DuyTa/cve-kgrag-db huggingface dataset:
CVE-2001-0415
REDIPlus program, REDI.exe, stores passwords and user names in cleartext in the StartLog.txt log file, which allows local users to gain access to other accounts.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: rediplus
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0275.html, http://www.securityfocus.com/bid/2495, https://exchange.xforce.ibmcloud.com/vulnerabilities/6276
CVE-2001-0742
Buffer overflow in Computalynx CMail POP3 mail server 2.4.9 allows remote attackers to run arbitrary code via a long HELO command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cmail
References: http://www.securiteam.com/windowsntfocus/5UP0B204AY.html, http://www.securiteam.com/windowsntfocus/5UP0B204AY.html
CVE-2001-1449
The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mandrake_single_network_firewall, mandrake_linux_corporate_server, http_server, mandrake_linux
References: http://www.kb.cert.org/vuls/id/913704, http://www.mandriva.com/security/advisories?name=MDKSA-2001:077-2, https://exchange.xforce.ibmcloud.com/vulnerabilities/8029
CVE-2001-0375
Cisco PIX Firewall 515 and 520 with 5.1.4 OS running aaa authentication to a TACACS+ server allows remote attackers to cause a denial of service via a large number of authentication requests.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: pix_firewall_520, pix_firewall_515
References: http://marc.info/?l=bugtraq&m=98658271707833&w=2, http://www.cisco.com/warp/public/707/pixfirewall-authen-flood-pub.shtml, http://www.securityfocus.com/bid/2551
CVE-2001-0088
common.inc.php in phpWebLog 0.4.2 does not properly initialize the $CONF array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the SiteKey and gain administrative privileges to phpWebLog.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpweblog
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0025.html, http://www.securityfocus.com/bid/2047, https://exchange.xforce.ibmcloud.com/vulnerabilities/5625
CVE-2001-1112
Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of characters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eftp
References: http://www.securityfocus.com/archive/1/213647, http://www.securityfocus.com/bid/3330, https://exchange.xforce.ibmcloud.com/vulnerabilities/7115
CVE-2001-1160
udirectory.pl in Microburst Technologies uDirectory 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the category_file field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: udirectory
References: http://www.securityfocus.com/archive/1/191829, http://www.securityfocus.com/bid/2884, https://exchange.xforce.ibmcloud.com/vulnerabilities/6706
CVE-2001-0632
Sun Chili!Soft 3.5.2 on Linux and 3.6 on AIX creates a default admin username and password in the default installation, which can allow a remote attacker to gain additional privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: chilisoft
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0378.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0443.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0378.html
CVE-2001-0096
FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission" vulnerability.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_server, internet_information_services
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-100, https://exchange.xforce.ibmcloud.com/vulnerabilities/5823, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-100
CVE-2001-1577
Unknown vulnerability in CDE in Caldera OpenUnix 7.1.0, 7.1.1, and 8.0 allows an xterm session to gain privileges when the session is reused.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: unixware, openunix
References: http://archives.neohapsis.com/archives/linux/caldera/2001-q4/0017.html, http://www.securityfocus.com/bid/3646, https://exchange.xforce.ibmcloud.com/vulnerabilities/7666
CVE-2001-0542
Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf.  NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sql_server
References: http://marc.info/?l=bugtraq&m=100891252317406&w=2, http://www.atstake.com/research/advisories/2001/a122001-1.txt, http://www.kb.cert.org/vuls/id/700575
CVE-2001-1204
Directory traversal vulnerability in phprocketaddin in Total PC Solutions PHP Rocket Add-in for FrontPage 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: php_rocket_add-in
References: http://www.securityfocus.com/archive/1/247559, http://www.securityfocus.com/bid/3751, https://exchange.xforce.ibmcloud.com/vulnerabilities/7749
CVE-2001-1246
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php
Related CWEs: CWE-88
Related CAPECs: CAPEC-137, CAPEC-88, CAPEC-174
References: http://online.securityfocus.com/archive/1/194425, http://www.iss.net/security_center/static/6787.php, http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz
CWE: CWE-88
CVE-2001-0791
