DuyTa/cve-kgrag-db huggingface dataset:
CVE-2001-0508
Vulnerability in IIS 5.0 allows remote attackers to cause a denial of service (restart) via a long, invalid WebDAV request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_services
References: http://online.securityfocus.com/archive/1/182579, http://www.iss.net/security_center/static/6982.php, http://www.osvdb.org/5606
CVE-2001-0527
DCScripts DCForum versions 2000 and earlier allow a remote attacker to gain additional privileges by inserting pipe symbols (|) and newlines into the last name in the registration form, which will create an extra entry in the registration database.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: dcforum_2000, dcforum
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0122.html, http://www.dcscripts.com/dcforum/dcfNews/167.html, http://www.osvdb.org/480
CVE-2001-0058
The Web interface to Cisco 600 routers running CBOS 2.4.1 and earlier allow remote attackers to cause a denial of service via a URL that does not end in a space character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: cisco_6xx_routers, broadband_operating_system
References: http://www.cisco.com/warp/public/707/CBOS-multiple.shtml, http://www.osvdb.org/460, https://exchange.xforce.ibmcloud.com/vulnerabilities/5626
CVE-2001-1540
IPRoute 0.973, 0.974 and 1.18 allows remote attackers to cause a denial of service via fragmented IP packets that split the TCP header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: iproute
References: http://archives.neohapsis.com/archives/bugtraq/2001-12/0047.html, http://www.iss.net/security_center/static/7664.php, http://archives.neohapsis.com/archives/bugtraq/2001-12/0047.html
CVE-2001-0424
BubbleMon 1.31 does not properly drop group privileges before executing programs, which allows local users to execute arbitrary commands with the kmem group id.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: bubblemon, freebsd
References: http://marc.info/?l=bugtraq&m=98744422105430&w=2, http://www.securityfocus.com/bid/2609, http://marc.info/?l=bugtraq&m=98744422105430&w=2
CVE-2001-0592
Watchguard Firebox II prior to 4.6 allows a remote attacker to create a denial of service in the kernel via a large stream (>10,000) of malformed ICMP or TCP packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: firebox_ii
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0054.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6327, http://archives.neohapsis.com/archives/bugtraq/2001-04/0054.html
CVE-2001-0209
Buffer overflow in Shoutcast Distributed Network Audio Server (DNAS) 1.7.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long description.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: dnas
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0305.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/5965, http://archives.neohapsis.com/archives/bugtraq/2001-01/0305.html
CVE-2001-0237
Memory leak in Microsoft 2000 domain controller allows remote attackers to cause a denial of service by repeatedly connecting to the Kerberos service and then disconnecting without sending any data.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_2000
References: http://ciac.llnl.gov/ciac/bulletins/l-079.shtml, http://marc.info/?l=bugtraq&m=98942093221908&w=2, http://www.securityfocus.com/bid/2707
CVE-2001-0040
APC UPS daemon, apcupsd, saves its process ID in a world-writable file, which allows local users to kill an arbitrary process by specifying the target process ID in the apcupsd.pid file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: apcupsd
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0066.html, http://www.linux-mandrake.com/en/security/MDKSA-2000-077.php3, http://www.securityfocus.com/bid/2070
CVE-2001-1379
The PostgreSQL authentication modules (1) mod_auth_pgsql 0.9.5, and (2) mod_auth_pgsql_sys 0.9.4, allow remote attackers to bypass authentication and execute arbitrary SQL via a SQL injection attack on the user name.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mod_auth_pgsql
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:03.mod_auth_pgsql.asc, http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0040.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000427
CVE-2001-0677
Eudora 5.0.2 allows a remote attacker to read arbitrary files via an email with the path of the target file in the "Attachment Converted" MIME header, which sends the file when the email is forwarded to the attacker by the user.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: eudora
References: http://www.osvdb.org/3085, http://www.securityfocus.com/archive/1/177369, http://www.securityfocus.com/bid/2616
CVE-2001-0779
Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/209, http://www.ciac.org/ciac/bulletins/m-008.shtml, http://www.kb.cert.org/vuls/id/327281
CVE-2001-0033
