DuyTa/cve-kgrag-db huggingface dataset:
CVE-2001-0358
Buffer overflows in Sierra Half-Life build 1573 and earlier allow remote attackers to execute arbitrary code via (1) a long map command, (2) a long exec command, or (3) long input in a configuration file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: half-life
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0111.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6218, https://exchange.xforce.ibmcloud.com/vulnerabilities/6221
CVE-2001-0405
ip_conntrack_ftp in the IPTables firewall for Linux 2.4 allows remote attackers to bypass access restrictions for an FTP server via a PORT command that lists an arbitrary IP address and port number, which is added to the RELATED table and allowed by the firewall.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: linux_kernel
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0271.html, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-071.php3, http://www.redhat.com/support/errata/RHSA-2001-052.html
CVE-2001-0377
Infradig Inframail prior to 3.98a allows a remote attacker to create a denial of service via a malformed POST request which includes a space followed by a large string.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: inframail
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0428.html, http://www.osvdb.org/5685, https://exchange.xforce.ibmcloud.com/vulnerabilities/6297
CVE-2001-1497
Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ie, internet_explorer
References: http://www.iss.net/security_center/static/7592.php, http://www.securityfocus.com/archive/1/241323, http://www.securityfocus.com/archive/1/241400
CVE-2001-1023
Xcache 2.1 allows remote attackers to determine the absolute path of web server documents by requesting a URL that is not cached by Xcache, which returns the full pathname in the Content-PageName header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: xcache
References: http://archives.neohapsis.com/archives/bugtraq/2001-09/0182.html, http://www.securityfocus.com/bid/3352, https://exchange.xforce.ibmcloud.com/vulnerabilities/7159
CVE-2001-0925
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: debian_linux, http_server
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://www.apacheweek.com/features/security-13, http://www.debian.org/security/2001/dsa-067, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3
CWE: CWE-22
CVE-2001-0183
ipfw and ip6fw in FreeBSD 4.2 and earlier allows remote attackers to bypass access restrictions by setting the ECE flag in a TCP packet, which makes the packet appear to be part of an established connection.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freebsd
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:08.ipfw.asc, http://www.ciac.org/ciac/bulletins/l-029.shtml, http://www.osvdb.org/1743
CVE-2001-1490
Mozilla 0.9.6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mozilla
References: http://www.securityfocus.com/archive/1/245152, http://www.securityfocus.com/bid/3684, https://exchange.xforce.ibmcloud.com/vulnerabilities/7709
CVE-2001-0737
A long 'synch' delay in Logitech wireless mice and keyboard receivers allows a remote attacker to hijack connections via a man-in-the-middle attack.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cordless_freedom_pro, cordless_freedom_navigator, cordless_freedom, cordless_itouch_keyboard
References: http://www.securityfocus.com/archive/1/185003, http://www.securityfocus.com/archive/1/3B0A36C8.E9D8610%40daten-treuhand.de, http://www.securityfocus.com/bid/2738
CVE-2001-0694
Directory traversal vulnerability in WFTPD 3.00 R5 allows a remote attacker to view arbitrary files via a dot dot attack in the CD command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: wftpd
References: http://archives.neohapsis.com/archives/vuln-dev/2001-q2/0454.html, http://archives.neohapsis.com/archives/vuln-dev/2001-q2/0454.html
CVE-2001-1538
SpeedXess HA-120 DSL router has a default administrative password of "speedxess", which allows remote attackers to gain access.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ha-120_dsl_router
References: http://archives.neohapsis.com/archives/bugtraq/2001-12/0032.html, http://www.iss.net/security_center/static/7655.php, http://www.securityfocus.com/bid/3617
CVE-2001-0965
glFTPD 1.23 allows remote attackers to cause a denial of service (CPU consumption) via a LIST command with an argument that contains a large number of * (asterisk) characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: glftpd
References: http://archives.neohapsis.com/archives/bugtraq/2001-08/0239.html, http://www.glftpd.org/, http://www.iss.net/security_center/static/7001.php
CVE-2001-0138
