yahoo-inc/cve-impacts huggingface dataset:
CVE-2001-1147: The PAM implementation in /bin/login of the util-linux package before 2.11 causes a password entry to be rewritten across multiple PAM calls, which could provide the credentials of one user to a different user, when used in certain PAM modules such as pam_limits.
CVE-2001-1148: Multiple buffer overflows in programs used by scoadmin and sysadmsh in SCO OpenServer 5.0.6a and earlier allow local users to gain privileges via a long TERM environment variable to (1) atcronsh, (2) auditsh, (3) authsh, (4) backupsh, (5) lpsh, (6) sysadm.menu, or (7) termsh.
Key phrases: gain privileges, gain privileges via a long TERM environment variable, buffer overflows
CVE-2001-1149: Panda Antivirus Platinum before 6.23.00 allows a remore attacker to cause a denial of service (crash) when a user selects an action for a malformed UPX packed executable file.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed upx packed executable file
CVE-2001-1150: Vulnerability in cgiWebupdate.exe in Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.5.2 through 3.5.4 allows remote attackers to read arbitrary files.
Key phrases: read arbitrary files
CVE-2001-1151: Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.53 allows remote attackers to access sensitive information from the hotdownload directory without authentication, such as the ofcscan.ini configuration file, which contains a weakly encrypted password.
Key phrases: access sensitive information from the hotdownload directory without, weakly encrypted password
CVE-2001-1152: Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters.
Key phrases: bypass blacklist restrictions, bypass blacklist restrictions and connect to unauthorized web
CVE-2001-1153: lpsystem in OpenUnix 8.0.0 allows local users to cause a denial of service and possibly execute arbitrary code via a long command line argument.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, long command line argument
CVE-2001-1154: Cyrus 2.0.15, 2.0.16, and 1.6.24 on BSDi 4.2, with IMAP enabled, allows remote attackers to cause a denial of service (hang) using PHP IMAP clients.
Key phrases: denial of service (hang), cause a denial of service (hang)
CVE-2001-1155: TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing.
Key phrases: bypass intended access restrictions, bypass intended access restrictions via DNS spoofing, dns spoofing
CVE-2001-1156: TYPSoft FTP 0.95 allows remote attackers to cause a denial of service (CPU consumption) via a "../../*" argument to (1) STOR or (2) RETR.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2001-1157: Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode.
Key phrases: bypass the filtering, bypass the filtering via (1) an
CVE-2001-1158: Check Point VPN-1/FireWall-1 4.1 base.def contains a default macro, accept_fw1_rdp, which can allow remote attackers to bypass intended restrictions with forged RDP (internal protocol) headers to UDP port 259 of arbitrary hosts.
Key phrases: bypass intended restrictions, bypass intended restrictions with forged RDP (internal
CVE-2001-1159: load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP.
Key phrases: execute arbitrary code, (1) view sensitive files via the
CVE-2001-1160: udirectory.pl in Microburst Technologies uDirectory 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the category_file field.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2001-1161: Cross-site scripting (CSS) vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script.
Key phrases: execute script on other web clients via a, cross-site scripting (css)
CVE-2001-1162: Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file.
Key phrases: overwrite certain files via a .. in a, directory traversal
CVE-2001-1163: Buffer overflow in Munica Corporation NetSQL 1.0 allows remote attackers to execute arbitrary code via a long CONNECT argument to port 6500.
Key phrases: execute arbitrary code, execute arbitrary code via a long CONNECT argument, buffer overflow
CVE-2001-1164: Buffer overflow in uucp utilities in UnixWare 7 allows local users to execute arbitrary code via long command line arguments to (1) uucp, (2) uux, (3) bnuconvert, (4) uucico, (5) uuxcmd, or (6) uuxqt.
Key phrases: execute arbitrary code, execute arbitrary code via long command line arguments, buffer overflow
CVE-2001-1165: Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which allows local users to gain privileges by decrypting the information, e.g., with the Disengage tool.
Key phrases: gain privileges, gain privileges by decrypting the information, weak encryption
CVE-2001-1166: linprocfs on FreeBSD 4.3 and earlier does not properly restrict access to kernel memory, which allows one process with debugging rights on a privileged process to read restricted memory from that process.