Trend Micro InterScan VirusWall for Windows NT allows remote attackers to make configuration changes by directly calling certain CGI programs, which do not restrict access.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: interscan_viruswall
References: http://cert.uni-stuttgart.de/archive/bugtraq/2001/06/msg00006.html, http://cert.uni-stuttgart.de/archive/bugtraq/2001/06/msg00006.html
CVE-2001-0140
arpwatch 2.1a4 allows local users to overwrite arbitrary files via a symlink attack in some configurations.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: linux, immunix, mandrake_linux
References: http://marc.info/?l=bugtraq&m=97916374410647&w=2, http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-002.php3, http://www.securityfocus.com/bid/2183
CVE-2001-0700
Buffer overflow in w3m 0.2.1 and earlier allows a remote attacker to execute arbitrary code via a long base64 encoded MIME header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: w3m
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000434, http://mi.med.tohoku.ac.jp/~satodai/w3m-dev-en/200106.month/537.html, http://www.debian.org/security/2001/dsa-064
CVE-2001-0943
dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands, which allows local users to execute arbitrary code by modifying the PATH to point to Trojan Horse programs.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: database_server
References: http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf, http://seclists.org/lists/bugtraq/2001/Dec/0001.html, http://www.securityfocus.com/archive/1/201020
CVE-2001-1515
Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS permissions, which may cause the directories to have less restrictive permissions than intended.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: windows_2000
Related CWEs: CWE-281
References: http://securitytracker.com/id?1002626, http://www.securityfocus.com/bid/3479, http://securitytracker.com/id?1002626
CWE: CWE-281
CVE-2001-0601
Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via HTTP requests containing certain combinations of UNICODE characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: domino_r5_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0174.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6349, http://archives.neohapsis.com/archives/bugtraq/2001-04/0174.html
CVE-2001-1265
Directory traversal vulnerability in IBM alphaWorks Java TFTP server 1.21 allows remote attackers to conduct unauthorized operations on arbitrary files via a .. (dot dot) attack.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: alphaworks_tftp_server
References: http://online.securityfocus.com/archive/1/198297, http://www.securityfocus.com/bid/3076, https://exchange.xforce.ibmcloud.com/vulnerabilities/6864
CVE-2001-0442
Buffer overflow in Mercury MTA POP3 server for NetWare 1.48 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long APOP command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mercury_nlm
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0378.html, http://online.securityfocus.com/archive/1/179217, http://www.iss.net/security_center/static/6444.php
CVE-2001-0734
Hitachi Super-H architecture in NetBSD 1.5 and 1.4.1 allows a local user to gain privileges via modified Status Register contents, which are not properly handled by (1) the sigreturn system call or (2) the process_write_regs kernel routine.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: netbsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-008.txt.asc, http://www.securityfocus.com/bid/2810, https://exchange.xforce.ibmcloud.com/vulnerabilities/6637
CVE-2001-1529
Buffer overflow in rpc.yppasswdd (yppasswd server) in AIX allows attackers to gain unauthorized access via a long string.  NOTE: due to lack of details in the vendor advisory, it is not clear if this is the same issue as CVE-2001-0779.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2001-q4/0009.html, http://archives.neohapsis.com/archives/aix/2001-q4/0009.html
CVE-2001-1498
Buffer overflow in mod_bf 0.2 allows local users to execute arbitrary commands via a long script.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mod_bf
References: http://www.bugtraq.org/advisories/GOBBLES-15.txt, http://www.securityfocus.com/bid/3713, https://exchange.xforce.ibmcloud.com/vulnerabilities/7730
CVE-2001-0690
Format string vulnerability in exim (3.22-10 in Red Hat, 3.12 in Debian and 3.16 in Conectiva) in batched SMTP mode allows a remote attacker to execute arbitrary code via format strings in SMTP mail headers.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: exim, debian_linux, linux
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0041.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000402, http://www.debian.org/security/2001/dsa-058
CVE-2001-0829
A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: tomcat