KTH Kerberos IV allows local users to change the configuration of a Kerberos server running at an elevated privilege by specifying an alternate directory using with the KRBCONFDIR environmental variable, which allows the user to gain additional privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: kth_kerberos, netbsd
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0093.html, http://archives.neohapsis.com/archives/bugtraq/2000-12/0105.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/5738
CVE-2001-0318
Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory (cwd).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: proftpd
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0117.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000380, http://marc.info/?l=bugtraq&m=97916525715657&w=2
CVE-2001-1356
NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: surgeftp
References: http://online.securityfocus.com/archive/1/201951, http://www.iss.net/security_center/static/6961.php, http://www.securityfocus.com/bid/3157
CVE-2001-0037
Directory traversal vulnerability in HomeSeer before 1.4.29 allows remote attackers to read arbitrary files via a URL containing .. (dot dot) specifiers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: homeseer
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0082.html, http://www.keware.com/hsbetachanges.htm, http://www.securityfocus.com/bid/2085
CVE-2001-0282
SEDUM 2.1 HTTP server allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sedum
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0419.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0419.html
CVE-2001-0235
Vulnerability in crontab allows local users to read crontab files of other users by replacing the temporary file that is being edited while crontab is running.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: debian_linux
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:09.crontab.v1.1.asc, http://www.debian.org/security/2001/dsa-024, http://www.securityfocus.com/bid/2332
CVE-2001-1256
kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable files via a symlink attack on the (1) /tmp/.kmmodreg_lock and (2) /tmp/kmpath.tmp temporary files.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: hp-ux
References: http://ciac.llnl.gov/ciac/bulletins/l-093.shtml, http://online.securityfocus.com/advisories/3354, http://www.kb.cert.org/vuls/id/127435
CVE-2001-0751
Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers (ISN), which allows remote attackers to spoof or hijack TCP connections.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cbos
References: http://www.cisco.com/warp/public/707/CBOS-multiple2-pub.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/139, http://www.cisco.com/warp/public/707/CBOS-multiple2-pub.html
CVE-2001-1061
Vulnerability in lsmcode in unknown versions of AIX, possibly related to a usage error.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2001-q3/0003.html, http://archives.neohapsis.com/archives/aix/2001-q3/0003.html
CVE-2001-0016
NTLM Security Support Provider (NTLMSSP) service does not properly check the function number in an LPC request, which could allow local users to gain administrator level access.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_nt
References: http://razor.bindview.com/publish/advisories/adv_NTLMSSP.html, http://www.securityfocus.com/bid/2348, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-008
CVE-2001-0365
Eudora before 5.1 allows a remote attacker to execute arbitrary code, when the 'Use Microsoft Viewer' and 'allow executables in HTML content' options are enabled, via an HTML email message containing Javascript, with ActiveX controls and malicious code within IMG tags.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eudora
References: http://marc.info/?l=bugtraq&m=98503741910995&w=2, http://www.securityfocus.com/bid/2490, https://exchange.xforce.ibmcloud.com/vulnerabilities/6262
CVE-2001-0535
Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the "HTTP Host" (CGI.Host) variable in (1) the "Web Publish" example script, and (2) the "Email" example script.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: coldfusion_server
References: http://www.allaire.com/Handlers/index.cfm?ID=21700, http://xforce.iss.net/alerts/advise92.php, http://www.allaire.com/Handlers/index.cfm?ID=21700
CVE-2001-1215
Format string vulnerability in PFinger 0.7.5 through 0.7.7 allows remote attackers to execute arbitrary code via format string specifiers in a .plan file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pfinger
References: http://www.iss.net/security_center/static/7742.php, http://www.securityfocus.com/archive/1/246656, http://www.securityfocus.com/bid/3725
CVE-2001-0821
The default configuration of DCShop 1.002 beta places sensitive files in the cgi-bin directory, which could allow remote attackers to read sensitive data via an HTTP GET request for (1) orders.txt or (2) auth_user_file.txt.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: dcshop