Key phrases: read restricted memory from that process
CVE-2001-1168: Directory traversal vulnerability in index.php in PhpMyExplorer before 1.2.1 allows remote attackers to read arbitrary files via a ..%2F (modified dot dot) in the chemin parameter.
Key phrases: read arbitrary files, read arbitrary files via a ..%2F, directory traversal
CVE-2001-1169: keyinit in S/Key does not require authentication to initialize a one-time password sequence, which allows an attacker who has gained privileges to a user account to create new one-time passwords for use in other activities that may use S/Key authentication, such as sudo.
Key phrases: a user account to create new one-, gain privileges
CVE-2001-1170: AmTote International homebet program stores the homebet.log file in the homebet/ virtual directory, which allows remote attackers to steal account and PIN numbers.
Key phrases: steal account and PIN numbers
CVE-2001-1171: Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow local users to gain privileges or modify the firewall policy.
Key phrases: gain privileges, gain privileges or modify the firewall policy, world-writable temporary .cpp file
CVE-2001-1172: OmniSecure HTTProtect 1.1.1 allows a superuser without omnish privileges to modify a protected file by creating a symbolic link to that file.
Key phrases: modify a protected file by creating a symbolic, symbolic link
CVE-2001-1173: Vulnerability in MasqMail before 0.1.15 allows local users to gain privileges via piped aliases.
Key phrases: gain privileges, gain privileges via piped aliases
CVE-2001-1174: Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header.
Key phrases: execute arbitrary code, execute arbitrary code via a long Message-, buffer overflow
CVE-2001-1175: vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing.
Key phrases: world-readable
CVE-2001-1176: Format string vulnerability in Check Point VPN-1/FireWall-1 4.1 allows a remote authenticated firewall administrator to execute arbitrary code via format strings in the control connection.
Key phrases: execute arbitrary code, execute arbitrary code via format strings in the
CVE-2001-1177: ml85p in Samsung ML-85G GDI printer driver before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2001-1178: Buffer overflow in xman allows local users to gain privileges via a long MANPATH environment variable.
Key phrases: gain privileges, gain privileges via a long MANPATH environment variable, buffer overflow
CVE-2001-1179: xman allows local users to gain privileges by modifying the MANPATH to point to a man page whose filename contains shell metacharacters.
Key phrases: gain privileges, gain privileges by modifying the MANPATH to point, shell metacharacters
CVE-2001-1180: FreeBSD 4.3 does not properly clear shared signal handlers when executing a process, which allows local users to gain privileges by calling rfork with a shared signal handler, having the child process execute a setuid program, and sending a signal to the child.
Key phrases: gain privileges, gain privileges by calling rfork with a shared, shared signal handlers
CVE-2001-1181: Dynamically Loadable Kernel Module (dlkm) static kernel symbol table in HP-UX 11.11 is not properly configured, which allows local users to gain privileges.
Key phrases: gain privileges
CVE-2001-1182: Vulnerability in login in HP-UX 11.00, 11.11, and 10.20 allows restricted shell users to bypass certain security checks and gain privileges.
Key phrases: bypass certain security checks, gain privileges, bypass certain security checks and gain privileges, vulnerability in login
CVE-2001-1183: PPTP implementation in Cisco IOS 12.1 and 12.2 allows remote attackers to cause a denial of service (crash) via a malformed packet.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed packet
CVE-2001-1184: wrshdsp.exe in Denicomp Winsock RSHD/NT 2.21.00 and earlier allows remote attackers to cause a denial of service (CPU consumption) via (1) in 2.20.00 and earlier, an invalid port number such as a negative number, which causes a connection attempt to that port and all ports below 1024, and (2) in 2.21.00, a port number of 1024.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption, invalid port number, negative number
CVE-2001-1185: Some AIO operations in FreeBSD 4.4 may be delayed until after a call to execve, which could allow a local user to overwrite memory of the new process and gain privileges.
Key phrases: gain privileges, overwrite memory of the new process and gain
CVE-2001-1186: Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents IIS from timing out the connection.
Key phrases: cause a denial of service via an HTTP
CVE-2001-1187: csvform.pl 0.1 allows remote attackers to execute arbitrary commands via metacharacters in the file parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via metacharacters in the file
CVE-2001-1188: mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier allows remote attackers to send SPAM e-mail through remote servers by modifying the sendto, email, server, subject, and resulturl hidden form fields.
