Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2001-1111
EFTP 2.0.7.337 stores user passwords in plaintext in the eftp2users.dat file.
Affected Products: n/a
References: [{'name': 'eftp-plaintext-password(7116)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7116'}, {'name': '20010912 EFTP Version 2.0.7.337 vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/213647'}, {'name': '3332', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3332'}]
CVE State: PUBLISHED
Explain CVE-2001-1112
Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of characters.
Affected Products: n/a
References: [{'name': 'eftp-lnk-bo(7115)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7115'}, {'name': '20010912 EFTP Version 2.0.7.337 vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/213647'}, {'name': '3330', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3330'}]
CVE State: PUBLISHED
Explain CVE-2001-1113
Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories with long names, then running the ls -R (recursive) command.
Affected Products: n/a
References: [{'name': '3174', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3174'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'ftp://ftp.trolltech.com/freebies/ftpd/troll-ftpd-1.27.tar.gz'}, {'name': '20010813 Local exploit for TrollFTPD-1.26', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/203874'}, {'name': 'trollftpd-long-path-bo(6974)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6974'}]
CVE State: PUBLISHED
Explain CVE-2001-1114
book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the "current" parameter.
Affected Products: n/a
References: [{'name': '3178', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3178'}, {'name': 'netcode-book-pipes-command(6986)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6986'}, {'name': '20010813 NetCode NC Book 0.2b remote command execution vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/204094'}]
CVE State: PUBLISHED
Explain CVE-2001-1115
generate.cgi in SIX-webboard 2.01 and before allows remote attackers to read arbitrary files via a dot dot (..) in the content parameter.
Affected Products: n/a
References: [{'name': '20010813 SIX-webboard 2.01 "show files" vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/204053'}, {'name': '3175', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3175'}, {'name': 'sixwebboard-dot-directory-traversal(6975)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6975'}]
CVE State: PUBLISHED
Explain CVE-2001-1116
Identix BioLogon 2.03 and earlier does not lock secondary displays on a multi-monitor system running Windows 98 or ME, which allows an attacker with physical access to the system to bypass authentication through a secondary display.
Affected Products: n/a
References: [{'name': 'identix-biologon-auth-bypass(6948)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6948'}, {'name': '20010802 Identix BioLogon Client security bug', 'tags': ['mailing-list', 'x_refsource_NTBUGTRAQ'], 'url': 'http://ntbugtraq.ntadvice.com/default.asp?pid=36&sid=1&A2=IND0108&L=NTBUGTRAQ&F=P&S=&P=71'}, {'name': '5453', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/5453'}, {'name': '3140', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3140'}, {'name': '20010808 Response to Identix BioLogon Client security bug', 'tags': ['mailing-list', 'x_refsource_NTBUGTRAQ'], 'url': 'http://ntbugtraq.ntadvice.com/default.asp?pid=36&sid=1&A2=ind0108&L=ntbugtraq&F=P&S=&P=724'}]
CVE State: PUBLISHED
Explain CVE-2001-1117
LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware before 1.39.3 Beta allows a remote attacker to view administration and user passwords by connecting to the router and viewing the HTML source for (1) index.htm and (2) Password.htm.
Affected Products: n/a
References: [{'name': '20010802 Advisory Update: Design Flaw in Linksys EtherFast 4-Port', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/201390'}, {'name': '3141', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3141'}, {'name': '5467', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/5467'}, {'name': 'linksys-etherfast-reveal-passwords(6949)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6949'}, {'name': '1920', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/1920'}, {'name': '20010810 Linksys router security fix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/203302'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'ftp://ftp.linksys.com/pub/befsr41/befsr-fw1402.zip'}]
CVE State: PUBLISHED
Explain CVE-2001-1118
A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.