References: http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html, http://jakarta.apache.org/tomcat/tomcat-3.2-doc/readme, http://www.securityfocus.com/bid/2982
CVE-2001-0975
Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_directory
References: http://otn.oracle.com/deploy/security/pdf/oid_cert_bof.pdf, http://www.cert.org/advisories/CA-2001-18.html, http://www.ciac.org/ciac/bulletins/l-116.shtml
CVE-2001-1260
Avaya Argent Office uses weak encryption (trivial encoding) for passwords, which allows remote attackers to gain administrator privileges by sniffing and decrypting the sniffing the passwords during a system reboot.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: argent_office
References: http://online.securityfocus.com/archive/1/202344, http://www.iss.net/security_center/static/6954.php, http://online.securityfocus.com/archive/1/202344
CVE-2001-0381
The OpenPGP PGP standard allows an attacker to determine the private signature key via a cryptanalytic attack in which the attacker alters the encrypted private key file and captures a single message signed with the signature key.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openpgp
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2001-017.0.txt, http://archives.neohapsis.com/archives/bugtraq/2001-03/0252.html, http://archives.neohapsis.com/archives/bugtraq/2001-03/0274.html
CVE-2001-1162
Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: cifs-9000_server, samba
References: ftp://patches.sgi.com/support/free/security/advisories/20011002-01-P, http://ciac.llnl.gov/ciac/bulletins/l-105.shtml, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000405
CVE-2001-1367
The checkAccess function in PHPSlice 0.1.4, and all other versions between 0.1.1 and 0.1.6, does not properly verify the administrative access level, which could allow remote attackers to gain privileges.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: phpslice
References: http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html, http://phpslice.org/comments.php?aid=1031&, https://exchange.xforce.ibmcloud.com/vulnerabilities/9649
CVE-2001-0665
Internet Explorer 6 and earlier allows remote attackers to cause certain HTTP requests to be automatically executed and appear to come from the user, which could allow attackers to gain privileges or execute operations within web-based services, aka the "HTTP Request Encoding vulnerability."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ie
References: http://www.osvdb.org/1972, http://www.securityfocus.com/bid/3421, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-051
CVE-2001-0278
Vulnerability in linkeditor in HP MPE/iX 6.5 and earlier allows local users to gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mpe_ix
References: http://archives.neohapsis.com/archives/hp/2001-q1/0050.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6223, http://archives.neohapsis.com/archives/hp/2001-q1/0050.html
CVE-2001-1468
PHP remote file inclusion vulnerability in checklogin.php in phpSecurePages 0.24 and earlier allows remote attackers to execute arbitrary PHP code by modifying the cfgProgDir parameter to reference a URL on a remote web server that contains the code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpsecurepages
References: http://securitytracker.com/id?1001408, http://www.kb.cert.org/vuls/id/391347, http://www.securityfocus.com/bid/2970
CVE-2001-0160
Lucent/ORiNOCO WaveLAN cards generate predictable Initialization Vector (IV) values for the Wireless Encryption Protocol (WEP) which allows remote attackers to quickly compile information that will let them decrypt messages.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: wavelan, orinoco_wavelan
References: http://www.cs.jhu.edu/~seny/pubs/wince802.pdf, http://www.cs.jhu.edu/~seny/pubs/wince802.pdf
CVE-2001-1424
Alcatel Speed Touch ADSL modem running firmware KHDSAA.108, KHDSAA.132, KHDSBA.133, and KHDSAA.134 has a blank default password, which allows remote attackers to gain unauthorized access.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: speed_touch_home
References: http://security.sdsc.edu/self-help/alcatel/alcatel-bugs.html, http://www.cert.org/advisories/CA-2001-08.html, http://www.kb.cert.org/vuls/id/212088
CVE-2001-0346
Handle leak in Microsoft Windows 2000 telnet service allows attackers to cause a denial of service by starting a large number of sessions and terminating them.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_2000
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-031, https://exchange.xforce.ibmcloud.com/vulnerabilities/6668, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-031
CVE-2001-1177
ml85p in Samsung ML-85G GDI printer driver before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: ml-85g_gdi_printer_driver, ml-85p_printer_driver