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0233.html, http://www.dcscripts.com/dcforum/dcshop/44.html, http://www.securityfocus.com/bid/2889
CVE-2001-0484
Tektronix PhaserLink 850 does not require authentication for access to configuration pages such as _ncl_subjects.shtml and _ncl_items.shtml, which allows remote attackers to modify configuration information and cause a denial of service by accessing the pages.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P
Affected Products: phaserlink
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0482.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6482, http://archives.neohapsis.com/archives/bugtraq/2001-04/0482.html
CVE-2001-0339
Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks, aka the "Web page spoofing vulnerability."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://www.ciac.org/ciac/bulletins/l-087.shtml, http://www.osvdb.org/5694, http://www.securityfocus.com/bid/2737
CVE-2001-1366
netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: netscript
References: http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html, http://netscript.sourceforge.net/netscript-1.6.2.tgz, http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html
CVE-2001-0087
itetris/xitetris 1.6.2 and earlier trusts the PATH environmental variable to find and execute the gunzip program, which allows local users to gain root privileges by changing their PATH so that it points to a malicious gunzip program.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: itetris
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0295.html, http://www.securityfocus.com/bid/2139, https://exchange.xforce.ibmcloud.com/vulnerabilities/5795
CVE-2001-0421
FTP server in Solaris 8 and earlier allows local and remote attackers to cause a core dump in the root directory, possibly with world-readable permissions, by providing a valid username with an invalid password followed by a CWD ~ command, which could release sensitive information such as shadowed passwords, or fill the disk partition.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Affected Products: sunos, solaris
References: http://www.securityfocus.com/archive/1/177200, http://www.securityfocus.com/bid/2601, http://www.securityfocus.com/archive/1/177200
CVE-2001-0351
Microsoft Windows 2000 telnet service allows a local user to make a certain system call that allows the user to terminate a Telnet session and cause a denial of service.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_2000
References: http://www.ciac.org/ciac/bulletins/l-092.shtml, http://www.securityfocus.com/bid/2846, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-031
CVE-2001-1155
TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freebsd
Related CWEs: CWE-863
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:56.tcp_wrappers.asc, http://www.osvdb.org/5454, ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:56.tcp_wrappers.asc
CWE: CWE-863
CVE-2001-0005
Buffer overflow in the parsing mechanism of the file loader in Microsoft PowerPoint 2000 allows attackers to execute arbitrary commands.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: powerpoint
References: http://www.atstake.com/research/advisories/2001/a012301-1.txt, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-002, https://exchange.xforce.ibmcloud.com/vulnerabilities/5996
CVE-2001-1150
Vulnerability in cgiWebupdate.exe in Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.5.2 through 3.5.4 allows remote attackers to read arbitrary files.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: virus_buster, officescan
References: http://www.iss.net/security_center/static/7014.php, http://www.securityfocus.com/archive/1/209375, http://www.securityfocus.com/archive/1/210087
CVE-2001-1033
Compaq TruCluster 1.5 allows remote attackers to cause a denial of service via a port scan from a system that does not have a DNS PTR record, which causes the cluster to enter a "split-brain" state.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: trucluster, tru64
References: http://www.securityfocus.com/archive/1/216323, http://www.securityfocus.com/bid/3362, https://exchange.xforce.ibmcloud.com/vulnerabilities/7171
CVE-2001-1173
Vulnerability in MasqMail before 0.1.15 allows local users to gain privileges via piped aliases.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: masqmail
References: ftp://innominate.org/oku/masqmail/ChangeLog-stable, ftp://innominate.org/oku/masqmail/ChangeLog-stable
CVE-2001-0118
rdist 6.1.5 allows local users to overwrite arbitrary files via a symlink attack.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: linux, immunix, mandrake_linux
References: http://marc.info/?l=bugtraq&m=97916374410647&w=2, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-005.php3, http://www.securityfocus.com/bid/2195
CVE-2001-0015