Affected Products: n/a
References: [{'name': '3145', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3145'}, {'name': 'roxen-urlrectifier-retrieve-files(6937)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6937'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.roxen.com/2.0/patch/security-notice.html'}, {'name': '20010802 FW: Security alert: Remote user can access any file', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/201499'}, {'name': '20010802 Roxen security alert: URL decoding vulnerable', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/201476'}]
CVE State: PUBLISHED
Explain CVE-2001-1119
cda in xmcd 3.0.2 and 2.6 in SuSE Linux allows local users to overwrite arbitrary files via a symlink attack.
Affected Products: n/a
References: [{'name': '3148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3148'}, {'name': 'SuSE-SA:2001:025', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2001_025_xmcd_txt.html'}, {'name': 'xmcd-cda-symlink(6941)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6941'}, {'name': 'VU#105347', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/105347'}]
CVE State: PUBLISHED
Explain CVE-2001-1120
Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary files, or (2) overwrite ColdFusion Server templates.
Affected Products: n/a
References: [{'name': '3018', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3018'}, {'name': 'coldfusion-unauthorized-file-access(6839)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6839'}, {'name': '20010712 New Cold Fusion vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/196452'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.allaire.com/handlers/index.cfm?id=21566'}, {'name': 'VU#135531', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/135531'}]
CVE State: PUBLISHED
Explain CVE-2001-1122
Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running the NT4ALL exploit program in 'SPECIAL' mode.
Affected Products: n/a
References: [{'name': '3144', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3144'}, {'name': 'winnt-nt4all-dos(6943)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6943'}, {'name': '20010803 REPOST: A damaging local DoS in WinNT SP6a', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/201722'}]
CVE State: PUBLISHED
Explain CVE-2001-1123
Vulnerability in Network Node Manager (NNM) 6.2 and earlier in HP OpenView allows a local user to execute arbitrary code, possibly via a buffer overflow in a long hostname or object ID.
Affected Products: n/a
References: [{'name': 'VU#782155', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/782155'}, {'name': 'openview-nmm-gain-privileges(7222)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7222'}, {'name': 'HPSBUX0112-177', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/advisories/3723'}, {'name': 'HPSBUX0110-170', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/advisories/3585'}, {'name': '3399', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3399'}]
CVE State: PUBLISHED
Explain CVE-2001-1124
rpcbind in HP-UX 11.00, 11.04 and 11.11 allows remote attackers to cause a denial of service (core dump) via a malformed RPC portmap requests, possibly related to a buffer overflow.
Affected Products: n/a
References: [{'name': 'M-003', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://www.ciac.org/ciac/bulletins/m-003.shtml'}, {'name': 'hp-rpcbind-dos(7221)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7221'}, {'name': 'HPSBUX0110-169', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/advisories/3586'}, {'name': 'oval:org.mitre.oval:def:5683', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5683'}, {'name': '3400', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3400'}]
CVE State: PUBLISHED
Explain CVE-2001-1125
Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.
Affected Products: n/a
References: [{'name': '20011005 Symantec LiveUpdate attacks', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/218717'}, {'name': '3403', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3403'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sarc.com/avcenter/security/Content/2001.10.05.html'}, {'name': 'liveupdate-host-verification(7235)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7235'}]
CVE State: PUBLISHED
Explain CVE-2001-1126
Symantec LiveUpdate 1.4 through 1.6, and possibly later versions, allows remote attackers to cause a denial of service (flood) via DNS spoofing of the update.symantec.com site.
Affected Products: n/a
References: [{'name': '3413', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3413'}, {'name': '20011005 Symantec LiveUpdate attacks', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/218717'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sarc.com/avcenter/security/Content/2001.10.05.html'}, {'name': 'liveupdate-host-verification(7235)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7235'}]
CVE State: PUBLISHED
Explain CVE-2001-1127
Buffer overflow in Progress database 8.3D and 9.1C could allow a local user to execute arbitrary code via (1) _proapsv, (2) _mprosrv, (3) _mprshut, (4) orarx, (5) sqlcpp, (6) _probrkr, (7) _sqlschema and (8) _sqldump.