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0284.html, http://www.securityfocus.com/bid/3008, https://exchange.xforce.ibmcloud.com/vulnerabilities/6845
CVE-2001-0835
Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in (1) search keywords embedded in HTTP referrer information, or (2) host names that are retrieved via a reverse DNS lookup.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webalizer
References: http://lists.suse.com/archives/suse-security-announce/2001-Nov/0001.html, http://marc.info/?l=bugtraq&m=100394630702875&w=2, http://www.linuxsecurity.com/advisories/other_advisory-1677.html
CVE-2001-1142
ArGoSoft FTP Server 1.2.2.2 uses weak encryption for user passwords, which allows an attacker with access to the password file to gain privileges.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ftp_server
References: http://www.iss.net/security_center/static/6848.php, http://www.securityfocus.com/archive/1/196968, http://www.securityfocus.com/bid/3029
CVE-2001-1314
Buffer overflows in Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: injoin_directory_server, livecontent_directory
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0770.html, http://ciac.llnl.gov/ciac/bulletins/l-116.shtml, http://www.cert.org/advisories/CA-2001-18.html
CVE-2001-1558
Unknown vulnerability in IP defragmenter (frag2) in Snort before 1.8.3 allows attackers to cause a denial of service (crash).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: snort
References: http://archives.neohapsis.com/archives/snort/2001-11/0990.html, http://archives.neohapsis.com/archives/snort/2001-11/0990.html
CVE-2001-1115
generate.cgi in SIX-webboard 2.01 and before allows remote attackers to read arbitrary files via a dot dot (..) in the content parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: six-webboard
References: http://www.securityfocus.com/archive/1/204053, http://www.securityfocus.com/bid/3175, https://exchange.xforce.ibmcloud.com/vulnerabilities/6975
CVE-2001-0446
IBM WCS (WebSphere Commerce Suite) 4.0.1 with Application Server 3.0.2 allows remote attackers to read source code for .jsp files by appending a / to the requested URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: websphere_commerce_suite
References: http://marc.info/?l=bugtraq&m=98583082225053&w=2, http://marc.info/?l=bugtraq&m=98583082225053&w=2
CVE-2001-1264
Vulnerability in mkacct in HP-UX 11.04 running Virtualvault Operating System (VVOS) 4.0 and 4.5 allows attackers to elevate privileges.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: vvos, hp-ux
References: http://ciac.llnl.gov/ciac/bulletins/l-119.shtml, http://www.kb.cert.org/vuls/id/420475, http://www.securityfocus.com/advisories/3459
CVE-2001-1351
Cross-site scripting vulnerability in Namazu 2.0.8 and earlier allows remote attackers to execute arbitrary Javascript as other web users via the index file name that is displayed when displaying hit numbers.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: namazu
References: http://marc.info/?l=bugtraq&w=2&r=1&s=namazu&q=b, http://www.osvdb.org/5690, https://exchange.xforce.ibmcloud.com/vulnerabilities/7875
CVE-2001-0410
Buffer overflow in Trend Micro Virus Buster 2001 8.02 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long "From" header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: virus_buster_2001
References: http://marc.info/?l=bugtraq&m=98593642520755&w=2, http://marc.info/?l=bugtraq&m=98593642520755&w=2
CVE-2001-0247
Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: netbsd, openbsd, freebsd, irix, kerberos_5
References: ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-018.txt.asc, ftp://patches.sgi.com/support/free/security/advisories/20010802-01-P, http://archives.neohapsis.com/archives/freebsd/2001-04/0466.html
CVE-2001-0291
Buffer overflow in post-query sample CGI program allows remote attackers to execute arbitrary commands via an HTTP POST request that contains at least 10001 parameters.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0003.html, http://archives.neohapsis.com/archives/bugtraq/2001-03/0003.html
CVE-2001-0942
dbsnmp in Oracle 8.1.6 and 8.1.7 uses the ORACLE_HOME environment variable to find and execute the dbsnmp program, which allows local users to execute arbitrary programs by pointing the ORACLE_HOME to an alternate directory that contains a malicious version of dbsnmp.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: database_server
References: http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf, http://seclists.org/lists/bugtraq/2001/Dec/0000.html, http://www.securityfocus.com/bid/3137
CVE-2001-0007
Buffer overflow in NetScreen Firewall WebUI allows remote attackers to cause a denial of service via a long URL request to the web administration interface.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: screen_os