privatepw program in wu-ftpd before 2.6.1-6 allows local users to overwrite arbitrary files via a symlink attack.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: debian_linux, linux, mandrake_linux_corporate_server, mandrake_linux, immunix
References: http://marc.info/?l=bugtraq&m=97916374410647&w=2, http://www.debian.org/security/2001/dsa-016, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-001.php3
CVE-2001-0133
The web administration interface for Interscan VirusWall 3.6.x and earlier does not use encryption, which could allow remote attackers to obtain the administrator password to sniff the administrator password via the setpasswd.cgi program or other HTTP GET requests that contain base64 encoded usernames and passwords.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: interscan_viruswall
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0235.html, http://www.securityfocus.com/bid/2212, http://archives.neohapsis.com/archives/bugtraq/2001-01/0235.html
CVE-2001-0818
A buffer overflow the '\s' console command in MDBMS 0.99b9 and earlier allows remote attackers to execute arbitrary commands by sending the command a large amount of data.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mdbms
References: http://www.securityfocus.com/archive/1/190933, http://www.securityfocus.com/bid/2867, https://exchange.xforce.ibmcloud.com/vulnerabilities/6700
CVE-2001-1048
AWOL PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: awol
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html, http://www.geocrawler.com/archives/3/14414/2001/9/0/6668723/, http://www.gospelcom.net/mnn/topher/awol/changelog.php
CVE-2001-0226
Directory traversal vulnerability in BiblioWeb web server 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) or ... attack in an HTTP GET request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: biblioweb_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0075.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0075.html
CVE-2001-0303
tstisapi.dll in Pi3Web 1.0.1 web server allows remote attackers to determine the physical path of the server via a URL that requests a non-existent file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: pi3web
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0316.html, http://www.securityfocus.com/bid/2381, http://archives.neohapsis.com/archives/bugtraq/2001-02/0316.html
CVE-2001-0919
Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when a cookie is set using Javascript.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://marc.info/?l=bugtraq&m=100679857614967&w=2, http://marc.info/?l=bugtraq&m=100679857614967&w=2
CVE-2001-0616
Faust Informatics Freestyle Chat server prior to 4.1 SR3 allows a remote attacker to create a denial of service via a URL request which includes a MS-DOS device name (e.g., GET /aux HTTP/1.0).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: freestyle_chat
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0241.html, http://www.securityfocus.com/bid/2777, https://exchange.xforce.ibmcloud.com/vulnerabilities/6602
CVE-2001-0763
Buffer overflow in Linux xinetd 2.1.8.9pre11-1 and earlier may allow remote attackers to execute arbitrary code via a long ident response, which is not properly handled by the svc_logprint function.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, suse_linux
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0064.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000404, http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-024-01
CVE-2001-0872
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: suse_linux, openssh, linux
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2001-042.1.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000446, http://frontal2.mandriva.com/security/advisories?name=MDKSA-2001:092
CVE-2001-1394
Signedness error in (1) getsockopt and (2) setsockopt for Linux kernel before 2.2.19 allows local users to cause a denial of service.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel
References: http://marc.info/?l=bugtraq&m=98575345009963&w=2, http://marc.info/?l=bugtraq&m=98637996127004&w=2, http://marc.info/?l=bugtraq&m=98653252326445&w=2
CVE-2001-0193
Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: debian_linux, suse_linux
References: http://marc.info/?l=bugtraq&m=98096782126481&w=2, http://www.debian.org/security/2001/dsa-028, http://www.securityfocus.com/bid/2327
CVE-2001-0963
Directory traversal vulnerability in SpoonFTP 1.1 allows local and sometimes remote attackers to access files outside of the FTP root via a ... (modified dot dot) in the CD (CWD) command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: spoonftp