Key phrases: send SPAM e-mail through remote servers
CVE-2001-1189: IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script.
Key phrases: obtain the passwords, obtain the passwords via a JSP script, cleartext
CVE-2001-1190: The default PAM files included with passwd in Mandrake Linux 8.1 do not support MD5 passwords, which could result in a lower level of password security than intended.
Key phrases: lower level of password security
CVE-2001-1191: WebSeal in IBM Tivoli SecureWay Policy Director 3.8 allows remote attackers to cause a denial of service (crash) via a URL that ends in %2e.
Key phrases: denial of service (crash), cause a denial of service (crash), webseal
CVE-2001-1192: Citrix Independent Computing Architecture (ICA) Client for Windows 6.1 allows remote malicious web sites to execute arbitrary code via a .ICA file, which is downloaded and automatically executed by the client.
Key phrases: execute arbitrary code, execute arbitrary code via a .ICA file
CVE-2001-1193: Directory traversal vulnerability in EFTP 2.0.8.346 allows local users to read directories via a ... (modified dot dot) in the CWD command.
Key phrases: read directories via a ... (modified dot, directory traversal
CVE-2001-1194: Zyxel Prestige 681 and 1600 SDSL Routers allow remote attackers to cause a denial of service via malformed packets with (1) an IP length less than actual packet size, or (2) fragmented packets whose size exceeds 64 kilobytes after reassembly.
Key phrases: cause a denial of service via malformed packets, fragmented packets
CVE-2001-1195: Novell Groupwise 5.5 and 6.0 Servlet Gateway is installed with a default username and password for the servlet manager, which allows remote attackers to gain privileges.
Key phrases: gain privileges, default username
CVE-2001-1196: Directory traversal vulnerability in edit_action.cgi of Webmin Directory 0.91 allows attackers to gain privileges via a '..' (dot dot) in the argument.
Key phrases: gain privileges, gain privileges via a '..' (, directory traversal
CVE-2001-1197: klprfax_filter in KDE2 KDEUtils allows local users to overwrite arbitrary files via a symlink attack on the klprfax.filter temporary file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2001-1198: RLPDaemon in HP-UX 10.20 and 11.0 allows local users to overwrite arbitrary files and gain privileges by specifying the target file in the -L option.
Key phrases: overwrite arbitrary files, gain privileges, overwrite arbitrary files and gain privileges by specifying, rlpdaemon
CVE-2001-1199: Cross-site scripting vulnerability in agora.cgi for Agora 3.0a through 4.0g, when debug mode is enabled, allows remote attackers to execute Javascript on other clients via the cart_id parameter.
Key phrases: execute Javascript on other clients via the cart_id, cross-site scripting
CVE-2001-1200: Microsoft Windows XP allows local users to bypass a locked screen and run certain programs that are associated with Hot Keys.
Key phrases: bypass a locked screen, bypass a locked screen and run certain programs, hot keys
CVE-2001-1201: Buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file.
Key phrases: execute arbitrary code, execute arbitrary code via long lines in the, buffer overflow
CVE-2001-1202: Cross-site scripting vulnerability in DeleGate 7.7.0 and 7.7.1 does not quote scripting commands within a "403 Forbidden" error page, which allows remote attackers to execute arbitrary Javascript on other clients via a URL that generates an error.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript on other clients via a, cross-site scripting, arbitrary javascript
CVE-2001-1203: Format string vulnerability in gpm-root in gpm 1.17.8 through 1.17.18 allows local users to gain root privileges.
Key phrases: gain root privileges, format string
CVE-2001-1204: Directory traversal vulnerability in phprocketaddin in Total PC Solutions PHP Rocket Add-in for FrontPage 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2001-1205: Directory traversal vulnerability in lastlines.cgi for Last Lines 2.0 allows remote attackers to read arbitrary files via '..' sequences in the $error_log variable.
Key phrases: read arbitrary files, read arbitrary files via '..' sequences, directory traversal
CVE-2001-1206: Matrix CGI vault Last Lines 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the $error_log variable.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2001-1207: Buffer overflows in DayDream BBS 2.9 through 2.13 allow remote attackers to possibly execute arbitrary code via the control codes (1) ~#MC, (2) ~#TF, or (3) ~#RA.