Network Dynamic Data Exchange (DDE) in Windows 2000 allows local users to gain SYSTEM privileges via a "WM_COPYDATA" message to an invisible window that is running with the privileges of the WINLOGON process.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000
References: http://www.atstake.com/research/advisories/2001/a020501-1.txt, http://www.securityfocus.com/bid/2341, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-007
CVE-2001-0336
The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_server
References: http://www.osvdb.org/5693, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026, https://exchange.xforce.ibmcloud.com/vulnerabilities/6858
CVE-2001-1431
Nokia Firewall Appliances running IPSO 3.3 and VPN-1/FireWall-1 4.1 Service Pack 3, IPSO 3.4 and VPN-1/FireWall-1 4.1 Service Pack 4, and IPSO 3.4 or IPSO 3.4.1 and VPN-1/FireWall-1 4.1 Service Pack 5, when SYN Defender is configured in Active Gateway mode, does not properly rewrite the third packet of a TCP three-way handshake to use the NAT IP address, which allows remote attackers to gain sensitive information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: vpn-1, firewall-1, firewall_appliance
References: http://www.kb.cert.org/vuls/id/258731, https://exchange.xforce.ibmcloud.com/vulnerabilities/8293, http://www.kb.cert.org/vuls/id/258731
CVE-2001-0472
Hursley Software Laboratories Consumer Transaction Framework (HSLCTF) HTTP object allows remote attackers to cause a denial of service (crash) via an extremely long HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: high_availability_cluster_multiprocessing
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0243.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6250, http://archives.neohapsis.com/archives/bugtraq/2001-03/0243.html
CVE-2001-0543
Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_2000, windows_nt, exchange_server
Related CWEs: CWE-401
References: http://www.securityfocus.com/bid/3183, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-043, https://exchange.xforce.ibmcloud.com/vulnerabilities/6977
CWE: CWE-401
CVE-2001-0441
Buffer overflow in (1) wrapping and (2) unwrapping functions of slrn news reader before 0.9.7.0 allows remote attackers to execute arbitrary commands via a long message header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mandrake_linux_corporate_server, debian_linux, linux, mandrake_linux
References: http://archives.neohapsis.com/archives/freebsd/2001-04/0610.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000383, http://marc.info/?l=bugtraq&m=98471253131191&w=2
CVE-2001-0093
Vulnerability in telnetd in FreeBSD 1.5 allows local users to gain root privileges by modifying critical environmental variables that affect the behavior of telnetd.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: freebsd
References: ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-017.txt.asc, ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-017.txt.asc
CVE-2001-0930
Sendpage.pl allows remote attackers to execute arbitrary commands via a message containing shell metacharacters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sendpage.pl
References: http://marc.info/?l=bugtraq&m=100689313216624&w=2, http://www.iss.net/security_center/static/7609.php, http://marc.info/?l=bugtraq&m=100689313216624&w=2
CVE-2001-0693
WebTrends HTTP Server 3.1c and 3.5 allows a remote attacker to view script source code via a filename followed by an encoded space (%20).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webtrends_enterprise_reporting_server_nt, webtrends_enterprise_reporting_server
References: http://marc.info/?l=bugtraq&m=99166905208903&w=2, http://www.securityfocus.com/bid/2812, https://exchange.xforce.ibmcloud.com/vulnerabilities/6639
CVE-2001-0229
Chili!Soft ASP for Linux before 3.6 does not properly set group privileges when running in inherited mode, which could allow attackers to gain privileges via malicious scripts.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: chilisoft
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0112.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0112.html
CVE-2001-1392
The Linux kernel before 2.2.19 does not have unregister calls for (1) CPUID and (2) MSR drivers, which could cause a DoS (crash) by unloading and reloading the drivers.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel
References: http://marc.info/?l=bugtraq&m=98575345009963&w=2, http://marc.info/?l=bugtraq&m=98637996127004&w=2, http://marc.info/?l=bugtraq&m=98653252326445&w=2
CVE-2001-0783
Cisco TFTP server 1.1 allows remote attackers to read arbitrary files via a ..(dot dot) attack in the GET command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tftp_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0227.html, http://www.securityfocus.com/bid/2886, http://www.sentry-labs.com/files/cisco0201061701.txt
CVE-2001-0288
Cisco switches and routers running IOS 12.1 and earlier produce predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ios