References: http://archives.neohapsis.com/archives/bugtraq/2001-09/0171.html, http://www.osvdb.org/1953, http://www.pi-soft.com/spoonftp/index.shtml
CVE-2001-1078
Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format specifiers in the SMTP commands (1) HELO, (2) EHLO, (3) MAIL FROM, or (4) RCPT TO, and the POP3 commands (5) USER and (6) other commands that can be executed after POP3 authentication.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: extremail
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0291.html, http://www.extremail.com/history.htm, http://www.extremail.com/news.htm
CVE-2001-0330
Bugzilla 2.10 allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for the globals.pl file, which is normally returned by the web server without being executed.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bugzilla
References: http://www.atstake.com/research/advisories/2001/a043001-1.txt, http://www.securityfocus.com/bid/2671, https://exchange.xforce.ibmcloud.com/vulnerabilities/6489
CVE-2001-0675
Rit Research Labs The Bat! 1.51 for Windows allows a remote attacker to cause a denial of service by sending an email to a user's account containing a carriage return <CR> that is not followed by a line feed <LF>.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: the_bat
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0345.html, http://archives.neohapsis.com/archives/bugtraq/2001-04/0381.html, http://archives.neohapsis.com/archives/bugtraq/2001-04/0410.html
CVE-2001-1537
The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: twig
Related CWEs: CWE-312
Related CAPECs: CAPEC-37
MITRE ATT&CK Techniques: T1005, T1552.004
MITRE ATT&CK Tactics: T1552
References: http://archives.neohapsis.com/archives/bugtraq/2001-11/0245.html, http://www.iss.net/security_center/static/7619.php, http://www.securityfocus.com/bid/3591
CWE: CWE-312
MITRE ATT&CK techniques: T1005, T1552.004
MITRE ATT&CK tactics: T1552
CVE-2001-0176
The setuid doroot program in Voyant Sonata 3.x executes arbitrary command line arguments, which allows local users to gain root privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sonata
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0278.html, http://www.securityfocus.com/bid/2125, https://exchange.xforce.ibmcloud.com/vulnerabilities/5787
CVE-2001-0682
ZoneAlarm and ZoneAlarm Pro allows a local attacker to cause a denial of service by running a trojan to initialize a ZoneAlarm mutex object which prevents ZoneAlarm from starting.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: zonealarm_pro, zonealarm
Related CWEs: CWE-667
Related CAPECs: CAPEC-25, CAPEC-27, CAPEC-26
MITRE ATT&CK Techniques: T1499.004
MITRE ATT&CK Tactics: T1499
References: http://marc.info/?l=ntbugtraq&m=97818917222992&w=2, https://exchange.xforce.ibmcloud.com/vulnerabilities/5821, http://marc.info/?l=ntbugtraq&m=97818917222992&w=2
CWE: CWE-667
MITRE ATT&CK techniques: T1499.004
MITRE ATT&CK tactics: T1499
CVE-2001-1225
Hughes Technology Mini SQL 2.0.10 through 2.0.12 allows local users to cause a denial of service by creating a very large array in a table, which causes miniSQL to crash when the table is queried.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: msql
References: http://www.iss.net/security_center/static/7746.php, http://www.securityfocus.com/archive/1/247222, http://www.securityfocus.com/bid/3742
CVE-2001-1500
ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: proftpd
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000450, http://www.mandriva.com/security/advisories?name=MDKSA-2002:005, http://www.securityfocus.com/archive/1/212805
CVE-2001-0043
phpGroupWare before 0.9.7 allows remote attackers to execute arbitrary PHP commands by specifying a malicious include file in the phpgw_info parameter of the phpgw.inc.php program.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: phpgroupware
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0053.html, http://sourceforge.net/project/shownotes.php?release_id=17604, http://www.osvdb.org/1682
CVE-2001-1076
Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0076.html, http://www.securityfocus.com/bid/2935, https://exchange.xforce.ibmcloud.com/vulnerabilities/6802
CVE-2001-1127
Buffer overflow in Progress database 8.3D and 9.1C could allow a local user to execute arbitrary code via (1) _proapsv, (2) _mprosrv, (3) _mprshut, (4) orarx, (5) sqlcpp, (6) _probrkr, (7) _sqlschema and (8) _sqldump.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: progress
References: http://www.securityfocus.com/archive/1/218833, http://www.securityfocus.com/bid/3404, https://exchange.xforce.ibmcloud.com/vulnerabilities/7236
CVE-2001-0731
Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: http_server