Key phrases: execute arbitrary code, possibly execute arbitrary code via the control codes, buffer overflows
CVE-2001-1208: Format string vulnerability in DayDream BBS allows remote attackers to execute arbitrary code via format string specifiers in a file containing a ~#RA control code.
Key phrases: execute arbitrary code, execute arbitrary code via format string specifiers in
CVE-2001-1209: Directory traversal vulnerability in zml.cgi allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2001-1210: Cisco ubr900 series routers that conform to the Data-over-Cable Service Interface Specifications (DOCSIS) standard must ship without SNMP access restrictions, which can allow remote attackers to read and write information to the MIB using arbitrary community strings.
Key phrases: using arbitrary community strings, read and write information to the MIB using, snmp access restrictions
CVE-2001-1211: Ipswitch IMail 7.0.4 and earlier allows attackers with administrator privileges to read and modify user alias and mailing list information for other domains hosted by the same server via the (1) aliasadmin or (2) listadm1 CGI programs, which do not properly verify that an administrator is the administrator for the target domain.
Key phrases: read and modify user alias and mailing list
CVE-2001-1212: Cross-site scripting vulnerability in catgy.cgi for Aktivate 1.03 allows remote attackers to execute arbitrary Javascript via the desc parameter.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript via the desc parameter, cross-site scripting, arbitrary javascript
CVE-2001-1213: The default configuration of DataWizard FtpXQ 2.0 and 2.1 includes a default username and password, which allows remote attackers to read and write arbitrary files in the root folder.
Key phrases: write arbitrary files, read and write arbitrary files in the root
CVE-2001-1214: manual.php in Marcus S. Xenakis Unix Manual 1.0 allows remote attackers to execute arbitrary code via a URL that contains shell metacharacters.
Key phrases: execute arbitrary code, execute arbitrary code via a URL that contains, shell metacharacters
CVE-2001-1215: Format string vulnerability in PFinger 0.7.5 through 0.7.7 allows remote attackers to execute arbitrary code via format string specifiers in a .plan file.
Key phrases: execute arbitrary code, execute arbitrary code via format string specifiers in
CVE-2001-1216: Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
Key phrases: execute arbitrary code, execute arbitrary code via a long request for, buffer overflow
CVE-2001-1217: Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
Key phrases: access sensitive information via a double encoded URL, directory traversal
CVE-2001-1218: Microsoft Internet Explorer for Unix 5.0SP1 allows local users to possibly cause a denial of service (crash) in CDE or the X server on Solaris 2.6 by rapidly scrolling Chinese characters or maximizing the window.
Key phrases: denial of service (crash), possibly cause a denial of service (crash
CVE-2001-1219: Microsoft Internet Explorer 6.0 and earlier allows malicious website operators to cause a denial of service (client crash) via JavaScript that continually refreshes the window via self.location.
Key phrases: denial of service (client crash), cause a denial of service (client crash
CVE-2001-1220: D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plaintext in the default Management Information Base (MIB), which allows remote attackers to gain administrative privileges.
Key phrases: gain administrative privileges, plaintext
CVE-2001-1221: D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point uses a default SNMP community string of 'public' which allows remote attackers to gain sensitive information.
Key phrases: gain sensitive information, snmp community string
CVE-2001-1222: Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid account name for the domain.
Key phrases: obtain PHP source code via an HTTP request containing
CVE-2001-1223: The web administration server for ELSA Lancom 1100 Office does not require authentication, which allows arbitrary remote attackers to gain administrative privileges by connecting to the server.
Key phrases: gain administrative privileges, gain administrative privileges by connecting to the server, authentication
CVE-2001-1224: get_input in adrotate.pm for Les VanBrunt AdRotate Pro 2.0 allows remote attackers to modify the database and possibly execute arbitrary commands via a SQL code injection attack.
Key phrases: execute arbitrary commands, modify the database and possibly execute arbitrary commands, sql code injection
CVE-2001-1225: Hughes Technology Mini SQL 2.0.10 through 2.0.12 allows local users to cause a denial of service by creating a very large array in a table, which causes miniSQL to crash when the table is queried.