References: http://www.cisco.com/warp/public/707/ios-tcp-isn-random-pub.shtml, http://www.cisco.com/warp/public/707/ios-tcp-isn-random-pub.shtml
CVE-2001-0805
Directory traversal vulnerability in ttawebtop.cgi in Tarantella Enterprise 3.00 and 3.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the pg parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tarantella_enterprise
References: http://www.securityfocus.com/archive/1/20010619150935.A5226%40tarantella.com, http://www.securityfocus.com/archive/1/3B2E37D0.81D9ED9D%40snosoft.com, http://www.securityfocus.com/bid/2890
CVE-2001-1275
MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from the mysql.user table and possibly gain privileges via password cracking.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mysql
References: http://marc.info/?l=bugtraq&m=98089552030459&w=2, http://www.calderasystems.com/support/security/advisories/CSSA-2001-006.0.txt, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-014.php3
CVE-2001-1116
Identix BioLogon 2.03 and earlier does not lock secondary displays on a multi-monitor system running Windows 98 or ME, which allows an attacker with physical access to the system to bypass authentication through a secondary display.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: biologon
References: http://ntbugtraq.ntadvice.com/default.asp?pid=36&sid=1&A2=IND0108&L=NTBUGTRAQ&F=P&S=&P=71, http://ntbugtraq.ntadvice.com/default.asp?pid=36&sid=1&A2=ind0108&L=ntbugtraq&F=P&S=&P=724, http://www.osvdb.org/5453
CVE-2001-0055
CBOS 2.4.1 and earlier in Cisco 600 routers allows remote attackers to cause a denial of service via a slow stream of TCP SYN packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: cisco_6xx_routers, broadband_operating_system
References: http://www.cisco.com/warp/public/707/CBOS-multiple.shtml, https://exchange.xforce.ibmcloud.com/vulnerabilities/5627, http://www.cisco.com/warp/public/707/CBOS-multiple.shtml
CVE-2001-1195
Novell Groupwise 5.5 and 6.0 Servlet Gateway is installed with a default username and password for the servlet manager, which allows remote attackers to gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: groupwise
References: http://support.novell.com/cgi-bin/search/searchtid.cgi?/10067329.htm, http://www.iss.net/security_center/static/7701.php, http://www.securityfocus.com/archive/1/245871
CVE-2001-0998
IBM HACMP 4.4 allows remote attackers to cause a denial of service via a completed TCP connection to HACMP ports (e.g., using a port scan) that does not send additional data, which causes a failure in snmpd.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: hacmp, aix
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY17630&apar=only, http://www-1.ibm.com/support/search.wss?rs=0&q=IY20943&apar=only, http://www.securityfocus.com/archive/1/216105
CVE-2001-1337
Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ipc_at_chip_embedded-webserver
References: http://www.iss.net/security_center/static/6594.php, http://www.securityfocus.com/archive/1/186418, http://www.securityfocus.com/bid/2774
CVE-2001-1474
SSH before 2.0 disables host key checking when connecting to the localhost, which allows remote attackers to silently redirect connections to the localhost by poisoning the client's DNS cache.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: ssh
References: http://www.kb.cert.org/vuls/id/786900, https://exchange.xforce.ibmcloud.com/vulnerabilities/6604, http://www.kb.cert.org/vuls/id/786900
CVE-2001-0803
Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: cde_common_desktop_environment
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: ftp://patches.sgi.com/support/free/security/advisories/20011107-01-P, ftp://stage.caldera.com/pub/security/openunix/CSSA-2001-SCO.30/, http://ftp.support.compaq.com/patches/.new/html/SSRT-541.shtml
CWE: CWE-119
CVE-2001-1463
The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, which allows remote attackers to sniff passwords.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: serv-u_file_server
Related CWEs: CWE-310
References: http://securitytracker.com/id?1002882, http://www.kb.cert.org/vuls/id/279763, https://exchange.xforce.ibmcloud.com/vulnerabilities/7925
CWE: CWE-310
CVE-2001-1443
KTH Kerberos IV and Kerberos V (Heimdal) for Telnet clients do not encrypt connections if the server does not support the requested encryption, which allows remote attackers to read communications via a man-in-the-middle attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: kth_kerberos
References: http://josefsson.org/ktelnet/kerberos-telnet.html, http://www.kb.cert.org/vuls/id/390280, https://exchange.xforce.ibmcloud.com/vulnerabilities/10640
CVE-2001-0843
Squid proxy server 2.4 and earlier allows remote attackers to cause a denial of service (crash) via a mkdir-only FTP PUT request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: squid_web_proxy