References: ftp://patches.sgi.com/support/free/security/advisories/20020301-01-P, http://frontal2.mandriva.com/security/advisories?name=MDKSA-2001:077, http://www.apacheweek.com/issues/01-10-05#security
CVE-2001-1289
Quake 3 arena 1.29f and 1.29g allows remote attackers to cause a denial of service (crash) via a malformed connection packet that begins with several char-255 characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: quake_3_arena
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0748.html, http://www.securityfocus.com/bid/3123, http://archives.neohapsis.com/archives/bugtraq/2001-07/0748.html
CVE-2001-0070
Buffer overflow in 1st Up Mail Server 4.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long MAIL FROM command.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: 1st_up_mail_server
References: http://archives.neohapsis.com/archives/win2ksecadvice/2000-q4/0143.html, http://www.securityfocus.com/bid/2152, https://exchange.xforce.ibmcloud.com/vulnerabilities/5808
CVE-2001-0429
Cisco Catalyst 5000 series switches 6.1(2) and earlier will forward an 802.1x frame on a Spanning Tree Protocol (STP) blocked port, which causes a network storm and a denial of service.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: catos
References: http://www.ciac.org/ciac/bulletins/l-072.shtml, http://www.cisco.com/warp/public/707/cat5k-8021x-vuln-pub.shtml, http://www.securityfocus.com/bid/2604
CVE-2001-0225
fortran math component in Infobot 0.44.5.3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: infobot
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0127.html, http://www.securityfocus.com/bid/2349, http://archives.neohapsis.com/archives/bugtraq/2001-02/0127.html
CVE-2001-1005
Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: truesync_desktop
References: http://www.securityfocus.com/archive/1/210067, http://www.securityfocus.com/bid/3231, http://www.securityfocus.com/archive/1/210067
CVE-2001-0777
Omnicron OmniHTTPd 2.0.8 allows remote attackers to cause a denial of service (memory exhaustion) via a series of requests for PHP scripts.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: omnihttpd
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0248.html, http://www.securityfocus.com/bid/2783, https://exchange.xforce.ibmcloud.com/vulnerabilities/6620
CVE-2001-0650
Cisco devices IOS 12.0 and earlier allow a remote attacker to cause a crash, or bad route updates, via malformed BGP updates with unrecognized transitive attribute.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ios
References: http://ciac.llnl.gov/ciac/bulletins/l-082.shtml, http://www.cisco.com/warp/public/707/ios-bgp-attr-corruption-pub.shtml, http://www.kb.cert.org/vuls/id/106392
CVE-2001-1149
Panda Antivirus Platinum before 6.23.00 allows a remore attacker to cause a denial of service (crash) when a user selects an action for a malformed UPX packed executable file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: panda_antivirus_platinum
References: http://www.osvdb.org/5456, http://www.securityfocus.com/archive/82/209328, http://www.osvdb.org/5456
CVE-2001-0467
Directory traversal vulnerability in RobTex Viking Web server before 1.07-381 allows remote attackers to read arbitrary files via a \... (modified dot dot) in an HTTP URL request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: viking_server
References: http://www.robtex.com/files/viking/beta/chglog.txt, http://www.securityfocus.com/archive/1/178935, http://www.securityfocus.com/bid/2643
CVE-2001-0923
RPM Package Manager 4.0.x through 4.0.2.x allows an attacker to execute arbitrary code via corrupted data in the RPM file when the file is queried.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: redhat_package_manager
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000440, http://www.securityfocus.com/archive/1/222542, http://www.securityfocus.com/bid/3472
CVE-2001-0765
BisonFTP V4R1 allows local users to access directories outside of their home directory by uploading .bdl files, which can then be linked to other directories.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bison_ftp_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0025.html, http://www.bisonftp.com/ServRev.htm, http://www.osvdb.org/1888
CVE-2001-1572
The MAC module in Netfilter in Linux kernel 2.4.1 through 2.4.11, when configured to filter based on MAC addresses, allows remote attackers to bypass packet filters via small packets.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: linux_kernel
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0057.html, http://www.iss.net/security_center/static/7267.php, http://www.securityfocus.com/bid/3418
CVE-2001-1487