Affected Products: n/a
References: [{'name': '20011005 Progress Database vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/218833'}, {'name': '3404', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3404'}, {'name': 'progress-strcpy-bo(7236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7236'}]
CVE State: PUBLISHED
Explain CVE-2001-1128
Buffer overflow in Progress database 8.3D and 9.1C allows local users to execute arbitrary code via long entries in files that are specified by the (1) PROMSGS or (2) PROTERMCAP environment variables.
Affected Products: n/a
References: [{'name': '3414', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3414'}, {'name': 'progress-protermcap-bo(7264)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7264'}, {'name': '20011008 Progress TERM (protermcap) overflows and PROMSGS overflows', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/219174'}]
CVE State: PUBLISHED
Explain CVE-2001-1129
Format string vulnerabilities in (1) _probuild, (2) _dbutil, (3) _mprosrv, (4) _mprshut, (5) _proapsv, (6) _progres, (7) _proutil, (8) _rfutil and (9) prolib in Progress database 9.1C allows a local user to execute arbitrary code via format string specifiers in the file used by the PROMSGS environment variable.
Affected Products: n/a
References: [{'name': 'progress-promsgs-format-string(7457)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7457'}, {'name': '20011102 Progres Databse PROMSGS Format strings issue.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/224395'}, {'name': '3502', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3502'}]
CVE State: PUBLISHED
Explain CVE-2001-1130
Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file.
Affected Products: n/a
References: [{'name': 'sdbsearch-cgi-command-execution(7003)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7003'}, {'name': '20010802 suse: sdbsearch.cgi vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/201216'}, {'name': 'SuSE-SA:2001:027', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2001_027_sdb_txt.html'}]
CVE State: PUBLISHED
Explain CVE-2001-1131
Directory traversal vulnerability in WhitSoft Development SlimFTPd 2.2 allows an attacker to read arbitrary files and directories via a ... (modified dot dot) in the CD command.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.securiteam.com/windowsntfocus/5RP0L0055O.html'}]
CVE State: PUBLISHED
Explain CVE-2001-1132
Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty site or list password, which is not properly handled during the call to the crypt function during authentication.
Affected Products: n/a
References: [{'name': 'CLA-2001:420', 'tags': ['vendor-advisory', 'x_refsource_CONECTIVA'], 'url': 'http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000420'}, {'name': 'mailman-blank-passwords(7091)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7091'}, {'name': '5455', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/5455'}]
CVE State: PUBLISHED
Explain CVE-2001-1133
Vulnerability in a system call in BSDI 3.0 and 3.1 allows local users to cause a denial of service (reboot) in the kernel via a particular sequence of instructions.
Affected Products: n/a
References: [{'name': '3220', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3220'}, {'name': 'bsd-kernel-dos(7023)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7023.php'}, {'name': '20010821 BSDi (3.0/3.1) reboot machine code as any user (non-specific)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/209192'}]
CVE State: PUBLISHED
Explain CVE-2001-1134
Xerox DocuPrint N40 Printers allow remote attackers to cause a denial of service via malformed data, such as that produced by the Code Red worm.
Affected Products: n/a
References: [{'name': '20010809 Xerox N40 printers and Code Red worm', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/203025'}, {'name': '3170', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3170'}, {'name': '20010720 Re: Two birds with one worm', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/198381'}, {'name': 'xerox-docuprint-dos(6976)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/6976.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1135
ZyXEL Prestige 642R and 642R-I routers do not filter the routers' Telnet and FTP ports on the external WAN interface from inside access, allowing someone on an internal computer to reconfigure the router, if the password is known.
