yahoo-inc/cve-impacts huggingface dataset:
CVE-2001-1313: Lotus Domino R5 before R5.0.7a allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via miscellaneous packets with semi-valid BER encodings, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), miscellaneous packets, semi-valid ber encodings
CVE-2001-1314: Buffer overflows in Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2001-1315: Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed BER encodings, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), malformed ber encodings
CVE-2001-1316: Buffer overflows in Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2001-1317: Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for certain BER object types, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), invalid encodings
CVE-2001-1318: Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash)
CVE-2001-1319: Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptional BER encodings for the LDAP filter type field, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: denial of service (hang), cause a denial of service (hang), exceptional ber encodings
CVE-2001-1320: Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), exceptional ber encodings, buffer overflows
CVE-2001-1321: Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings of BER OBJECT-IDENTIFIER values, as demonstrated by the PROTOS LDAPv3 test suite.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), invalid encodings of ber object-identifier values
CVE-2001-1322: xinetd 2.1.8 and earlier runs with a default umask of 0, which could allow local users to read or modify files that are created by an application that runs under xinetd but does not set its own safe umask.
Key phrases: read or modify files that are created by
CVE-2001-1323: Buffer overflow in MIT Kerberos 5 (krb5) 1.2.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via base-64 encoded data, which is not properly handled when the radix_encode function processes file glob output from the ftpglob function.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2001-1324: cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
Key phrases: gain privileges
CVE-2001-1325: Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using an IFRAME tag, possibly due to a vulnerability in Windows Scripting Host (WSH).
Key phrases: execute scripts when Active Scripting is disabled by, windows scripting host (wsh)
CVE-2001-1326: Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables in HTML content" option is disabled, via an HTML email with a form that is activated from an image that the attacker spoofs as a link, which causes the user to execute the form and access embedded attachments.
Key phrases: execute arbitrary code, execute arbitrary code when the "Use Microsoft, execute the form and access embedded attachments, spoofing
CVE-2001-1327: pmake before 2.1.35 in Turbolinux 6.05 and earlier is installed with setuid root privileges, which could allow local users to gain privileges by exploiting vulnerabilities in pmake or programs that are used by pmake.
Key phrases: gain privileges, gain privileges by exploiting vulnerabilities in pmake or, root privilege
CVE-2001-1328: Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2001-1329: Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument.
Key phrases: gain root privileges, gain root privileges via a long command line, buffer overflow
CVE-2001-1330: Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument.
Key phrases: gain root privileges, gain root privileges via a long command line, buffer overflow
CVE-2001-1331: mandb in the man-db package before 2.3.16-3 allows local users to overwrite arbitrary files via the command line options (1) -u or (2) -c, which do not drop privileges and follow symlinks.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via the command line options
CVE-2001-1332: Buffer overflows in Linux CUPS before 1.1.6 may allow remote attackers to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflows
CVE-2001-1333: Linux CUPS before 1.1.6 does not securely handle temporary files, possibly due to a symlink vulnerability that could allow local users to overwrite files.
Key phrases: overwrite files, symlink
CVE-2001-1334: Block_render_url.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating a block and specifying the target file as the source URL.
Key phrases: read arbitrary files, read arbitrary files by creating a block and
CVE-2001-1335: Directory traversal vulnerability in CesarFTP 0.98b and earlier allows remote authenticated users (such as anonymous) to read arbitrary files via a GET with a filename that contains a ...%5c (modified dot dot).
Key phrases: read arbitrary files, read arbitrary files via a GET with a, directory traversal
CVE-2001-1336: CesarFTP 0.98b and earlier stores usernames and passwords in plaintext in the settings.ini file, which allows attackers to gain privileges.
Key phrases: gain privileges, plaintext
CVE-2001-1337: Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request.
Key phrases: cause a denial of service via a long, long http request
CVE-2001-1338: Beck IPC GmbH IPC@CHIP TelnetD server generates different responses when given valid and invalid login names, which allows remote attackers to determine accounts on the system.