Key phrases: cause a denial of service by creating a, large array, crash
CVE-2001-1226: AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database.
Key phrases: modify SQL queries
CVE-2001-1227: Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags.
Key phrases: bypass security controls, bypass security controls for certain methods by accessing
CVE-2001-1228: Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute code via a long file name, possibly remotely if gzip is run on an FTP server.
Key phrases: execute code via a long file name, buffer overflows
CVE-2001-1229: Buffer overflows in (1) Icecast before 1.3.9 and (2) libshout before 1.0.4 allow remote attackers to cause a denial of service (crash) and execute arbitrary code.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2001-1230: Buffer overflows in Icecast before 1.3.10 allow remote attackers to cause a denial of service (crash) and execute arbitrary code.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2001-1231: GroupWise 5.5 and 6 running in live remote or smart caching mode allows remote attackers to read arbitrary users' mailboxes by extracting usernames and passwords from sniffed network traffic, as addressed by the "Padlock" fix.
Key phrases: read arbitrary users, read arbitrary users' mailboxes by extracting usernames
CVE-2001-1232: GroupWise WebAccess 5.5 with directory indexing enabled allows a remote attacker to view arbitrary directory contents via an HTTP request with a lowercase "get".
Key phrases: view arbitrary directory contents, view arbitrary directory contents via an HTTP request, directory indexing
CVE-2001-1233: Netware Enterprise Web Server 5.1 running GroupWise WebAccess 5.5 with Novell Directory Services (NDS) enabled allows remote attackers to enumerate user names, group names and other system information by accessing ndsobj.nlm.
Key phrases: enumerate user names
CVE-2001-1234: Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable.
Key phrases: execute arbitrary code, execute arbitrary code by including files from remote, includedir variable
CVE-2001-1235: pSlash PHP script 0.7 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable.
Key phrases: execute arbitrary code, execute arbitrary code by including files from remote
CVE-2001-1236: myphpPagetool PHP script 0.4.3-1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable.
Key phrases: execute arbitrary code, execute arbitrary code by including files from remote
CVE-2001-1237: Phormation PHP script 0.9.1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the phormationdir variable.
Key phrases: execute arbitrary code, execute arbitrary code by including files from remote
CVE-2001-1238: Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the Process tab which could allow local users to install Trojan horses that cannot be stopped with the Task Manager.
Key phrases: end processes with uppercase letters named (1, install Trojan horses that cannot be stopped
CVE-2001-1239: PowerNet IX allows remote attackers to cause a denial of service via a port scan.
Key phrases: cause a denial of service via a port, powernet ix
CVE-2001-1240: The default configuration of sudo in Engarde Secure Linux 1.0.1 allows any user in the admin group to run certain commands that could be leveraged to gain full root access.
Key phrases: gain full root access, run certain commands that could be leveraged to, gain root access
CVE-2001-1241: Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to execute arbitrary commands by directing Un-CGI to a document that begins with "#!"  and the desired program name.
Key phrases: execute arbitrary commands, execute arbitrary commands by directing Un-CGI
CVE-2001-1242: Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an HTML form.
Key phrases: execute arbitrary code, execute arbitrary code via a .. (dot, directory traversal
CVE-2001-1243: Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2001-1244: Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process.
Key phrases: denial of service (bandwidth and CPU exhaustion), cause a denial of service (bandwidth and, cpu exhaustion
CVE-2001-1245: Opera 5.0 for Linux does not properly handle malformed HTTP headers, which allows remote attackers to cause a denial of service, possibly with a header whose value is the same as a MIME header name.
Key phrases: cause a denial of service, malformed http headers
CVE-2001-1246: PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters
CVE-2001-1247: PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to access the files.
Key phrases: read and write files owned by the web, to write files
CVE-2001-1248: vWebServer 1.2.0 allows remote attackers to view arbitrary ASP scripts via a request for an ASP script that ends with a URL-encoded space character (%20).
Key phrases: view arbitrary ASP scripts, view arbitrary ASP scripts via a request for
CVE-2001-1249: vWebServer 1.2.0 allows remote attackers to cause a denial of service via a URL that contains MS-DOS device names.
Key phrases: cause a denial of service via a URL, ms-dos device names
CVE-2001-1250: vWebServer 1.2.0 allows remote attackers to cause a denial of service (hang) via a small number of long URL requests, possibly due to a buffer overflow.
