DuyTa/cve-kgrag-db huggingface dataset:
CVE-2001-1081
Format string vulnerabilities in Livingston/Lucent RADIUS before 2.1.va.1 may allow local or remote attackers to cause a denial of service and possibly execute arbitrary code via format specifiers that are injected into log messages.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: radius
References: http://archives.neohapsis.com/archives/apps/freshmeat/2001-07/0009.html, http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html, http://freshmeat.net/releases/52020/
CVE-2001-1066
ns6install installation script for Netscape 6.01 on Solaris, and other versions including 6.2.1 beta, allows local users to overwrite arbitrary files via a symlink attack.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: solaris
References: http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0036.html, http://marc.info/?l=bugtraq&m=99893667921216&w=2, http://www.securityfocus.com/bid/3243
CVE-2001-1201
Buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: wmcube_gdk
References: http://marc.info/?l=bugtraq&m=100863301405266&w=2, http://online.securityfocus.com/archive/1/246273, http://www.iss.net/security_center/static/7720.php
CVE-2001-0495
Directory traversal in DataWizard WebXQ server 1.204 allows remote attackers to view files outside of the web root via a .. (dot dot) attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webxq
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0490.html, http://www.osvdb.org/1799, http://www.securityfocus.com/bid/2660
CVE-2001-1377
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: xtradius, openradius, freeradius, radiusclient, yard_radius
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:02.asc, http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466
CVE-2001-0788
Internet Software Solutions Air Messenger LAN Server (AMLServer) 3.4.2 allows remote attackers to obtain an absolute path for the server directory by viewing the Location header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: air_messenger_lan_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0228.html, http://www.securityfocus.com/bid/2881, http://archives.neohapsis.com/archives/bugtraq/2001-06/0228.html
CVE-2001-0959
Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$, which allows remote attackers to obtain sensitive information and overwrite critical files.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: arcserve_backup_2000, arcserve_backup
References: http://archives.neohapsis.com/archives/bugtraq/2001-09/0137.html, http://support.ca.com/Download/patches/asitnt/QO00945.html, http://www.osvdb.org/5483
CVE-2001-1376
Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xtradius, openradius, freeradius, radiusclient, yard_radius
References: http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466, http://marc.info/?l=bugtraq&m=101537153021792&w=2
CVE-2001-0926
SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page, in which the request's body has an #include statement.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jrun
References: http://marc.info/?l=bugtraq&m=100697797325013&w=2, http://www.macromedia.com/v1/handlers/index.cfm?ID=22261&Method=Full, http://www.securityfocus.com/bid/3589
CVE-2001-0819
A buffer overflow in Linux fetchmail before 5.8.6 allows remote attackers to execute arbitrary code via a large 'To:' field in an email header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: fetchmail
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:43.fetchmail.asc, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000403, http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-025-01
CWE: CWE-119
CVE-2001-1335
Directory traversal vulnerability in CesarFTP 0.98b and earlier allows remote authenticated users (such as anonymous) to read arbitrary files via a GET with a filename that contains a ...%5c (modified dot dot).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: cesarftp
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0252.html, http://www.iss.net/security_center/static/6606.php, http://www.securityfocus.com/bid/2786
CVE-2001-1203
Format string vulnerability in gpm-root in gpm 1.17.8 through 1.17.18 allows local users to gain root privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: gpm
References: http://www.debian.org/security/2001/dsa-095, http://www.securityfocus.com/bid/3750, https://exchange.xforce.ibmcloud.com/vulnerabilities/7748
CVE-2001-1345
bctool in Jetico BestCrypt 0.7 and earlier trusts the user-supplied PATH to find and execute an fsck utility program, which allows local users to gain privileges by modifying the PATH to point to a Trojan horse program.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bestcrypt
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0005.html, http://www.jetico.com/index.htm#/linux.htm, http://www.securityfocus.com/bid/2820
CVE-2001-0674
Directory traversal vulnerability in RobTex Viking Web server before 1.07-381 allows remote attackers to read arbitrary files via a hexadecimal encoded dot-dot attack (eg. http://www.server.com/%2e%2e/%2e%2e) in an HTTP URL request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: viking_server
References: http://www.robtex.com/viking/bugs.htm, http://www.securityfocus.com/archive/1/177231, https://exchange.xforce.ibmcloud.com/vulnerabilities/6394
CVE-2001-0685
Thibault Godouet FCron prior to 1.1.1 allows a local user to corrupt another user's crontab file via a symlink attack on the fcrontab temporary file.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P
Affected Products: fcron
References: http://fcron.free.fr/CHANGES.html, http://marc.info/?l=bugtraq&m=98339581702282&w=2, http://www.securityfocus.com/bid/2835
CVE-2001-0785