popauth utility in Qualcomm Qpopper 4.0 and earlier allows local users to overwrite arbitrary files and execute commands as the pop user via a symlink attack on the -trace file option.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: qpopper
References: http://www.securityfocus.com/archive/1/246069, https://exchange.xforce.ibmcloud.com/vulnerabilities/7707, http://www.securityfocus.com/archive/1/246069
CVE-2001-0949
Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 allows remote attackers to execute arbitrary code via long arguments to the parameters (1) Mode, (2) Certificate_File, (3) useExpiredCRLs, (4) listenLength, (5) maxThread, (6) maxConnPerSite, (7) maxMsgLen, (8) exitTime, (9) blockTime, (10) nextUpdatePeriod, (11) buildLocal, (12) maxOCSPValidityPeriod, (13) extension, and (14) a particular combination of parameters associated with private key generation that form a string of a certain length.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: enterprise_validation_authority
References: http://marc.info/?l=bugtraq&m=100749428517090&w=2, http://www.securityfocus.com/bid/3621, http://www.securityfocus.com/bid/3622
CVE-2001-0266
Vulnerability in Software Distributor SD-UX in HP-UX 11.0 and earlier allows local users to gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: hp-ux
References: http://archives.neohapsis.com/archives/hp/2001-q1/0069.html, http://www.osvdb.org/6033, http://archives.neohapsis.com/archives/hp/2001-q1/0069.html
CVE-2001-0758
Directory traversal vulnerability in Shambala 4.5 allows remote attackers to escape the FTP root directory via "CWD ..."  command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: shambala_server
References: http://www.securiteam.com/windowsntfocus/5SP011P4KC.html, http://www.securiteam.com/windowsntfocus/5SP011P4KC.html
CVE-2001-0425
AdLibrary.pm in AdCycle 0.78b allows remote attackers to gain privileges to AdCycle via a malformed Agent: header in the HTTP request, which is inserted into a resulting SQL query that is used to verify login information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: adcycle
References: http://www.securityfocus.com/archive/1/163942, http://www.securityfocus.com/bid/2393, http://www.securityfocus.com/archive/1/163942
CVE-2001-1024
login.gas.bat and other CGI scripts in Entrust getAccess allow remote attackers to execute Java programs, and possibly arbitrary commands, by specifying an alternate -classpath argument.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: getaccess
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0662.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6915, http://archives.neohapsis.com/archives/bugtraq/2001-07/0662.html
CVE-2001-1389
Multiple vulnerabilities in xinetd 2.3.0 and earlier, and additional variants until 2.3.3, may allow remote attackers to cause a denial of service or execute arbitrary code, primarily via buffer overflows or improper NULL termination.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xinetd
References: http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-033-01, http://marc.info/?l=bugtraq&m=99913751525583&w=2, http://rhn.redhat.com/errata/RHSA-2001-109.html
CVE-2001-0416
sgml-tools (aka sgmltools) before 1.0.9-15 creates temporary files with insecure permissions, which allows other users to read files that are being processed by sgml-tools.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: immunix, sgml-tools, mandrake_linux
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000390, http://marc.info/?l=bugtraq&m=98477491130367&w=2, http://www.debian.org/security/2001/dsa-038
CVE-2001-1145
fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: netbsd, openbsd, freebsd
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:40.fts.v1.1.asc, http://archives.neohapsis.com/archives/netbsd/2001-q3/0204.html, http://www.iss.net/security_center/static/8715.php
CVE-2001-0477
Vulnerability in WebCalendar 0.9.26 allows remote command execution.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webcalendar
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0392.html, http://www.securityfocus.com/bid/2639, http://archives.neohapsis.com/archives/bugtraq/2001-04/0392.html
CVE-2001-0255
FaSTream FTP++ Server 2.0 allows remote attackers to list arbitrary directories by using the "ls" command and including the drive letter name (e.g. C:) in the requested pathname.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: fastream_ftp_server, fastream_ftp\+\+_server
References: http://marc.info/?l=bugtraq&m=98021181215325&w=2, http://www.securityfocus.com/bid/2267, https://exchange.xforce.ibmcloud.com/vulnerabilities/5977
CVE-2001-1360
Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sane