References: http://www.osvdb.org/1707, http://www.securityfocus.com/archive/1/155149, http://www.securityfocus.com/bid/2176
CVE-2001-0988
Arkeia backup server 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwrite the files or obtain sensitive information.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: arkeia
References: http://archives.neohapsis.com/archives/bugtraq/2001-07/0521.html, http://www.securityfocus.com/bid/3085, https://exchange.xforce.ibmcloud.com/vulnerabilities/6885
CVE-2001-1442
Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the "news" group to gain privileges via a long -c command line argument.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: inn
References: http://archives.neohapsis.com/archives/bugtraq/2001-04/0311.html, http://securitytracker.com/id?1001353, http://www.kb.cert.org/vuls/id/943536
CVE-2001-0295
Directory traversal vulnerability in War FTP 1.67.04 allows remote attackers to list directory contents and possibly read files via a "dir *./../.." command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: war_ftpd
References: http://marc.info/?l=bugtraq&m=98390925726814&w=2, http://support.jgaa.com/?cmd=ShowArticle&ID=31, http://www.osvdb.org/874
CVE-2001-1574
Buffer overflow in (1) HttpSaveCVP.dll and (2) HttpSaveCSP.dll in Trend Micro InterScan VirusWall 3.5.1 allows remote attackers to execute arbitrary code.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: interscan_viruswall
References: http://cert.uni-stuttgart.de/archive/bugtraq/2001/06/msg00408.html, http://cert.uni-stuttgart.de/archive/bugtraq/2001/06/msg00408.html
CVE-2001-0242
Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the ".ASX Buffer Overrun" vulnerability as discussed in MS:MS00-090.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_media_player
References: http://www.kb.cert.org/vuls/id/187528, http://www.securityfocus.com/archive/1/181419, http://www.securityfocus.com/archive/1/183906
CVE-2001-1466
Buffer overflow in VanDyke SecureCRT before 3.4.2, when using the SSH-1 protocol, allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: securecrt
References: http://archives.neohapsis.com/archives/vuln-dev/2001-q4/0967.html, http://www.kb.cert.org/vuls/id/216227, https://exchange.xforce.ibmcloud.com/vulnerabilities/10111
CVE-2001-1545
Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests (a.k.a. rewriting) when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jrun
References: http://www.iss.net/security_center/static/7679.php, http://www.macromedia.com/v1/handlers/index.cfm?ID=22291&Method=Full, http://www.securityfocus.com/bid/3665
CVE-2001-1250
vWebServer 1.2.0 allows remote attackers to cause a denial of service (hang) via a small number of long URL requests, possibly due to a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vwebserver
References: http://online.securityfocus.com/archive/1/194418, http://www.iss.net/security_center/static/6771.php, http://www.securityfocus.com/bid/2979
CVE-2001-0995
PHProjekt before 2.4a allows remote attackers to perform actions as other PHProjekt users by modifying the ID number in an HTTP request to PHProjekt CGI programs.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpprojekt
References: http://www.phprojekt.com/ChangeLog, http://www.securityfocus.com/archive/1/210349, http://www.securityfocus.com/bid/3239
CVE-2001-0256
FaSTream FTP++ Server 2.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long username.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ftp\+\+_server
References: http://marc.info/?l=bugtraq&m=98021181215325&w=2, http://www.securityfocus.com/bid/2261, https://exchange.xforce.ibmcloud.com/vulnerabilities/5976
CVE-2001-0752
Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via an ICMP ECHO REQUEST (ping) with the IP Record Route option set.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: cbos
References: http://www.cisco.com/warp/public/707/CBOS-multiple2-pub.html, http://www.osvdb.org/5573, https://exchange.xforce.ibmcloud.com/vulnerabilities/7298
CVE-2001-0361
Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N
Affected Products: ssh, openssh
Related CWEs: CWE-310
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:24.ssh.asc, http://marc.info/?l=bugtraq&m=98158450021686&w=2, http://www.ciac.org/ciac/bulletins/l-047.shtml
CWE: CWE-310
CVE-2001-0815
Buffer overflow in PerlIS.dll in Activestate ActivePerl 5.6.1.629 and earlier allows remote attackers to execute arbitrary code via an HTTP request for a long filename that ends in a .pl extension.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: activeperl
References: http://bugs.activestate.com/show_bug.cgi?id=18062, http://marc.info/?l=bugtraq&m=100583978302585&w=2, http://www.osvdb.org/678
CVE-2001-0301
Buffer overflow in Analog before 4.16 allows remote attackers to execute arbitrary commands by using the ALIAS command to construct large strings.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: analog