Key phrases: denial of service (hang), cause a denial of service (hang), buffer overflow
CVE-2001-1251: SmallHTTP 1.204 through 3.00 beta 8 allows remote attackers to cause a denial of service via multiple long URL requests.
Key phrases: cause a denial of service via multiple long
CVE-2001-1252: Network Associates PGP Keyserver 7.0 allows remote attackers to bypass authentication and access the administrative web interface via URLs that directly access cgi-bin instead of keyserver/cgi-bin for the programs (1) console, (2) cs, (3) multi_config and (4) directory.
Key phrases: bypass authentication, bypass authentication and access the administrative web interface
CVE-2001-1253: Alexis 2.0 and 2.1 in COM2001 InternetPBX stores voicemail passwords in plain text in the com2001.ini file, which could allow local users to make long distance calls as other users.
Key phrases: make long distance calls as other users, plain text
CVE-2001-1254: Web Access component for COM2001 Alexis 2.0 and 2.1 in InternetPBX sends username and voice mail passwords in the clear via a Java applet that sends the information to port 8888 of the server, which could allow remote attackers to steal the passwords via sniffing.
Key phrases: steal the passwords via sniffing
CVE-2001-1255: WinMySQLadmin 1.1 stores the MySQL password in plain text in the my.ini file, which allows local users to obtain unathorized access the MySQL database.
Key phrases: obtain unathorized access, obtain unathorized access the MySQL database, plain text
CVE-2001-1256: kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable files via a symlink attack on the (1) /tmp/.kmmodreg_lock and (2) /tmp/kmpath.tmp temporary files.
Key phrases: create arbitrary world, create arbitrary world-writeable files via a, symlink
CVE-2001-1257: Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript embedded in an email, cross-site scripting, arbitrary javascript
CVE-2001-1258: Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server.
Key phrases: read IMP configuration files and steal the Horde
CVE-2001-1259: Avaya Argent Office allows remote attackers to cause a denial of service by sending UDP packets to port 53 with no payload.
Key phrases: cause a denial of service by sending UDP, no payload
CVE-2001-1260: Avaya Argent Office uses weak encryption (trivial encoding) for passwords, which allows remote attackers to gain administrator privileges by sniffing and decrypting the sniffing the passwords during a system reboot.
Key phrases: gain administrator privileges, gain administrator privileges by sniffing and decrypting the, weak encryption, system reboot
CVE-2001-1261: Avaya Argent Office 2.1 may allow remote attackers to change hold music by spoofing a legitimate server's response to a TFTP broadcast and providing an alternate HoldMusic file.
Key phrases: change hold music by spoofing a legitimate server
CVE-2001-1262: Avaya Argent Office 2.1 compares a user-provided SNMP community string with the correct string only up to the length of the user-provided string, which allows remote attackers to bypass authentication with a 0 length community string.
Key phrases: bypass authentication, bypass authentication with a 0 length community string
CVE-2001-1263: telnet95.exe in Pragma InterAccess 4.0 build 5 allows remote attackers to cause a denial of service (crash) via a large number of characters to port 23, possibly due to a buffer overflow.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2001-1264: Vulnerability in mkacct in HP-UX 11.04 running Virtualvault Operating System (VVOS) 4.0 and 4.5 allows attackers to elevate privileges.
Key phrases: elevate privileges
CVE-2001-1265: Directory traversal vulnerability in IBM alphaWorks Java TFTP server 1.21 allows remote attackers to conduct unauthorized operations on arbitrary files via a .. (dot dot) attack.
Key phrases: conduct unauthorized operations on arbitrary files via a, directory traversal, .. (dot dot), dot dot attack
CVE-2001-1266: Directory traversal vulnerability in Doug Neal's HTTPD Daemon (DNHTTPD) before 0.4.1 allows remote attackers to view arbitrary files via a .. (dot dot) attack using the dot hex code '%2E'.
Key phrases: view arbitrary files, view arbitrary files via a .. (dot, directory traversal, .. (dot dot), dot dot attack
CVE-2001-1267: Directory traversal vulnerability in GNU tar 1.13.19 and earlier allows local users to overwrite arbitrary files during archive extraction via a tar file whose filenames contain a .. (dot dot).
