesyn AT-AR220e cable/DSL router firmware 1.08a RC14 with the portmapper and the 'Virtual Server' enabled can allow a remote attacker to gain access t… | |
CVE-2001-0614 | | 2001-08-22 | Carello E-Commerce 1.2.1 and earlier allows a remote attacker to gain additional privileges and execute arbitrary commands via a specially constructed URL. | |
CVE-2001-0613 | | 2001-08-22 | Omnicron Technologies OmniHTTPD Professional 2.08 and earlier allows a remote attacker to create a denial of service via a long POST URL request. | |
CVE-2001-0612 | | 2001-08-22 | McAfee Remote Desktop 3.0 and earlier allows remote attackers to cause a denial of service (crash) via a large number of packets to port 5045. | |
CVE-2001-0608 | | 2001-08-22 | HP architected interface facility (AIF) as includes with MPE/iX 5.5 through 6.5 running on a HP3000 allows an attacker to gain additional privileges and gain a… | |
CVE-2001-0607 | | 2001-08-22 | asecure as included with HP-UX 10.01 through 11.00 can allow a local attacker to create a denial of service and gain additional privileges via unsafe permissio… | |
CVE-2001-0606 | | 2001-08-22 | Vulnerability in iPlanet Web Server 4.X in HP-UX 11.04 (VVOS) with VirtualVault A.04.00 allows a remote attacker to create a denial of service via the HTTPS se… | |
CVE-2001-0605 | | 2001-08-22 | Headlight Software MyGetright prior to 1.0b allows a remote attacker to upload and/or overwrite arbitrary files via a malicious .dld (skins-data) file which co… | |
CVE-2001-0593 | | 2001-08-22 | Anaconda Partners Clipper 3.3 and earlier allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in the template parameter. | |
CVE-2001-0591 | | 2001-08-22 | Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary… | |
CVE-2001-0589 | | 2001-08-22 | NetScreen ScreenOS prior to 2.5r6 on the NetScreen-10 and Netscreen-100 can allow a local attacker to bypass the DMZ 'denial' policy via specific traffic patte… | |
CVE-2001-0588 | | 2001-08-22 | sendmail 8.9.3, as included with the MMDF 2.43.3b package in SCO OpenServer 5.0.6, can allow a local attacker to gain additional privileges via a buffer overfl… | |
CVE-2001-0587 | | 2001-08-22 | deliver program in MMDF 2.43.3b in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow in the first argument to… | |
CVE-2001-0586 | | 2001-08-22 | TrendMicro ScanMail for Exchange 3.5 Evaluation allows a local attacker to recover the administrative credentials for ScanMail via a combination of unprotected… |