References: http://archives.neohapsis.com/archives/linux/conectiva/2001-q3/0020.html, http://marc.info/?l=bugtraq&m=100109679010256&w=2, http://www.debian.org/security/2001/dsa-077
CVE-2001-0563
ElectroSystems Engineering Inc. ElectroComm 2.0 and earlier allows a remote attacker to create a denial of service via large (> 160000 character) strings sent to port 23.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: electrocomm
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0049.html, http://www.securityfocus.com/bid/2706, https://exchange.xforce.ibmcloud.com/vulnerabilities/6514
CVE-2001-1095
Buffer overflow in uuq in AIX 4 could allow local users to execute arbitrary code via a long -r parameter.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2001-q4/0000.html, http://www-1.ibm.com/support/search.wss?rs=0&q=IY24231&apar=only, http://www.osvdb.org/5469
CVE-2001-0371
Race condition in the UFS and EXT2FS file systems in FreeBSD 4.2 and earlier, and possibly other operating systems, makes deleted data available to user processes before it is zeroed out, which allows a local user to access otherwise restricted information.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: freebsd
References: http://archives.neohapsis.com/archives/freebsd/2001-03/0403.html, http://www.osvdb.org/5682, https://exchange.xforce.ibmcloud.com/vulnerabilities/6268
CVE-2001-1137
D-Link DI-704 Internet Gateway firmware earlier than V2.56b6 allows remote attackers to cause a denial of service (reboot) via malformed IP datagram fragments.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: dl-704
References: http://www.securityfocus.com/archive/1/212532, http://www.securityfocus.com/bid/3306, https://exchange.xforce.ibmcloud.com/vulnerabilities/7090
CVE-2001-1109
Directory traversal vulnerability in EFTP 2.0.7.337 allows remote authenticated users to reveal directory contents via a .. (dot dot) in the (1) LIST, (2) QUOTE SIZE, and (3) QUOTE MDTM commands.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eftp
References: http://www.eftp.org/releasehistory.html, http://www.securityfocus.com/archive/1/213647, http://www.securityfocus.com/bid/3331
CVE-2001-0972
Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculating the value of the admin cookie (UserID 1), i.e. "0888888."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: asp_forum
References: http://marc.info/?l=bugtraq&m=99834088223352&w=2, http://www.securityfocus.com/bid/3210, https://exchange.xforce.ibmcloud.com/vulnerabilities/7011
CVE-2001-1285
Directory traversal vulnerability in readmail.cgi for Ipswitch IMail 7.04 and earlier allows remote attackers to access the mailboxes of other users via a .. (dot dot) in the mbx parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: imail
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0082.html, http://www.ipswitch.com/Support/IMail/news.html, http://www.securityfocus.com/bid/3432
CVE-2001-1294
Buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier allows remote attackers to cause a denial of service (crash) in the Webmail interface via a long username and password.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: inetserv
References: http://www.iss.net/security_center/static/7022.php, http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0001&L=ntbugtraq&F=P&S=&P=4592, http://www.securityfocus.com/bid/3224
CVE-2001-1108
Directory traversal vulnerability in SnapStream PVS 1.2a allows remote attackers to read arbitrary files via a .. (dot dot) attack in the requested URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pvs
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0606.html, http://discuss.snapstream.com/ubb/Forum1/HTML/000216.html, http://www.osvdb.org/2080
CVE-2001-0299
Buffer overflow in Voyager web administration server for Nokia IP440 allows local users to cause a denial of service, and possibly execute arbitrary commands, via a long URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ip440_firewall_vpn_appliance
References: http://marc.info/?l=bugtraq&m=97535202912588&w=2, http://marc.info/?l=bugtraq&m=97603879517777&w=2, http://www.osvdb.org/6020
CVE-2001-1361
Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: twig
References: http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html, http://twig.screwdriver.net/file.php3?file=CHANGELOG, http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html
CVE-2001-0130
Buffer overflow in HTML parser of the Lotus R5 Domino Server before 5.06, and Domino Client before 5.05, allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed font size specifier.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: domino_r5_server, domino_r5_client
References: http://service1.symantec.com/sarc/sarc.nsf/info/html/Lotus.Domino.Denial.of.Service.Malformed.HTML.Email.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6207, http://service1.symantec.com/sarc/sarc.nsf/info/html/Lotus.Domino.Denial.of.Service.Malformed.HTML.Email.html