References: ftp://ftp.mostang.com/pub/sane/sane-1.0.8/sane-backends-1.0.8.tar.gz, http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html, ftp://ftp.mostang.com/pub/sane/sane-1.0.8/sane-backends-1.0.8.tar.gz
CVE-2001-0579
lpadmin in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow attack in the first argument to the command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openserver
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0421.html, http://security-archive.merton.ox.ac.uk/bugtraq-200104/0221.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6291
CVE-2001-0648
Directory traversal vulnerability in PHProjekt 2.1 and earlier allows a remote attacker to conduct unauthorized activities via a dot dot (..) attack on the file module.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: phprojekt
References: http://www.securityfocus.com/archive/1/184215, http://www.securityfocus.com/bid/2702, https://exchange.xforce.ibmcloud.com/vulnerabilities/6522
CVE-2001-1080
diagrpt in AIX 4.3.x and 5.1 uses the DIAGDATADIR environment variable to find and execute certain programs, which allows local users to gain privileges by modifying the variable to point to a Trojan horse program.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://www-1.ibm.com/services/continuity/recover1.nsf/MSS/MSS-OAR-E01-2001.225.1/%24file/oar225.txt, http://www.securityfocus.com/bid/2916, https://exchange.xforce.ibmcloud.com/vulnerabilities/6734
CVE-2001-1242
Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an HTML form.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: un-cgi
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0287.html, http://archives.neohapsis.com/archives/bugtraq/2001-07/0349.html, http://www.iss.net/security_center/static/6846.php
CVE-2001-0480
Directory traversal vulnerability in Alex's FTP Server 0.7 allows remote attackers to read arbitrary files via a ... (modified dot dot) in the (1) GET or (2) CD commands.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: alexs_ftp_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0523.html, http://www.securityfocus.com/bid/2668, http://archives.neohapsis.com/archives/bugtraq/2001-04/0523.html
CVE-2001-1045
Directory traversal vulnerability in basilix.php3 in Basilix Webmail 1.0.3beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the request_id[DUMMY] parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: basilix_webmail
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0114.html, http://www.securityfocus.com/bid/2995, https://exchange.xforce.ibmcloud.com/vulnerabilities/6873
CVE-2001-0723
Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript, aka the "Second Cookie Handling Vulnerability."
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: internet_explorer
References: http://www.securityfocus.com/bid/3546, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-055, http://www.securityfocus.com/bid/3546
CVE-2001-1575
Apple Personal Web Sharing (PWS) 1.1, 1.5, and 1.5.5, when Web Sharing authentication is enabled, allows remote attackers to cause a denial of service via a long password, possibly due to a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: personal_web_sharing
References: http://cert.uni-stuttgart.de/archive/bugtraq/2001/06/msg00409.html, http://www.securityfocus.com/bid/2945, https://exchange.xforce.ibmcloud.com/vulnerabilities/6759
CVE-2001-1447
NetInfo Manager for Mac OS X 10.0 through 10.1 allows local users to gain root privileges by opening applications using the (1) "recent items" and (2) "services" menus, which causes the applications to run with root privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0121.html, http://archives.neohapsis.com/archives/bugtraq/2001-10/0130.html, http://www.ciac.org/ciac/bulletins/m-007.shtml
CVE-2001-0418
content.pl script in NCM Content Management System allows remote attackers to read arbitrary contents of the content database by inserting SQL characters into the id parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ncm_content_management_system
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0223.html, http://www.securityfocus.com/bid/2584, http://archives.neohapsis.com/archives/bugtraq/2001-04/0223.html
CVE-2001-0873
uuxqt in Taylor UUCP package does not properly remove dangerous long options, which allows local users to gain privileges by calling uux and specifying an alternate configuration file with the --config option.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: taylor_uucp
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000425, http://marc.info/?l=bugtraq&m=100715446131820, http://rhn.redhat.com/errata/RHSA-2001-165.html
CVE-2001-0154