Key phrases: overwrite arbitrary files, overwrite arbitrary files during archive extraction via a, directory traversal
CVE-2001-1268: Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename.
Key phrases: overwrite arbitrary files, overwrite arbitrary files during archive extraction via a, directory traversal
CVE-2001-1269: Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' (slash) character.
Key phrases: overwrite arbitrary files, overwrite arbitrary files during archive extraction via filenames
CVE-2001-1270: Directory traversal vulnerability in the console version of PKZip (pkzipc) 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec (recursive) option via a .. (dot dot) attack on the archived files.
Key phrases: overwrite arbitrary files, overwrite arbitrary files during archive extraction with the, directory traversal, .. (dot dot), dot dot attack
CVE-2001-1271: Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a ..  (dot dot) attack on archived filenames.
Key phrases: overwrite arbitrary files, overwrite arbitrary files during archive extraction via a, directory traversal, .. (dot dot), dot dot attack
CVE-2001-1272: wmtv 0.6.5 and earlier does not properly drop privileges, which allows local users to execute arbitrary commands via the -e (external command) option.
Key phrases: execute arbitrary commands, execute arbitrary commands via the -e (external
CVE-2001-1273: The "mxcsr P4" vulnerability in the Linux kernel before 2.2.17-14, when running on certain Intel CPUs, allows local users to cause a denial of service (system halt).
Key phrases: denial of service (system halt), cause a denial of service (system halt, mxcsr
CVE-2001-1274: Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service and possibly gain privileges.
Key phrases: gain privileges, cause a denial of service and possibly gain, buffer overflow
CVE-2001-1275: MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from the mysql.user table and possibly gain privileges via password cracking.
Key phrases: obtain the encrypted administrator password, gain privileges, use the SHOW GRANTS command to obtain the, password cracking
CVE-2001-1276: ispell before 3.1.20 allows local users to overwrite files of other users via a symlink attack on a temporary file.
Key phrases: overwrite files of other users via a symlink
CVE-2001-1277: makewhatis in the man package before 1.5i2 allows an attacker in group man to overwrite arbitrary files via a man page whose name contains shell metacharacters.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a man page whose, shell metacharacters
CVE-2001-1278: Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags.
Key phrases: bypass security controls, bypass security controls for certain methods by accessing
CVE-2001-1279: Buffer overflow in print-rx.c of tcpdump 3.x (probably 3.6x) allows remote attackers to cause a denial of service and possibly execute arbitrary code via AFS RPC packets with invalid lengths that trigger an integer signedness error, a different vulnerability than CVE-2000-1026.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow, integer signedness error
CVE-2001-1280: POP3 Server for Ipswitch IMail 7.04 and earlier generates different responses to valid and invalid user names, which allows remote attackers to determine users on the system.
Key phrases: determine users on the system
CVE-2001-1281: Web Messaging Server for Ipswitch IMail 7.04 and earlier allows remote authenticated users to change information for other users by modifying the olduser parameter in the "Change User Information" web form.
Key phrases: change information for other users by modifying the
CVE-2001-1282: Ipswitch IMail 7.04 and earlier records the physical path of attachments in an e-mail message header, which could allow remote attackers to obtain potentially sensitive configuration information.
Key phrases: obtain potentially sensitive configuration information
CVE-2001-1283: The webmail interface for Ipswitch IMail 7.04 and earlier allows remote authenticated users to cause a denial of service (crash) via a mailbox name that contains a large number of . (dot) or other characters to programs such as (1) readmail.cgi or (2) printmail.cgi, possibly due to a buffer overflow that may allow execution of arbitrary code.
Key phrases: denial of service (crash), cause a denial of service (crash), execution of arbitrary code, buffer overflow
CVE-2001-1284: Ipswitch IMail 7.04 and earlier uses predictable session IDs for authentication, which allows remote attackers to hijack sessions of other users.
Key phrases: hijack sessions of other users, predictable session ids
CVE-2001-1285: Directory traversal vulnerability in readmail.cgi for Ipswitch IMail 7.04 and earlier allows remote attackers to access the mailboxes of other users via a .. (dot dot) in the mbx parameter.