Key phrases: determine accounts on the system, invalid login names
CVE-2001-1339: Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks.
Key phrases: bad passwords, brute force password guessing
CVE-2001-1340: Beck GmbH IPC@Chip TelnetD service supports only one connection and does not disconnect a user who does not complete the login process, which allows remote attackers to lock out the administrator account by connecting to the service.
Key phrases: lock out the administrator account by connecting to
CVE-2001-1341: The Beck GmbH IPC@Chip embedded web server installs the chipcfg.cgi program by default, which allows remote attackers to obtain sensitive network information via a request to the program.
Key phrases: obtain sensitive network information, obtain sensitive network information via a request to
CVE-2001-1342: Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.
Key phrases: denial of service (GPF), cause a denial of service (GPF), null pointer
CVE-2001-1343: ws_mail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacters in the kill parameter.
Key phrases: execute arbitrary code, execute arbitrary code via shell metacharacters in the
CVE-2001-1344: WSSecurity.pl in WebStore allows remote attackers to bypass authentication by providing the program with a filename that exists, which is made easier by (1) inserting a null character or (2) .. (dot dot).
Key phrases: bypass authentication, bypass authentication by providing the program with a
CVE-2001-1345: bctool in Jetico BestCrypt 0.7 and earlier trusts the user-supplied PATH to find and execute an fsck utility program, which allows local users to gain privileges by modifying the PATH to point to a Trojan horse program.
Key phrases: gain privileges, gain privileges by modifying the PATH to point
CVE-2001-1346: Computer Associates ARCserveIT 6.61 and 6.63 (also called ARCservIT) allows local users to overwrite arbitrary files via a symlink attack on the temporary files (1) asagent.tmp or (2) inetd.tmp.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2001-1347: Windows 2000 allows local users to cause a denial of service and possibly gain privileges by setting a hardware breakpoint that is handled using global debug registers, which could cause other processes to terminate due to an exception, and allow hijacking of resources such as named pipes.
Key phrases: gain privileges, cause a denial of service and possibly gain, hijacking of resources such as named pipes, hardware breakpoint
CVE-2001-1348: TWIG 2.6.2 and earlier allows remote attackers to perform unauthorized database operations via a SQL injection attack on the id parameter.
Key phrases: perform unauthorized database operations via a SQL injection, sql injection
CVE-2001-1349: Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and possibly corrupt the heap and gain privileges via race conditions in signal handlers.
Key phrases: gain privileges, cause a denial of service and possibly corrupt, race conditions
CVE-2001-1350: Cross-site scripting vulnerability in namazu.cgi for Namazu 2.0.7 and earlier allows remote attackers to execute arbitrary Javascript as other web users via the lang parameter.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript as other web users via, cross-site scripting, arbitrary javascript
CVE-2001-1351: Cross-site scripting vulnerability in Namazu 2.0.8 and earlier allows remote attackers to execute arbitrary Javascript as other web users via the index file name that is displayed when displaying hit numbers.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript as other web users via, cross-site scripting, hit numbers, arbitrary javascript
CVE-2001-1352: Cross-site scripting vulnerability in Namazu 2.0.9 and earlier allows remote attackers to execute arbitrary Javascript as other web users via an error message that is returned when an invalid index file is specified in the idxname parameter.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript as other web users via, cross-site scripting, arbitrary javascript
CVE-2001-1353: ghostscript before 6.51 allows local users to read and write arbitrary files as the 'lp' user via the file operator, even with -dSAFER enabled.
Key phrases: write arbitrary files, read and write arbitrary files as the '
CVE-2001-1354: NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Key phrases: decrypt passwords or use a different password that, weak password hashing
CVE-2001-1355: Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to (1) the -del command or (2) the -lookup command.
Key phrases: execute arbitrary code, execute arbitrary code via long arguments to (, buffer overflows
CVE-2001-1356: NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.
Key phrases: conduct brute force password guessing attacks against the, weak hashing
CVE-2001-1357: Multiple vulnerabilities in phpMyChat before 0.14.5 exist in (1) input.php3, (2) handle_inputH.php3, or (3) index.lib.php3 with unknown consequences, possibly related to user spoofing or improperly initialized variables.