Affected Products: n/a
References: [{'name': '20010810 Re: ZyXEL Prestige 642R: Exposed Admin Services on WAN with Default Password', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/203592'}, {'name': 'prestige-wan-bypass-filter(7146)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7146'}, {'name': '20010809 ZyXEL Prestige 642R: Exposed Admin Services on WAN with Default Password', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/203022'}, {'name': '20010918 SECURITY RISK: ZyXEL ADSL Router 642R - WAN filter bypass from internal network', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/214971'}, {'name': '3346', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3346'}, {'name': '20010814 Fwd: ZyXEL Prestige 642 Router Administration Interface Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/204439'}]
CVE State: PUBLISHED
Explain CVE-2001-1136
The libsecurity library in HP-UX 11.04 (VVOS) allows attackers to cause a denial of service.
Affected Products: n/a
References: [{'name': 'L-143', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://www.ciac.org/ciac/bulletins/l-143.shtml'}, {'name': 'HPSBUX0109-166', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://archives.neohapsis.com/archives/hp/2001-q3/0063.html'}, {'name': '3338', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3338'}, {'name': 'hp-virtualvault-libsecurity-dos(7124)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7124'}]
CVE State: PUBLISHED
Explain CVE-2001-1137
D-Link DI-704 Internet Gateway firmware earlier than V2.56b6 allows remote attackers to cause a denial of service (reboot) via malformed IP datagram fragments.
Affected Products: n/a
References: [{'name': '3306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3306'}, {'name': '20010906 Malformed Fragmented Packets DoS Dlink Firewall/Routers', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/212532'}, {'name': 'dlink-fragmented-packet-dos(7090)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7090'}]
CVE State: PUBLISHED
Explain CVE-2001-1138
Directory traversal vulnerability in r.pl (aka r.cgi) of Randy Parker Power Up HTML 0.8033beta allows remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the FILE parameter.
Affected Products: n/a
References: [{'name': '20010907  *** Security Advisory *** Power UP HTML', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/212679'}, {'name': 'powerup-rcgi-directory-traversal(7092)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7092'}, {'name': '3304', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3304'}]
CVE State: PUBLISHED
Explain CVE-2001-1139
Directory traversal vulnerability in ASCII NT WinWrapper Professional allows remote attackers to read arbitrary files via a .. (dot dot) in the server request.
Affected Products: n/a
References: [{'name': '3219', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3219'}, {'name': 'winwrapper-dot-directory-traversal(7015)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7015.php'}, {'name': '20010822 [SNS Advisory No.39] WinWrapper Professional 2.0 Remote Arbitrary File Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/209414'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.tsc.ant.co.jp/products/download.htm'}]
CVE State: PUBLISHED
Explain CVE-2001-1140
BadBlue Personal Edition v1.02 beta allows remote attackers to read source code for executable programs by appending a %00 (null byte) to the request.
Affected Products: n/a
References: [{'name': '20010822 -- [ iSecureLabs BadBlue v1.02 beta for Windows 98, ME and 2000 Advisory ] --', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/209545'}, {'name': '3222', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3222'}, {'name': 'badblue-file-source-disclosure(7021)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7021'}]
CVE State: PUBLISHED
Explain CVE-2001-1141
The Pseudo-Random Number Generator (PRNG) in SSLeay and OpenSSL before 0.9.6b allows attackers to use the output of small PRNG requests to determine the internal state information, which could be used by attackers to predict future pseudo-random numbers.
Affected Products: n/a
References: [{'name': '3004', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3004'}, {'name': 'FreeBSD-SA-01:51', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'http://www.securityfocus.com/advisories/3475'}, {'name': 'NetBSD-SA2001-013', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-013.txt.asc'}, {'name': 'openssl-prng-brute-force(6823)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6823'}, {'name': 'MDKSA-2001:065', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-065.php3?dis=8.0'}, {'name': 'CLA-2001:418', 'tags': ['vendor-advisory', 'x_refsource_CONECTIVA'], 'url': 'http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000418'}, {'name': '20010710 OpenSSL Security Advisory: PRNG weakness in versions up to 0.9.6a', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/195829'}, {'name': 'RHSA-2001:051', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2001-051.html'}, {'name': '853', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/853'}, {'name': 'ESA-20010709-01', 'tags': ['vendor-advisory', 'x_refsource_ENGARDE'], 'url': 'http://www.linuxsecurity.com/advisories/other_advisory-1483.html'}]
CVE State: PUBLISHED
Explain CVE-2001-1142
ArGoSoft FTP Server 1.2.2.2 uses weak encryption for user passwords, which allows an attacker with access to the password file to gain privileges.