References: http://archives.neohapsis.com/archives/bugtraq/2001-02/0264.html, http://archives.neohapsis.com/archives/linux/redhat/2001-q1/0056.html, http://www.analog.cx/security2.html
CVE-2001-1465
SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filtering by fragmenting packets so that no packet contains both data elements.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: superscout_web_filter
References: http://securitytracker.com/id?1001801, http://www.kb.cert.org/vuls/id/139315, http://securitytracker.com/id?1001801
CVE-2001-0847
Lotus Domino Web Server 5.x allows remote attackers to gain sensitive information by accessing the default navigator $defaultNav via (1) URL encoding the request, or (2) directly requesting the ReplicaID.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: domino_web_server
References: http://marc.info/?l=bugtraq&m=100448726831108&w=2, http://www.securityfocus.com/bid/3488, https://exchange.xforce.ibmcloud.com/vulnerabilities/7423
CVE-2001-0313
Borderware Firewall Server 6.1.2 allows remote attackers to cause a denial of service via a ping to the broadcast address of the public network on which the server is placed, which causes the server to continuously send pings (echo requests) to the network.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: firewall_server
References: http://marc.info/?l=bugtraq&m=98053139231392&w=2, https://exchange.xforce.ibmcloud.com/vulnerabilities/6004, http://marc.info/?l=bugtraq&m=98053139231392&w=2
CVE-2001-0983
UltraEdit uses weak encryption to record FTP passwords in the uedit32.ini file, which allows local users who can read the file to decrypt the passwords and gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ultraedit-32
References: http://marc.info/?l=bugtraq&m=99861651923668&w=2, http://www.eve-software.com/security/ueditpw.html, http://marc.info/?l=bugtraq&m=99861651923668&w=2
CVE-2001-0021
MailMan Webmail 3.0.25 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the alternate_template parameter.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mailman_webmail
References: http://archives.neohapsis.com/archives/bugtraq/2000-12/0057.html, http://www.endymion.com/products/mailman/history.htm, http://www.securityfocus.com/bid/2063
CVE-2001-0164
Buffer overflow in Netscape Directory Server 4.12 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed recipient field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: directory_server
References: http://www.atstake.com/research/advisories/2001/a030701-1.txt, https://exchange.xforce.ibmcloud.com/vulnerabilities/6233, http://www.atstake.com/research/advisories/2001/a030701-1.txt
CVE-2001-0747
Buffer overflow in iPlanet Web Server (iWS) Enterprise Edition 4.1, service packs 3 through 7, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long method name in an HTTP request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: iplanet_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0203.html, http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert5.11.html, http://archives.neohapsis.com/archives/bugtraq/2001-05/0203.html
CVE-2001-1482
SQL injection vulnerability in bb_memberlist.php for phpBB 1.4.2 allows remote attackers to execute arbitrary SQL queries via the $sortby variable.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpbb
References: http://www.securityfocus.com/archive/1/219178, http://www.securityfocus.com/bid/3411, https://exchange.xforce.ibmcloud.com/vulnerabilities/7253
CVE-2001-1168
Directory traversal vulnerability in index.php in PhpMyExplorer before 1.2.1 allows remote attackers to read arbitrary files via a ..%2F (modified dot dot) in the chemin parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: phpmyexplorer_classic, phpmyexplorer_multiuser
References: http://archives.neohapsis.com/archives/bugtraq/2001-08/0408.html, http://archives.neohapsis.com/archives/bugtraq/2001-08/0418.html, http://archives.neohapsis.com/archives/bugtraq/2001-08/0408.html
CVE-2001-1344
WSSecurity.pl in WebStore allows remote attackers to bypass authentication by providing the program with a filename that exists, which is made easier by (1) inserting a null character or (2) .. (dot dot).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webstore_400cs, webstore_400
References: http://archives.neohapsis.com/archives/bugtraq/2001-06/0142.html, http://www.securityfocus.com/bid/2860, https://exchange.xforce.ibmcloud.com/vulnerabilities/6685
CVE-2001-1503
The finger daemon (in.fingerd) in Sun Solaris 2.5 through 8 and SunOS 5.5 through 5.8 allows remote attackers to list all accounts on a host by typing finger 'a b c d e f g h'@host.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: sunos, solaris