Key phrases: unknown consequences, improperly initialized variables, spoofing
CVE-2001-1358: Vulnerabilities in phpMyChat before 0.14.4 allow local and possibly remote attackers to gain privileges by specifying an alternate library file in the L (localization) parameter.
Key phrases: gain privileges, gain privileges by specifying an alternate library file
CVE-2001-1359: Volution clients 1.0.7 and earlier attempt to contact the computer creation daemon (CCD) when an LDAP authentication failure occurs, which allows remote attackers to fully control clients via a Trojan horse Volution server.
Key phrases: fully control clients via a Trojan horse Volution, ldap authentication failure
CVE-2001-1360: Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned.
CVE-2001-1361: Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.
CVE-2001-1362: Vulnerability in the server for nPULSE before 0.53p4.
CVE-2001-1363: Vulnerability in phpWebSite before 0.7.9 related to running multiple instances in the same domain, which may allow attackers to gain administrative privileges.
Key phrases: gain administrative privileges
CVE-2001-1364: Vulnerability in autodns.pl for AutoDNS before 0.0.4 related to domain names that are not fully qualified.
CVE-2001-1365: Vulnerability in IntraGnat before 1.4.
CVE-2001-1366: netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive information.
Key phrases: obtain sensitive information, alter program behavior or obtain sensitive information, dynamic variables
CVE-2001-1367: The checkAccess function in PHPSlice 0.1.4, and all other versions between 0.1.1 and 0.1.6, does not properly verify the administrative access level, which could allow remote attackers to gain privileges.
Key phrases: gain privileges
CVE-2001-1368: Vulnerability in iPlanet Web Server 4 included in Virtualvault Operating System (VVOS) 4.0 running HP-UX 11.04 could allow attackers to corrupt data.
Key phrases: corrupt data
CVE-2001-1369: Leon J Breedt pam-pgsql before 0.5.2 allows remote attackers to execute arbitrary SQL code and bypass authentication or modify user account records by injecting SQL statements into user or password fields.
Key phrases: execute arbitrary SQL code, bypass authentication, execute arbitrary SQL code and bypass authentication or, pam-pgsql
CVE-2001-1370: prepend.php3 in PHPLib before 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server, as seen in Horde 1.2.5 and earlier, IMP before 2.2.6, and other packages that use PHPLib.
Key phrases: execute arbitrary scripts, execute arbitrary scripts via an HTTP request that
CVE-2001-1371: The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.
Key phrases: deploy applications by default via urn:soap
CVE-2001-1372: Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
Key phrases: obtain the physical path of a file under
CVE-2001-1373: MailSafe in Zone Labs ZoneAlarm 2.6 and earlier and ZoneAlarm Pro 2.6 and 2.4 does not block prohibited file types with long file names, which allows remote attackers to send potentially dangerous attachments.
Key phrases: send potentially dangerous attachments
CVE-2001-1374: expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd.
Key phrases: gain root privileges, gain root privileges via a Trojan horse library
CVE-2001-1375: tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local users to execute arbitrary code via a Trojan horse library that is under a user-controlled directory.
Key phrases: execute arbitrary code, execute arbitrary code via a Trojan horse library, user-controlled directory
CVE-2001-1376: Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2001-1377: Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2001-1378: fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files.
Key phrases: overwrite files of other users via a symlink
CVE-2001-1379: The PostgreSQL authentication modules (1) mod_auth_pgsql 0.9.5, and (2) mod_auth_pgsql_sys 0.9.4, allow remote attackers to bypass authentication and execute arbitrary SQL via a SQL injection attack on the user name.
Key phrases: execute arbitrary SQL, bypass authentication, bypass authentication and execute arbitrary SQL via a, arbitrary sql, sql injection
CVE-2001-1380: OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses.
Key phrases: login from unauthorized IP addresses
CVE-2001-1382: The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could allow remote attackers to determine that the countermeasure is being used.