Affected Products: n/a
References: [{'name': 'argosoft-ftp-weak-encryption(6848)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/6848.php'}, {'name': '20010712 ArGoSoft FTP Server 1.2.2.2 Weak password encryption', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/196968'}, {'name': '3029', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3029'}]
CVE State: PUBLISHED
Explain CVE-2001-1143
IBM DB2 7.0 allows a remote attacker to cause a denial of service (crash) via a single byte to (1) db2ccs.exe on port 6790, or (2) db2jds.exe on port 6789.
Affected Products: n/a
References: [{'name': '20010711 IBM Windows DB2 DoS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/196140'}, {'name': '3010', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3010'}, {'name': 'ibm-db2-jds-dos(6833)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/6833.php'}, {'name': 'ibm-db2-ccs-dos(6832)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/6832.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1144
Directory traversal vulnerability in McAfee ASaP VirusScan agent 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request.
Affected Products: n/a
References: [{'name': '3020', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3020'}, {'name': '20010711 McAfee ASaP Virusscan - myCIO HTTP Server Directory Traversal Vulnerabilty', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/196272'}, {'name': 'VU#190267', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/190267'}, {'name': 'mcafee-mycio-directory-traversal(6834)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/6834.php'}, {'name': '584', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/584'}, {'name': '20010716 McAfee ASaP Virusscan - MyCIO HTTP Server Directory Traversal Vul nerability', 'tags': ['mailing-list', 'x_refsource_NTBUGTRAQ'], 'url': 'http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0107&L=ntbugtraq&F=P&S=&P=1558'}]
CVE State: PUBLISHED
Explain CVE-2001-1145
fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories.
Affected Products: n/a
References: [{'name': 'FreeBSD-SA-01:40', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:40.fts.v1.1.asc'}, {'name': '5466', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/5466'}, {'name': '3205', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3205'}, {'name': '20010530 029: SECURITY FIX: May 30, 2001', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata28.html'}, {'name': 'NetBSD-SA2001-016', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'http://archives.neohapsis.com/archives/netbsd/2001-q3/0204.html'}, {'name': 'bsd-fts-race-condition(8715)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/8715.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1146
AllCommerce with debugging enabled in EnGarde Secure Linux 1.0.1 creates temporary files with predictable names, which allows local users to modify files via a symlink attack.
Affected Products: n/a
References: [{'name': 'ESA-20010711-01', 'tags': ['vendor-advisory', 'x_refsource_ENGARDE'], 'url': 'http://www.linuxsecurity.com/advisories/other_advisory-1492.html'}, {'name': 'allcommerce-temp-symlink(6830)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6830'}, {'name': '3016', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3016'}]
CVE State: PUBLISHED
Explain CVE-2001-1147
The PAM implementation in /bin/login of the util-linux package before 2.11 causes a password entry to be rewritten across multiple PAM calls, which could provide the credentials of one user to a different user, when used in certain PAM modules such as pam_limits.