References: http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0016.html, http://sunsolve.sun.com/search/document.do?assetkey=1-26-27116-1, http://www.securityfocus.com/bid/3457
CVE-2001-1484
Alcatel ADSL modems allow remote attackers to access the Trivial File Transfer Protocol (TFTP) to modify firmware and configuration via a bounce attack from a system on the local area network (LAN) side, which is allowed to access TFTP without authentication.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: speed_touch_adsl_modem, adsl_modem_1000
References: http://www.cert.org/advisories/CA-2001-08.html, http://www.kb.cert.org/vuls/id/211736, https://exchange.xforce.ibmcloud.com/vulnerabilities/6336
CVE-2001-1090
nss_postgresql 0.6.1 and before allows a remote attacker to execute arbitrary SQL queries by inserting SQL code into an HTTP request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: nss_postgresql
References: http://www.securityfocus.com/archive/1/213331, http://www.securityfocus.com/bid/3315, https://exchange.xforce.ibmcloud.com/vulnerabilities/7111
CVE-2001-0778
OmniHTTPd 2.0.8 and earlier allow remote attackers to obtain source code via a GET request with the URL-encoded symbol for a space (%20).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: omnihttpd
References: http://archives.neohapsis.com/archives/bugtraq/2001-05/0248.html, http://www.omnicron.ca/httpd/docs/release.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6621
CVE-2001-0827
Cerberus FTP server 1.0 - 1.5 allows remote attackers to cause a denial of service (crash) via a large number of "PASV" requests.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ceberus_ftp_server
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00070.html, http://www.securityfocus.com/bid/2976, http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00070.html
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2001-0978
login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brute force password guessing attacks without being detected or observed using the lastb program.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hp-ux
References: http://archives.neohapsis.com/archives/hp/2001-q3/0052.html, http://www.iss.net/security_center/static/8632.php, http://www.securityfocus.com/bid/3289
CVE-2001-1248
vWebServer 1.2.0 allows remote attackers to view arbitrary ASP scripts via a request for an ASP script that ends with a URL-encoded space character (%20).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: vwebserver
References: http://online.securityfocus.com/archive/1/194418, http://www.iss.net/security_center/static/6769.php, http://www.securityfocus.com/bid/2975
CVE-2001-1369
Leon J Breedt pam-pgsql before 0.5.2 allows remote attackers to execute arbitrary SQL code and bypass authentication or modify user account records by injecting SQL statements into user or password fields.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pam-pgsql
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:14.pam-pgsql.asc, http://www.iss.net/security_center/static/7110.php, http://www.securityfocus.com/bid/3319
CVE-2001-1200
Microsoft Windows XP allows local users to bypass a locked screen and run certain programs that are associated with Hot Keys.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_xp
References: http://www.iss.net/security_center/static/7713.php, http://www.securityfocus.com/archive/1/246014, http://www.securityfocus.com/bid/3703
CVE-2001-0030
FoolProof 3.9 allows local users to bypass program execution restrictions by downloading the restricted executables from another source and renaming them.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: foolproof_security
References: http://www.securityfocus.com/bid/2089, https://exchange.xforce.ibmcloud.com/vulnerabilities/5758, http://www.securityfocus.com/bid/2089
CVE-2001-0676
Directory traversal vulnerability in Rit Research Labs The Bat! 1.48f and earlier allows a remote attacker to create arbitrary files via a "dot dot" attack in the filename for an attachment.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: the_bat
References: http://www.securityfocus.com/archive/1/154359, https://exchange.xforce.ibmcloud.com/vulnerabilities/5871, http://www.securityfocus.com/archive/1/154359
CVE-2001-1557
Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aix
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY20486&apar=only, http://www-1.ibm.com/support/search.wss?rs=0&q=IY23674&apar=only, http://www-1.ibm.com/support/search.wss?rs=0&q=IY20486&apar=only
CVE-2001-0991
Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other clients via an incorrect URL containing the malicious script, which is printed back in an error message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: proxomitron_naoko-4
References: http://www.securityfocus.com/archive/1/198954, http://www.securityfocus.com/bid/3087, https://exchange.xforce.ibmcloud.com/vulnerabilities/6887