CVE-2001-0420
Directory traversal vulnerability in talkback.cgi program allows remote attackers to read arbitrary files via a .. (dot dot) in the article parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: talkback
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0128.html, http://www.securityfocus.com/bid/2547, http://archives.neohapsis.com/archives/bugtraq/2001-04/0128.html
CVE-2001-0253
Directory traversal vulnerability in hsx.cgi program in iWeb Hyperseek 2000 allows remote attackers to read arbitrary files and directories via a .. (dot dot) attack in the show parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: hyperseek
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0463.html, http://www.kb.cert.org/vuls/id/146704, http://www.securityfocus.com/bid/2314
CVE-2001-0236
Buffer overflow in Solaris snmpXdmid SNMP to DMI mapper daemon allows remote attackers to execute arbitrary commands via a long "indication" event.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://marc.info/?l=bugtraq&m=98462536724454&w=2, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/207, http://www.cert.org/advisories/CA-2001-05.html
CVE-2001-1144
Directory traversal vulnerability in McAfee ASaP VirusScan agent 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: asap_virusscan
References: http://www.iss.net/security_center/static/6834.php, http://www.kb.cert.org/vuls/id/190267, http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0107&L=ntbugtraq&F=P&S=&P=1558
CVE-2001-0740
3COM OfficeConnect 812 and 840 ADSL Router 4.2, running OCR812 router software 1.1.9 and earlier, allows remote attackers to cause a denial of service via a long string containing a large number of "%s" strings, possibly triggering a format string vulnerability.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: 3cp4144, 3c840-us
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0115.html, http://marc.info/?l=bugtraq&m=100119572524232&w=2, http://marc.info/?l=bugtraq&m=100137290421828&w=2
CVE-2001-1562
Format string vulnerability in nvi before 1.79 allows local users to gain privileges via format string specifiers in a filename.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: nvi
References: http://marc.info/?l=bugtraq&m=100526142205694&w=2, http://www.debian.org/security/2001/dsa-085, http://www.iss.net/security_center/static/7317.php
CVE-2001-0894
Vulnerability in Postfix SMTP server before 20010228-pl07, when configured to email the postmaster when SMTP errors cause the session to terminate, allows remote attackers to cause a denial of service (memory exhaustion) by generating a large number of SMTP errors, which forces the SMTP session log to grow too large.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: postfix
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000439, http://frontal2.mandriva.com/security/advisories?name=MDKSA-2001:089, http://marc.info/?l=bugtraq&m=100584160110303&w=2
CVE-2001-0749
Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to read arbitrary files via a webserver root directory set to system root.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ipc_at_chip_embedded-webserver
References: http://www.securityfocus.com/archive/1/186418, http://www.securityfocus.com/bid/2775, https://exchange.xforce.ibmcloud.com/vulnerabilities/8922
CVE-2001-0251
The Web Publishing feature in Netscape Enterprise Server 3.x allows remote attackers to cause a denial of service via the REVLOG command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: enterprise_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0422.html, http://www.securityfocus.com/bid/2294, https://exchange.xforce.ibmcloud.com/vulnerabilities/6003
CVE-2001-1010
Directory traversal vulnerability in pagecount CGI script in Sambar Server before 5.0 beta 5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) attack on the page parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: sambar_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0565.html, http://www.sambar.com/security.htm, http://www.securityfocus.com/bid/3092
CVE-2001-0024
simplestmail.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the MyEmail parameter.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: simplestmail.cgi
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0136.html, http://www.securityfocus.com/bid/2102, https://exchange.xforce.ibmcloud.com/vulnerabilities/5739
CVE-2001-1448
Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on temporary files created by the (1) mkuserproc, (2) mgrnt, and (3) mgdatasrvr.sc scripts.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: edeveloper
References: http://www.kb.cert.org/vuls/id/157795, http://www.securityfocus.com/archive/1/246343, https://exchange.xforce.ibmcloud.com/vulnerabilities/10616
CVE-2001-1113
Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories with long names, then running the ls -R (recursive) command.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: trollftpd