Affected Products: n/a
References: [{'name': 'utillinux-pamlimits-gain-privileges(7266)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7266.php'}, {'name': 'M-009', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://www.ciac.org/ciac/bulletins/m-009.shtml'}, {'name': 'RHSA-2001:132', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2001-132.html'}, {'name': 'SuSE-SA:2001:034', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2001_034_shadow_txt.html'}, {'name': '3415', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3415'}, {'name': '20011008 pam_limits.so Bug!!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/219175'}, {'name': 'MDKSA-2001:084', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-084.php3'}]
CVE State: PUBLISHED
Explain CVE-2001-1148
Multiple buffer overflows in programs used by scoadmin and sysadmsh in SCO OpenServer 5.0.6a and earlier allow local users to gain privileges via a long TERM environment variable to (1) atcronsh, (2) auditsh, (3) authsh, (4) backupsh, (5) lpsh, (6) sysadm.menu, or (7) termsh.
Affected Products: n/a
References: [{'name': '20010613 SCO atcronsh auditsh termsh overflows', 'tags': ['mailing-list', 'x_refsource_VULN-DEV'], 'url': 'http://www.securityfocus.com/archive/82/191216'}, {'name': 'openserver-scoadmin-sysadm-bo(7281)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7281'}, {'name': 'CSSA-2001-SCO.25', 'tags': ['vendor-advisory', 'x_refsource_CALDERA'], 'url': 'http://www.securityfocus.com/archive/1/219966'}]
CVE State: PUBLISHED
Explain CVE-2001-1149
Panda Antivirus Platinum before 6.23.00 allows a remore attacker to cause a denial of service (crash) when a user selects an action for a malformed UPX packed executable file.
Affected Products: n/a
References: [{'name': '20010821 RE: Bug report -- Incident number 240649', 'tags': ['mailing-list', 'x_refsource_VULN-DEV'], 'url': 'http://www.securityfocus.com/archive/82/209328'}, {'name': '5456', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/5456'}]
CVE State: PUBLISHED
Explain CVE-2001-1150
Vulnerability in cgiWebupdate.exe in Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.5.2 through 3.5.4 allows remote attackers to read arbitrary files.
Affected Products: n/a
References: [{'name': 'officescan-iuser-read-files(7014)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7014.php'}, {'name': '20010824 [SNS Advisory No.40] TrendMicro OfficeScan Corp Edition ver.3.54 Remote read file of IUSER authority Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/210087'}, {'name': '20010822 [SNS Advisory No.38] Trend Micro Virus Buster (Ver.3.5x) Remote', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/209375'}, {'name': '3216', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3216'}]
CVE State: PUBLISHED
Explain CVE-2001-1151
Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.53 allows remote attackers to access sensitive information from the hotdownload directory without authentication, such as the ofcscan.ini configuration file, which contains a weakly encrypted password.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionID=318'}, {'name': 'officescan-config-file-access(7286)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7286'}, {'name': '20011015 [SNS Advisory No.44] Trend Micro OfficeScan Corporate Edition(Virus Buster Corporate Edition)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/220666'}]
CVE State: PUBLISHED
Explain CVE-2001-1152
Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.mimesweeper.com/support/technotes/notes/1043.asp'}, {'name': '20010905 Various problems in Baltimore WebSweeper URL filtering', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/212283'}, {'name': '3296', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/cgi-bin/vulns-item.pl?section=info&id=3296'}]
CVE State: PUBLISHED
Explain CVE-2001-1153
lpsystem in OpenUnix 8.0.0 allows local users to cause a denial of service and possibly execute arbitrary code via a long command line argument.
Affected Products: n/a
References: [{'name': 'CSSA-2001-SCO.15', 'tags': ['vendor-advisory', 'x_refsource_CALDERA'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2001-08/0391.html'}, {'name': '3248', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3248'}, {'name': 'openunix-lpsystem-bo(7041)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7041.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1154
Cyrus 2.0.15, 2.0.16, and 1.6.24 on BSDi 4.2, with IMAP enabled, allows remote attackers to cause a denial of service (hang) using PHP IMAP clients.
Affected Products: n/a
References: [{'name': 'cyrus-imap-php-dos(7053)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/7053'}, {'name': '20010830 Possible Denial of Service with PHP and Cyrus IMAP on BSDi 4.2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/211056'}, {'name': '3260', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3260'}]
CVE State: PUBLISHED
Explain CVE-2001-1155
TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing.