HTML e-mail feature in Internet Explorer 5.5 and earlier allows attackers to execute attachments by setting an unusual MIME type for the attachment, which Internet Explorer does not process correctly.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://marc.info/?l=bugtraq&m=98596775905044&w=2, http://securitytracker.com/id?1001197, http://www.cert.org/advisories/CA-2001-06.html
CVE-2001-1556
The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: http_server
Related CWEs: CWE-532
Related CAPECs: CAPEC-215
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0231.html, http://httpd.apache.org/docs/logs.html, http://www.iss.net/security_center/static/7363.php
CWE: CWE-532
CVE-2001-0973
BSCW groupware system 3.3 through 4.0.2 beta allows remote attackers to read or modify arbitrary files by uploading and extracting a tar file with a symlink into the data-bag space.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: bscw
References: http://archives.neohapsis.com/archives/bugtraq/2001-08/0328.html, http://bscw.gmd.de/Bulletins/BSCW-SB-2001-08.extract.txt, http://www.iss.net/security_center/static/7029.php
CVE-2001-0633
Directory traversal vulnerability in Sun Chili!Soft ASP on multiple Unixes allows a remote attacker to read arbitrary files above the web root via a '..' (dot dot) attack in the sample script 'codebrws.asp'.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: chilisoft
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0378.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0443.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0378.html
CVE-2001-1284
Ipswitch IMail 7.04 and earlier uses predictable session IDs for authentication, which allows remote attackers to hijack sessions of other users.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: imail
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0082.html, http://www.ipswitch.com/Support/IMail/news.html, http://www.securityfocus.com/bid/3428
CVE-2001-1299
Zorbat Zorbstats PHP script before 0.9 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: zorbstats
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html, http://www.come.to/zorbat/, http://www.iss.net/security_center/static/7215.php
CVE-2001-0395
Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: consoleserver_3200_firmware, consoleserver_3200
Related CWEs: CWE-307
Related CAPECs: CAPEC-560, CAPEC-653, CAPEC-600
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0170.html, http://www.securityfocus.com/bid/2578, http://archives.neohapsis.com/archives/bugtraq/2001-04/0170.html
CWE: CWE-307
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2001-0614
Carello E-Commerce 1.2.1 and earlier allows a remote attacker to gain additional privileges and execute arbitrary commands via a specially constructed URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: e-commerce
References: http://marc.info/?l=bugtraq&m=98991352402073&w=2, https://exchange.xforce.ibmcloud.com/vulnerabilities/6532, http://marc.info/?l=bugtraq&m=98991352402073&w=2
CVE-2001-1481
Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows remote attackers to gain privileges.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: xitami
Related CWEs: CWE-312
Related CAPECs: CAPEC-37
MITRE ATT&CK Techniques: T1005, T1552.004
MITRE ATT&CK Tactics: T1552
References: http://archives.neohapsis.com/archives/win2ksecadvice/2000-q4/0109.html, http://www.securityfocus.com/archive/1/242375, http://www.securityfocus.com/bid/3582
CWE: CWE-312
MITRE ATT&CK techniques: T1005, T1552.004
MITRE ATT&CK tactics: T1552
CVE-2001-0716
Citrix MetaFrame 1.8 Server with Service Pack 3, and XP Server Service Pack 1 and earlier, allows remote attackers to cause a denial of service (crash) via a large number of incomplete connections to the server.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: metaframe
References: http://www.securityfocus.com/bid/3440, http://xforce.iss.net/alerts/advise99.php, https://exchange.xforce.ibmcloud.com/vulnerabilities/7068
CVE-2001-1268
Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: unzip
References: http://online.securityfocus.com/archive/1/196445, http://sunsolve.sun.com/search/document.do?assetkey=1-26-47800-1, http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000928.1-1
CVE-2001-1133
Vulnerability in a system call in BSDI 3.0 and 3.1 allows local users to cause a denial of service (reboot) in the kernel via a particular sequence of instructions.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: bsd_os
References: http://www.iss.net/security_center/static/7023.php, http://www.securityfocus.com/archive/1/209192, http://www.securityfocus.com/bid/3220
CVE-2001-0911
PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and decoding it.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php-nuke, postnuke