Key phrases: determine that the countermeasure is being used, echo packet
CVE-2001-1383: initscript in setserial 2.17-4 and earlier uses predictable temporary file names, which could allow local users to conduct unauthorized operations on files.
Key phrases: conduct unauthorized operations on files, predictable temporary file names
CVE-2001-1384: ptrace in Linux 2.2.x through 2.2.19, and 2.4.x through 2.4.9, allows local users to gain root privileges by running ptrace on a setuid or setgid program that itself calls an unprivileged program, such as newgrp.
Key phrases: gain root privileges, gain root privileges by running ptrace on a
CVE-2001-1385: The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
CVE-2001-1386: WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a ".lnk." extension, which bypasses WFTPD's check for a ".lnk" extension.
Key phrases: read arbitrary files, read arbitrary files by uploading a (link, arbitrary file upload
CVE-2001-1387: iptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "--reject-with tcp-reset," which causes iptables to generate different responses than specified by the administrator, possibly leading to an information leak.
Key phrases: information leak
CVE-2001-1388: iptables before 1.2.4 does not accurately convert rate limits that are specified on the command line, which could allow attackers or users to generate more or less traffic than intended by the administrator.
Key phrases: generate more or less traffic than intended by
CVE-2001-1389: Multiple vulnerabilities in xinetd 2.3.0 and earlier, and additional variants until 2.3.3, may allow remote attackers to cause a denial of service or execute arbitrary code, primarily via buffer overflows or improper NULL termination.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary, buffer overflows, improper null termination
CVE-2001-1390: Unknown vulnerability in binfmt_misc in the Linux kernel before 2.2.19, related to user pages.
Key phrases: unknown
CVE-2001-1391: Off-by-one vulnerability in CPIA driver of Linux kernel before 2.2.19 allows users to modify kernel memory.
Key phrases: modify kernel memory, off-by-one
CVE-2001-1392: The Linux kernel before 2.2.19 does not have unregister calls for (1) CPUID and (2) MSR drivers, which could cause a DoS (crash) by unloading and reloading the drivers.
Key phrases:  DoS (crash), dos
CVE-2001-1393: Unknown vulnerability in classifier code for Linux kernel before 2.2.19 could result in denial of service (hang).
Key phrases: denial of service (hang), unknown
CVE-2001-1394: Signedness error in (1) getsockopt and (2) setsockopt for Linux kernel before 2.2.19 allows local users to cause a denial of service.
Key phrases: cause a denial of service, signedness error
CVE-2001-1395: Unknown vulnerability in sockfilter for Linux kernel before 2.2.19 related to "boundary cases," with unknown impact.
Key phrases: unknown, unknown impact
CVE-2001-1396: Unknown vulnerabilities in strnlen_user for Linux kernel before 2.2.19, with unknown impact.
Key phrases: unknown, unknown impact
CVE-2001-1397: The System V (SYS5) shared memory implementation for Linux kernel before 2.2.19 could allow attackers to modify recently freed memory.
Key phrases: modify recently freed memory
CVE-2001-1398: Masquerading code for Linux kernel before 2.2.19 does not fully check packet lengths in certain cases, which may lead to a vulnerability.
CVE-2001-1399: Certain operations in Linux kernel before 2.2.19 on the x86 architecture copy the wrong number of bytes, which might allow attackers to modify memory, aka "User access asm bug on x86."
Key phrases: modify memory, user access asm bug
CVE-2001-1400: Unknown vulnerabilities in the UDP port allocation for Linux kernel before 2.2.19 could allow local users to cause a denial of service (deadlock).
Key phrases: denial of service (deadlock), cause a denial of service (deadlock), unknown
CVE-2001-1401: Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1) process_bug.cgi, (2) show_activity.cgi, (3) showvotes.cgi, (4) showdependencytree.cgi, (5) showdependencygraph.cgi, (6) showattachment.cgi, or (7) describecomponents.cgi.