Affected Products: n/a
References: [{'name': '5454', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/5454'}, {'name': 'FreeBSD-SA-01:56', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:56.tcp_wrappers.asc'}]
CVE State: PUBLISHED
Explain CVE-2001-1156
TYPSoft FTP 0.95 allows remote attackers to cause a denial of service (CPU consumption) via a "../../*" argument to (1) STOR or (2) RETR.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://membres.lycos.fr/typsoft/eng/history.html'}, {'name': '20011008 [ASGUARD-LABS] TYPSoft FTP Server v0.95 STOR/RETR Denial of Service Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/219167'}, {'name': '3409', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3409'}, {'name': 'typsoft-ftp-retr-stor-dos(7247)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7247.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1157
Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode.
Affected Products: n/a
References: [{'name': "20010812 Various problems in Baltimore's WEBSweeper Script filter ing", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/203821'}, {'name': '3172', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3172'}, {'name': '3173', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3173'}]
CVE State: PUBLISHED
Explain CVE-2001-1158
Check Point VPN-1/FireWall-1 4.1 base.def contains a default macro, accept_fw1_rdp, which can allow remote attackers to bypass intended restrictions with forged RDP (internal protocol) headers to UDP port 259 of arbitrary hosts.
Affected Products: n/a
References: [{'name': '2952', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/2952'}, {'name': '20010709 Check Point FireWall-1 RDP Bypass Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2001-07/0128.html'}, {'name': '20010712 RDP Bypass workaround for VPN-1/FireWall 4.1 SPx', 'tags': ['vendor-advisory', 'x_refsource_CHECKPOINT'], 'url': 'http://www.checkpoint.com/techsupport/alerts/rdp.html'}, {'name': 'VU#310295', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/310295'}, {'name': 'CA-2001-17', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.cert.org/advisories/CA-2001-17.html'}, {'name': 'L-109', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://ciac.llnl.gov/ciac/bulletins/l-109.shtml'}, {'name': '20010709 Check Point response to RDP Bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://online.securityfocus.com/cgi-bin/archive.pl?id=1&start=2002-03-11&end=2002-03-17&mid=195647&threads=1'}, {'name': '1884', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/1884'}, {'name': 'fw1-rdp-bypass(6815)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6815'}]
CVE State: PUBLISHED
Explain CVE-2001-1159
load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP.
Affected Products: n/a
References: [{'name': '20010702 (SRADV00010) Remote command execution vulnerabilities in SquirrelMail', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2001-07/0029.html'}, {'name': '2968', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/2968'}, {'name': 'squirrelmail-loadprefs-execute-code(6775)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/6775.php'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.squirrelmail.org/changelog.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1160
udirectory.pl in Microburst Technologies uDirectory 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the category_file field.
Affected Products: n/a
References: [{'name': 'udirectory-remote-command-execution(6706)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6706'}, {'name': '2884', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/2884'}, {'name': '20010618 udirectory from Microburst Technologies remote command execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/191829'}]
CVE State: PUBLISHED
Explain CVE-2001-1161
Cross-site scripting (CSS) vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script.
Affected Products: n/a
References: [{'name': 'lotus-domino-css(6789)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/6789.php'}, {'name': '2962', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/2962'}, {'name': '20010702 Re: Lotus Domino Server Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/194609'}, {'name': 'VU#642239', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/642239'}, {'name': '1887', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/1887'}, {'name': '20010702 Lotus Domino Server Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/194465'}]
CVE State: PUBLISHED
Explain CVE-2001-1162
Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file.