Directory traversal in Webpaging interface in Internet Software Solutions Air Messenger LAN Server (AMLServer) 3.4.2 allows allows remote attackers to read arbitrary files via a .. (dot dot) attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: air_messenger_lan_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0228.html, http://www.securityfocus.com/bid/2883, http://archives.neohapsis.com/archives/bugtraq/2001-06/0228.html
CVE-2001-1193
Directory traversal vulnerability in EFTP 2.0.8.346 allows local users to read directories via a ... (modified dot dot) in the CWD command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: eftp
References: http://www.eftp.org/releasehistory.html, http://www.kb.cert.org/vuls/id/413875, http://www.osvdb.org/2003
CVE-2001-0436
dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using a .. (dot dot) in the AZ parameter to reference the program.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dcforum_2000, dcforum
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0269.html, http://www.dcscripts.com/FAQ/sec_2001_03_31.html, http://www.osvdb.org/3862
CVE-2001-1034
Format string vulnerability in Hylafax on FreeBSD allows local users to execute arbitrary code via format specifiers in the -h hostname argument for (1) faxrm or (2) faxalter.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: freebsd
References: http://www.securityfocus.com/archive/1/215984, http://www.securityfocus.com/bid/3357, https://exchange.xforce.ibmcloud.com/vulnerabilities/7164
CVE-2001-0258
The Easycom/Safecom Print Server (firmware 404.590) PrintGuide server allows remote attackers to cause a denial of service via a large number of connections that send null characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: easycom_safecom_print_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0375.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/5989, http://archives.neohapsis.com/archives/bugtraq/2001-01/0375.html
CVE-2001-0029
Buffer overflow in oops WWW proxy server 1.4.6 (and possibly other versions) allows remote attackers to execute arbitrary commands via a long host or domain name that is obtained from a reverse DNS lookup.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: oops_proxy_server
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0158.html, http://www.securityfocus.com/bid/2099, http://zipper.paco.net/~igor/oops/ChangeLog
CVE-2001-0646
Maxum Rumpus FTP Server 1.3.3 and 2.0.3 dev 3 allows a remote attacker to perform a denial of service (hang) by creating a directory name of a specific length.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: rumpus_ftp_server
References: http://www.securityfocus.com/archive/1/184751, http://www.securityfocus.com/bid/2716, https://exchange.xforce.ibmcloud.com/vulnerabilities/6542
CVE-2001-0230
Buffer overflow in dc20ctrl before 0.4_1 in FreeBSD, and possibly other operating systems, allows local users to gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freebsd
References: http://archives.neohapsis.com/archives/freebsd/2001-02/0083.html, http://www.osvdb.org/6081, https://exchange.xforce.ibmcloud.com/vulnerabilities/6077
CVE-2001-0146
IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_services, exchange_server
References: http://www.kb.cert.org/vuls/id/796584, http://www.securityfocus.com/bid/2440, http://www.securityfocus.com/bid/2441
CVE-2001-0028
Buffer overflow in the HTML parsing code in oops WWW proxy server 1.5.2 and earlier allows remote attackers to execute arbitrary commands via a large number of " (quotation) characters.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: oops_proxy_server
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0127.html, http://archives.neohapsis.com/archives/freebsd/2000-12/0418.html, http://www.securityfocus.com/bid/2099
CVE-2001-0748
Acme.Serve 1.7, as used in Cisco Secure ACS Unix and possibly other products, allows remote attackers to read arbitrary files by prepending several / (slash) characters to the URI.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: acme_server
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.cisco.com/warp/public/707/acmeweb-acsunix-dirtravers-vuln-pub.shtml, http://www.iss.net/security_center/static/6634.php, http://www.osvdb.org/5544
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2001-0397
Buffer overflow in Silent Runner Collector (SRC) 1.6.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long SMTP HELO command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: silent_runner_collector_src
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0454.html, http://archives.neohapsis.com/archives/bugtraq/2001-03/0454.html
CVE-2001-1528
AmTote International homebet program returns different error messages when invalid account numbers and PIN codes are provided, which allows remote attackers to determine the existence of valid account numbers via a brute force attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: homebet
Related CWEs: CWE-203
Related CAPECs: CAPEC-189
References: http://archives.neohapsis.com/archives/bugtraq/2001-09/0235.html, http://www.iss.net/security_center/static/7185.php, http://www.securityfocus.com/bid/3371
CWE: CWE-203
CVE-2001-1320
Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: keyserver
References: http://ciac.llnl.gov/ciac/bulletins/l-116.shtml, http://www.cert.org/advisories/CA-2001-18.html, http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/
CVE-2001-0568
Digital Creations Zope 2.3.1 b1 and earlier allows a local attacker (Zope user) with through-the-web scripting capabilities to alter ZClasses class attributes.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: zope