References: http://marc.info/?l=bugtraq&m=100638850219503&w=2, http://www.securityfocus.com/bid/3567, https://exchange.xforce.ibmcloud.com/vulnerabilities/7596
CVE-2001-0212
Directory traversal vulnerability in HIS Auktion 1.62 allows remote attackers to read arbitrary files via a .. (dot dot) in the menue parameter, and possibly execute commands via shell metacharacters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: auktion
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0218.html, http://www.securityfocus.com/bid/2367, http://archives.neohapsis.com/archives/bugtraq/2001-02/0218.html
CVE-2001-0609
Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog function.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: cfingerd
Related CWEs: CWE-193
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0202.html, http://www.securityfocus.com/bid/2576, https://exchange.xforce.ibmcloud.com/vulnerabilities/6364
CWE: CWE-193
CVE-2001-0334
FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string when it is expanded.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_server
Related CWEs: CWE-131
Related CAPECs: CAPEC-100, CAPEC-47
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026, https://exchange.xforce.ibmcloud.com/vulnerabilities/6535, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026
CWE: CWE-131
CVE-2001-0932
Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: powerftp
References: http://marc.info/?l=bugtraq&m=100698397818175&w=2, http://www.securityfocus.com/bid/3595, https://exchange.xforce.ibmcloud.com/vulnerabilities/7616
CVE-2001-0431
Vulnerability in iPlanet Web Server Enterprise Edition 4.x.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: iplanet_web_server
References: http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html, http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html, http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html
CVE-2001-0517
Oracle listener in Oracle 8i on Solaris allows remote attackers to cause a denial of service via a malformed connection packet with a maximum transport data size that is set to 0.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: oracle8i
References: http://otn.oracle.com/deploy/security/pdf/net8_dos_alert.pdf, http://www.osvdb.org/5590, http://xforce.iss.net/alerts/advise82.php
CVE-2001-0268
The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: openbsd, netbsd
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0353.html, http://archives.neohapsis.com/archives/linux/caldera/2001-q4/0014.html, http://archives.neohapsis.com/archives/netbsd/2001-q1/0093.html
CVE-2001-1400
Unknown vulnerabilities in the UDP port allocation for Linux kernel before 2.2.19 could allow local users to cause a denial of service (deadlock).
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel
References: http://marc.info/?l=bugtraq&m=98575345009963&w=2, http://marc.info/?l=bugtraq&m=98637996127004&w=2, http://marc.info/?l=bugtraq&m=98653252326445&w=2
CVE-2001-0310
sort in FreeBSD 4.1.1 and earlier, and possibly other operating systems, uses predictable temporary file names and does not properly handle when the temporary file already exists, which causes sort to crash and possibly impacts security-sensitive scripts.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: freebsd
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:13.sort.asc, http://www.securityfocus.com/bid/3960, https://exchange.xforce.ibmcloud.com/vulnerabilities/6038
CVE-2001-0312
IBM WebSphere plugin for Netscape Enterprise server allows remote attackers to read source code for JSP files via an HTTP request that contains a host header that references a host that is not in WebSphere's host aliases list, which will bypass WebSphere processing.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: websphere_plugin
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0446.html, http://archives.neohapsis.com/archives/bugtraq/2001-01/0446.html
CVE-2001-1008
Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities via an applet that has been signed by an expired certificate.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jre, java_plug-in
References: http://archives.neohapsis.com/archives/bugtraq/2001-08/0359.html, http://www.iss.net/security_center/static/7048.php, http://www.securityfocus.com/bid/3245
CVE-2001-0845
Vulnerability in DECwindows Motif Server on OpenVMS VAX or Alpha 6.2 through 7.3, and SEVMS VAX or Alpha 6.2, allows local users to gain access to unauthorized resources.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sevms_alpha, dec_openvms, sevms, dec_openvms_alpha
References: http://ftp.support.compaq.com/patches/.new/html/SSRT0738.shtml, http://www.securityfocus.com/bid/3492, https://exchange.xforce.ibmcloud.com/vulnerabilities/7425