Affected Products: n/a
References: [{'name': 'MDKSA-2001-062', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-062.php3'}, {'name': 'HPSBUX0107-157', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/advisories/3423'}, {'name': 'DSA-065', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2001/dsa-065'}, {'name': '2928', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/2928'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://us1.samba.org/samba/whatsnew/macroexploit.html'}, {'name': 'CSSA-2001-024.0', 'tags': ['vendor-advisory', 'x_refsource_CALDERA'], 'url': 'http://www.calderasystems.com/support/security/advisories/CSSA-2001-024.0.txt'}, {'name': 'IMNX-2001-70-027-01', 'tags': ['vendor-advisory', 'x_refsource_IMMUNIX'], 'url': 'http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-027-01'}, {'name': 'RHSA-2001:086', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2001-086.html'}, {'name': 'samba-netbios-file-creation(6731)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/6731'}, {'name': '20010623 smbd remote file creation vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/193027'}, {'name': 'CLA-2001:405', 'tags': ['vendor-advisory', 'x_refsource_CONECTIVA'], 'url': 'http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000405'}, {'name': 'L-105', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://ciac.llnl.gov/ciac/bulletins/l-105.shtml'}, {'name': '20011002-01-P', 'tags': ['vendor-advisory', 'x_refsource_SGI'], 'url': 'ftp://patches.sgi.com/support/free/security/advisories/20011002-01-P'}]
CVE State: PUBLISHED
Explain CVE-2001-1163
Buffer overflow in Munica Corporation NetSQL 1.0 allows remote attackers to execute arbitrary code via a long CONNECT argument to port 6500.
Affected Products: n/a
References: [{'name': '2885', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/2885'}]
CVE State: PUBLISHED
Explain CVE-2001-1164
Buffer overflow in uucp utilities in UnixWare 7 allows local users to execute arbitrary code via long command line arguments to (1) uucp, (2) uux, (3) bnuconvert, (4) uucico, (5) uuxcmd, or (6) uuxqt.
Affected Products: n/a
References: [{'name': 'CSSA-2001-SCO.4', 'tags': ['vendor-advisory', 'x_refsource_CALDERA'], 'url': 'ftp://stage.caldera.com/pub/security/unixware/CSSA-2001-SCO.4/CSSA-2001-SCO.4.txt'}]
CVE State: PUBLISHED
Explain CVE-2001-1165
Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which allows local users to gain privileges by decrypting the information, e.g., with the Disengage tool.
Affected Products: n/a
References: [{'name': '3213', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3213'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securemac.com/fileguard.php#disengage'}, {'name': 'fileguard-weak-password-encryption(7018)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7018.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1166
linprocfs on FreeBSD 4.3 and earlier does not properly restrict access to kernel memory, which allows one process with debugging rights on a privileged process to read restricted memory from that process.
Affected Products: n/a
References: [{'name': 'FreeBSD-SA-01:55', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:55.procfs.asc'}, {'name': '1938', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/1938'}, {'name': '3217', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/3217'}, {'name': 'linprocfs-process-memory-leak(7017)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://www.iss.net/security_center/static/7017.php'}]
CVE State: PUBLISHED
Explain CVE-2001-1168
Directory traversal vulnerability in index.php in PhpMyExplorer before 1.2.1 allows remote attackers to read arbitrary files via a ..%2F (modified dot dot) in the chemin parameter.
Affected Products: n/a
References: [{'name': '20010829 eRisk Security Advisory:  PhpMyExplorer vulnerable to directory traversal.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2001-08/0408.html'}, {'name': '20010830 Re: eRisk Security Advisory:  PhpMyExplorer vulnerable to directory traversal.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2001-08/0418.html'}]
CVE State: PUBLISHED
Explain CVE-2001-1169
keyinit in S/Key does not require authentication to initialize a one-time password sequence, which allows an attacker who has gained privileges to a user account to create new one-time passwords for use in other activities that may use S/Key authentication, such as sudo.
Affected Products: n/a
References: [{'name': '20010902 S/Key keyinit(1) authentication (lack thereof) + sudo(1)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2001-08/0441.html'}]
CVE State: PUBLISHED