Key phrases: access the mailboxes of other users via a, directory traversal
CVE-2001-1286: Ipswitch IMail 7.04 and earlier stores a user's session ID in a URL, which could allow remote attackers to hijack sessions by obtaining the URL, e.g. via an HTML email that causes the Referrer to be sent to a URL under the attacker's control.
Key phrases: hijack sessions by obtaining the URL
CVE-2001-1287: Buffer overflow in Web Calendar in Ipswitch IMail 7.04 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP GET, buffer overflow
CVE-2001-1288: Windows 2000 and Windows NT allows local users to cause a denial of service (reboot) by executing a command at the command prompt and pressing the F7 and enter keys several times while the command is executing, possibly related to an exception handling error in csrss.exe.
Key phrases: denial of service (reboot), cause a denial of service (reboot), exception handling error, execute commands
CVE-2001-1289: Quake 3 arena 1.29f and 1.29g allows remote attackers to cause a denial of service (crash) via a malformed connection packet that begins with several char-255 characters.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed connection packet
CVE-2001-1290: admin.cgi in Active Classifieds Free Edition 1.0, and possibly commercial versions, allows remote attackers to modify the configuration, gain privileges, and execute arbitrary Perl code via the table_width parameter.
Key phrases: execute arbitrary Perl code, gain privileges, modify the configuration
CVE-2001-1291: The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to break into the server via brute force password guessing.
Key phrases: incorrect username, brute force password guessing
CVE-2001-1292: Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, long password
CVE-2001-1293: Buffer overflow in web server of 3com HomeConnect Cable Modem External with USB (#3CR29223) allows remote attackers to cause a denial of service (crash) via a long HTTP request.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2001-1294: Buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier allows remote attackers to cause a denial of service (crash) in the Webmail interface via a long username and password.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2001-1295: Directory traversal vulnerability in Cerberus FTP Server 1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the CD command.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2001-1296: More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
Key phrases: include arbitrary files, include arbitrary files from remote web sites via, groupware php script
CVE-2001-1297: PHP remote file inclusion vulnerability in Actionpoll PHP script before 1.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2001-1298: Webodex PHP script 1.0 and earlier allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
Key phrases: include arbitrary files, include arbitrary files from remote web sites via
CVE-2001-1299: Zorbat Zorbstats PHP script before 0.9 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
Key phrases: include arbitrary files, include arbitrary files from remote web sites via, includedir variable
CVE-2001-1300: Directory traversal vulnerability in Dynu FTP server 1.05 and earlier allows remote attackers to read arbitrary files via a .. in the CD (CWD) command.
Key phrases: read arbitrary files, read arbitrary files via a .. in the, directory traversal
CVE-2001-1301: rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other packages, allows local users to modify files of other users via a symlink attack on a temporary file.
Key phrases: modify files of other users via a symlink
CVE-2001-1302: The change password option in the Windows Security interface for Windows 2000 allows attackers to use the option to attempt to change passwords of other users on other systems or identify valid accounts by monitoring error messages, possibly due to a problem in the NetuserChangePassword function.
Key phrases: use the option to attempt to change passwords
CVE-2001-1303: The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for the protected network without authentication.
Key phrases: obtain sensitive configuration information, obtain sensitive configuration information for the protected network
CVE-2001-1304: Buffer overflow in SHOUTcast Server 1.8.2 allows remote attackers to cause a denial of service (crash) via several HTTP requests with a long (1) user-agent or (2) host HTTP header.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2001-1305: ICQ 2001a Alpha and earlier allows remote attackers to automatically add arbitrary UINs to an ICQ user's contact list via a URL to a web page with a Content-Type of application/x-icq, which is processed by Internet Explorer.
Key phrases: add arbitrary UINs, automatically add arbitrary UINs to an ICQ user, arbitrary uins
CVE-2001-1306: iPlanet Directory Server 4.1.4 and earlier (LDAP) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid BER length of length fields, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), invalid ber length of length fields
CVE-2001-1307: Buffer overflows in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2001-1308: Format string vulnerabilities in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), format string
CVE-2001-1309: Buffer overflows in IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2001-1310: IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for the L field of a BER encoding, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), invalid encodings
CVE-2001-1311: Buffer overflows in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2001-1312: Format string vulnerabilities in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), format string