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000382, http://www.debian.org/security/2001/dsa-043, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-025.php3
CVE-2001-0394
Remote manager service in Website Pro 3.0.37 allows remote attackers to cause a denial of service via a series of malformed HTTP requests to the /dyn directory.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: website_pro
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0425.html, http://www.osvdb.org/5669, https://exchange.xforce.ibmcloud.com/vulnerabilities/6295
CVE-2001-0516
Oracle listener between Oracle 9i and Oracle 8.0 allows remote attackers to cause a denial of service via a malformed connection packet that contains an incorrect requester_version value that does not match an expected offset to the data.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: oracle8i, oracle9i
References: http://otn.oracle.com/deploy/security/pdf/net8_dos_alert.pdf, http://xforce.iss.net/alerts/advise82.php, http://otn.oracle.com/deploy/security/pdf/net8_dos_alert.pdf
CVE-2001-0502
Running Windows 2000 LDAP Server over SSL, a function does not properly check the permissions of a user request when the directory principal is a domain user and the data attribute is the domain password, which allows local users to modify the login password of other users.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000
References: http://www.ciac.org/ciac/bulletins/l-101.shtml, http://www.securityfocus.com/bid/2929, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-036
CVE-2001-1071
Cisco IOS 12.2 and earlier running Cisco Discovery Protocol (CDP) allows remote attackers to cause a denial of service (memory consumption) via a flood of CDP neighbor announcements.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ios, catos
References: http://www.kb.cert.org/vuls/id/139491, http://www.osvdb.org/1969, http://www.securityfocus.com/archive/1/219257
CVE-2001-1232
GroupWise WebAccess 5.5 with directory indexing enabled allows a remote attacker to view arbitrary directory contents via an HTTP request with a lowercase "get".
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: groupwise
References: http://www.securityfocus.com/archive/1/204875, http://www.securityfocus.com/bid/3188, https://exchange.xforce.ibmcloud.com/vulnerabilities/6988
CVE-2001-1570
Windows XP with fast user switching and account lockout enabled allows local users to deny user account access by setting the fast user switch to the same user (self) multiple times, which causes other accounts to be locked out.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_xp
References: http://archives.neohapsis.com/archives/bugtraq/2001-12/0213.html, http://www.iss.net/security_center/static/7731.php, http://www.securityfocus.com/bid/3717
CVE-2001-0077
The clustmon service in Sun Cluster 2.x does not require authentication, which allows remote attackers to obtain sensitive information such as system logs and cluster configurations.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: cluster
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0180.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6123, http://archives.neohapsis.com/archives/bugtraq/2000-12/0180.html
CVE-2001-0809
Vulnerability in CIFS/9000 Server (SAMBA) A.01.06 and earlier in HP-UX 11.0 and 11.11, when configured as a print server, allows local users to overwrite arbitrary files by modifying certain resources.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: hp-ux
References: http://archives.neohapsis.com/archives/hp/2001-q2/0074.html, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5673, http://archives.neohapsis.com/archives/hp/2001-q2/0074.html
CVE-2001-0859
2.4.3-12 kernel in Red Hat Linux 7.1 Korean installation program sets the setting default umask for init to 000, which installs files with world-writeable permissions.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: linux
References: http://online.securityfocus.com/advisories/3725, http://www.redhat.com/support/errata/RHSA-2001-148.html, http://www.securityfocus.com/bid/3527
CVE-2001-0401
Buffer overflow in tip in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0394.html, http://www.securityfocus.com/bid/2475, https://exchange.xforce.ibmcloud.com/vulnerabilities/6284
CVE-2001-0191
gnuserv before 3.12, as shipped with XEmacs, does not properly check the specified length of an X Windows MIT-MAGIC-COOKIE cookie, which allows remote attackers to execute arbitrary commands via a buffer overflow, or brute force authentication by using a short cookie length.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: gnuserv, xemacs
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0030.html, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-019.php3, http://www.redhat.com/support/errata/RHSA-2001-010.html
CWE: CWE-120
CVE-2001-0831
Unknown vulnerability in Oracle Label Security in Oracle 8.1.7 and 9.0.1, when audit functionality, SET_LABEL, or SQL*Predicate is being used, allows local users to gain additional access.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: database_server
References: http://marc.info/?l=bugtraq&m=100386756715645&w=2, http://otn.oracle.com/deploy/security/pdf/OLS817alert.pdf, http://www.iss.net/security_center/static/7344.php
CVE-2001-0170
glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: debian_linux, immunix, linux
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0131.html, http://archives.neohapsis.com/archives/bugtraq/2001-01/0186.html, http://www.redhat.com/support/errata/RHSA-2001-001.html
CVE-2001-0828
A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: resin
References: http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html, http://www.caucho.com/products/resin/changes.xtp, http://www.kb.cert.org/vuls/id/981651