CVE-2001-1058
The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to bypass access control (specified by the -restrict argument) and steal a license via a client request that includes the name of a host that is allowed to obtain the license.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mathematica
References: http://www.securityfocus.com/archive/1/200462, http://www.securityfocus.com/bid/3118, https://exchange.xforce.ibmcloud.com/vulnerabilities/6927
CVE-2001-0468
Buffer overflow in FTPFS allows local users to gain root privileges via a long user name.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ftpfs
References: http://archives.neohapsis.com/archives/bugtraq/2001-03/0163.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/6234, http://archives.neohapsis.com/archives/bugtraq/2001-03/0163.html
CVE-2001-0136
Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: proftpd, mandrake_linux, debian_linux, linux
Related CWEs: CWE-401
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0122.html, http://archives.neohapsis.com/archives/bugtraq/2001-01/0132.html, http://archives.neohapsis.com/archives/bugtraq/2001-02/0267.html
CWE: CWE-401
CVE-2001-0816
OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openssh
References: http://archives.neohapsis.com/archives/bugtraq/2001-09/0153.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000431, http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-034-01
CVE-2001-0051
IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: db2_universal_database
References: http://www.securityfocus.com/archive/1/149222, http://www.securityfocus.com/bid/2068, https://exchange.xforce.ibmcloud.com/vulnerabilities/5662
CVE-2001-1398
Masquerading code for Linux kernel before 2.2.19 does not fully check packet lengths in certain cases, which may lead to a vulnerability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: linux_kernel
References: http://marc.info/?l=bugtraq&m=98575345009963&w=2, http://marc.info/?l=bugtraq&m=98637996127004&w=2, http://marc.info/?l=bugtraq&m=98653252326445&w=2
CVE-2001-1035
Binary decoding feature of slrn 0.9 and earlier allows remote attackers to execute commands via shell scripts that are inserted into a news post.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: slrn
References: http://www.debian.org/security/2001/dsa-078, http://www.securityfocus.com/bid/3364, https://exchange.xforce.ibmcloud.com/vulnerabilities/7166
CVE-2001-0753
Cisco CBOS 2.3.8 and earlier stores the passwords for (1) exec and (2) enable in cleartext in the NVRAM and a configuration file, which could allow unauthorized users to obtain the passwords and gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cbos
References: http://www.cisco.com/warp/public/707/CBOS-multiple2-pub.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/44544, http://www.cisco.com/warp/public/707/CBOS-multiple2-pub.html
CVE-2001-1298
Webodex PHP script 1.0 and earlier allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: webodex
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html, http://www.iss.net/security_center/static/7215.php, http://www.securityfocus.com/bid/3385
CVE-2001-0105
Vulnerability in top in HP-UX 11.04 and earlier allows local users to overwrite files owned by the "sys" group.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: hp-ux
References: http://archives.neohapsis.com/archives/hp/2000-q4/0079.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/5773, http://archives.neohapsis.com/archives/hp/2000-q4/0079.html
CVE-2001-1226
AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: adcycle
References: http://www.iss.net/security_center/static/7762.php, http://www.securityfocus.com/archive/1/247126, http://www.securityfocus.com/bid/3741
CVE-2001-0113
statsconfig.pl in OmniHTTPd 2.07 allows remote attackers to execute arbitrary commands via the mostbrowsers parameter, whose value is used as part of a generated Perl script.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: omnihttpd
References: http://archives.neohapsis.com/archives/bugtraq/2001-01/0248.html, http://www.securityfocus.com/bid/2211, http://archives.neohapsis.com/archives/bugtraq/2001-01/0248.html
CVE-2001-1297
PHP remote file inclusion vulnerability in Actionpoll PHP script before 1.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: actionpoll
References: http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html, http://sourceforge.net/project/shownotes.php?release_id=58331, http://www.iss.net/security_center/static/7215.php
CVE-2001-0744
Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: imp
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2001-025.0.txt, http://archives.neohapsis.com/archives/bugtraq/2001-05/0303.html, http://www.horde.org/imp/2.2/news.php