References: ftp://ftp.trolltech.com/freebies/ftpd/troll-ftpd-1.27.tar.gz, http://www.securityfocus.com/archive/1/203874, http://www.securityfocus.com/bid/3174
CVE-2001-0275
Moby Netsuite Web Server 1.02 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP request.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netsuite_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0346.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0346.html
CVE-2001-0347
Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000
References: http://www.ciac.org/ciac/bulletins/l-092.shtml, http://www.osvdb.org/5686, http://www.securityfocus.com/bid/2847
CVE-2001-0499
Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS, (2) PING, (3) SERVICES, (4) TRC_FILE, (5) SAVE_CONFIG, or (6) RELOAD.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: oracle8i
References: http://www.cert.org/advisories/CA-2001-16.html, http://www.kb.cert.org/vuls/id/620495, http://www.nai.com/research/covert/advisories/050.asp
CVE-2001-1391
Off-by-one vulnerability in CPIA driver of Linux kernel before 2.2.19 allows users to modify kernel memory.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: linux_kernel
Related CWEs: CWE-193
References: http://marc.info/?l=bugtraq&m=98575345009963&w=2, http://marc.info/?l=bugtraq&m=98637996127004&w=2, http://marc.info/?l=bugtraq&m=98653252326445&w=2
CWE: CWE-193
CVE-2001-0171
Buffer overflow in SlimServe HTTPd 1.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long GET request.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: slimserve
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0505.html, http://www.securityfocus.com/bid/2318, https://exchange.xforce.ibmcloud.com/vulnerabilities/6028
CVE-2001-0182
FireWall-1 4.1 with a limited-IP license allows remote attackers to cause a denial of service by sending a large number of spoofed IP packets with various source addresses to the inside interface, which floods the console with warning messages and consumes CPU resources.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: firewall-1
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0298.html, http://www.osvdb.org/1733, http://www.securityfocus.com/bid/2238
CVE-2001-0772
Buffer overflows and other vulnerabilities in multiple Common Desktop Environment (CDE) modules in HP-UX 10.10 through 11.11 allow attackers to cause a denial of service and possibly gain additional privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hp-ux
References: http://archives.neohapsis.com/archives/hp/2001-q2/0044.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6585, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6022
CVE-2001-1007
Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered, which allows attackers to more quickly guess the key via a brute force attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: truesync_desktop
References: http://www.securityfocus.com/archive/1/210067, http://www.securityfocus.com/archive/1/210067
CVE-2001-0834
htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to (1) cause a denial of service (CPU consumption) by specifying a large file such as /dev/zero, or (2) read arbitrary files by uploading an alternate configuration file that specifies the target file.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Affected Products: debian_linux, linux, suse_linux, htdig
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000429, http://marc.info/?l=bugtraq&m=100260195401753&w=2, http://sourceforge.net/tracker/index.php?func=detail&aid=458013&group_id=4593&atid=104593
CVE-2001-0770
Buffer overflow in GuildFTPd Server 0.97 allows remote attacker to execute arbitrary code via a long SITE command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: guildftpd
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0254.html, http://www.nitrolic.com/help/history.htm, https://exchange.xforce.ibmcloud.com/vulnerabilities/6612
CVE-2001-1509
geteuid in Itanium Architecture (IA) running on HP-UX 11.20 does not properly identify a user's effective user id, which could allow local users to gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hp-ux
References: http://hp.cso.uiuc.edu/ftp/pub/hp/patches/11.20/PHSS_25454, http://www.iss.net/security_center/static/7324.php, http://www.securityfocus.com/advisories/3606
CVE-2001-0067
The installation of J-Pilot creates the .jpilot directory with the user's umask, which could allow local attackers to read other users' PalmOS backup information if their umasks are not securely set.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jpilot
References: http://www.linux-mandrake.com/en/security/2000/MDKSA-2000-081.php3, http://www.securityfocus.com/templates/archive.pike?mid=150957&end=2001-02-03&fromthread=1&start=2001-01-28&threads=0&list=1&, https://exchange.xforce.ibmcloud.com/vulnerabilities/5762