CVE-2001-0853
Directory traversal vulnerability in Entrust GetAccess allows remote attackers to read arbitrary files via a .. (dot dot) in the locale parameter to (1) helpwin.gas.bat or (2) AboutBox.gas.bat.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: getaccess
References: http://archives.neohapsis.com/archives/bugtraq/2001-11/0022.html, http://marc.info/?l=bugtraq&m=100498111712723&w=2, http://www.kb.cert.org/vuls/id/243243
CVE-2001-0206
Directory traversal vulnerability in Soft Lite ServerWorx 3.00 allows remote attackers to read arbitrary files by inserting a .. (dot dot) or ... into the requested pathname of an HTTP GET request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: serverworx
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0137.html, http://www.securityfocus.com/bid/2346, http://archives.neohapsis.com/archives/bugtraq/2001-02/0137.html
CVE-2001-1330
Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0133.html, http://archives.neohapsis.com/archives/bugtraq/2001-06/0133.html
CVE-2001-0031
BroadVision One-To-One Enterprise allows remote attackers to determine the physical path of server files by requesting a .JSP file name that does not exist.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: one-to-one_enterprise_server
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0074.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/5661, http://archives.neohapsis.com/archives/bugtraq/2000-12/0074.html
CVE-2001-0337
The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of service via a series of requests.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_server
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026
CVE-2001-0877
Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service via (1) a spoofed SSDP advertisement that causes the client to connect to a service on another machine that generates a large amount of traffic (e.g., chargen), or (2) via a spoofed SSDP announcement to broadcast or multicast addresses, which could cause all UPnP clients to send traffic to a single target system.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_me, windows_xp, windows_98se, windows_98
References: http://marc.info/?l=bugtraq&m=100887440810532&w=2, http://marc.info/?l=ntbugtraq&m=100887271006313&w=2, http://www.cert.org/advisories/CA-2001-37.html
CVE-2001-1502
webcart.cgi in Mountain Network Systems WebCart 8.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEXTPAGE parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webcart
References: http://www.securityfocus.com/archive/1/221688, http://www.securityfocus.com/bid/3453, https://exchange.xforce.ibmcloud.com/vulnerabilities/7315
CVE-2001-1410
Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: internet_explorer
References: http://marc.info/?l=bugtraq&m=105820229407274&w=2, http://marc.info/?l=bugtraq&m=105829174431769&w=2, http://www.doxdesk.com/personal/posts/bugtraq/20030713-ie/
CVE-2001-0615
Directory traversal vulnerability in Faust Informatics Freestyle Chat server prior to 4.1 SR3 allows a remote attacker to read arbitrary files via a specially crafted URL which includes variations of a '..' (dot dot) attack such as '...' or '....'.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: freestyle_chat
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0241.html, http://www.osvdb.org/1841, http://www.securityfocus.com/bid/2776
CVE-2001-0385
GoAhead webserver 2.1 allows remote attackers to cause a denial of service via an HTTP request to the /aux directory.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: goahead_webserver
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0281.html, http://freecode.com/projects/embedthis-goahead-webserver/releases/343539, http://osvdb.org/81099
CVE-2001-0254
FaSTream FTP++ Server 2.0 allows remote attackers to obtain the real pathname of the server via the "pwd" command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ftp\+\+_server
References: http://marc.info/?l=bugtraq&m=98021181215325&w=2, http://marc.info/?l=bugtraq&m=98021181215325&w=2
CVE-2001-0590
Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tomcat
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0031.html, http://www.osvdb.org/5580, http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0112-004
CVE-2001-1327
pmake before 2.1.35 in Turbolinux 6.05 and earlier is installed with setuid root privileges, which could allow local users to gain privileges by exploiting vulnerabilities in pmake or programs that are used by pmake.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pmake
References: http://www.iss.net/security_center/static/9988.php, http://www.turbolinux.com/pipermail/tl-security-announce/2001-May/000313.html, http://www.iss.net/security_center/static/9988.php
CVE-2001-0851
Linux kernel 2.0, 2.2 and 2.4 with syncookies enabled allows remote attackers to bypass firewall rules by brute force guessing the cookie.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: suse_linux, openlinux_edesktop, openlinux, linux_kernel, openlinux_eserver
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000432, http://www.caldera.com/support/security/advisories/CSSA-2001-038.0.txt, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-082.php3
CVE-2001-1065
Web-based configuration utility in Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap binds itself to port 80 even when web-based configuration services are disabled, which could leave the router open to attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: cbos
References: http://www.cisco.com/warp/public/707/cisco-cbos-webserver-pub.shtml, https://exchange.xforce.ibmcloud.com/vulnerabilities/7027, http://www.cisco.com/warp/public/707/cisco-cbos-webserver-pub.shtml