Key phrases: bypass viewing permissions, bypass viewing permissions via modified bug id, modified bug id parameters
CVE-2001-1402: Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi, (2) the voteon, bug_id, and user variables for showvotes.cgi, (3) an invalid email address in createaccount.cgi, (4) an invalid ID in showdependencytree.cgi, (5) invalid usernames and other fields in process_bug.cgi, and (6) error messages in buglist.cgi.
Key phrases: conduct unauthorized activities via cross-site scripting, untrusted parameters, cross-site scripting (css), sql injection
CVE-2001-1403: Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by "shoulder-surfing" and observing the web browser's location bar.
Key phrases: gain privileges, gain privileges by reading the information from the, shoulder-surfing
CVE-2001-1404: Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain privileges.
Key phrases: gain privileges, plaintext
CVE-2001-1405: Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) via a flood of requests to sanitycheck.cgi.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption, flood of requests
CVE-2001-1406: process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
CVE-2001-1407: Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds the user to the CC list of the restricted bug and allows the user to view the bug.
Key phrases: bypass group security checks, bypass group security checks by marking a bug, view the bug
CVE-2001-1408: Directory traversal vulnerability in readmsg.php in WebMail 2.0.1 in Cobalt Qube 3 allows remote attackers to read arbitrary files via a .. (dot dot) in the mailbox parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2001-1409: dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.
Key phrases: replace or create files in the root file, insecure permissions
CVE-2001-1410: Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering.
Key phrases: create chromeless windows using the Javascript window.createPopup method, simulate a victim's display and conduct unauthorized, sensitive data, social engineering
CVE-2001-1411: Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.
Key phrases: gain privileges, gain privileges if gm4 is called by setuid, format string
CVE-2001-1412: nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command line argument.
Key phrases: read the encrypted passwords from the password file
CVE-2001-1413: Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries (such as FTP server), may allow remote attackers to execute arbitrary code via a long filename argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long filename argument, stack-based buffer overflow, stack based buffer overflow
CVE-2001-1414: The Basic Security Module (BSM) for Solaris 2.5.1, 2.6, 7, and 8 does not log anonymous FTP access, which allows remote attackers to hide their activities, possibly when certain BSM audit files are not present under the FTP root.
Key phrases: hide their activities, anonymous ftp access
CVE-2001-1415: vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes.
Key phrases: remove arbitrary zero-byte files such as, device nodes
CVE-2001-1416: Multiple cross-site scripting (XSS) vulnerabilities in the log messages in certain Alpha versions of AOL Instant Messenger (AIM) 4.4 allow remote attackers to execute arbitrary web script or HTML via an image in the (1) DATA, (2) STYLE, or (3) BINARY tags.
Key phrases: execute arbitrary web script or HTML, execute arbitrary web script or HTML via an, cross-site scripting (xss)
CVE-2001-1417: AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application hang or crash) via a buddy icon GIF file whose length and width values are larger than the actual image data.
Key phrases: denial of service (application hang or crash), cause a denial of service (application hang, buddy icon gif file
CVE-2001-1418: AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a malformed WAV file.
Key phrases: denial of service (application crash), cause a denial of service (application crash, malformed wav file
CVE-2001-1419: AOL Instant Messenger (AIM) 4.7.2480 and earlier allows remote attackers to cause a denial of service (application crash) via an instant message that contains a large amount of "<!--" HTML comments.
Key phrases: denial of service (application crash), cause a denial of service (application crash, <!-- html comments
CVE-2001-1420: AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a long filename, possibly caused by a buffer overflow.
Key phrases: denial of service (application crash), cause a denial of service (application crash, buffer overflow
CVE-2001-1421: AOL Instant Messenger (AIM) 4.7 and earlier allows remote attackers to cause a denial of service (application crash) via a large number of different fonts followed by an HTML HR tag.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2001-1422: WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
Key phrases: bypass VNC authentication, bypass VNC authentication by sniffing the challenge and
CVE-2001-1423: Advanced Poll before 1.61, when using a flat file database, allows remote attackers to gain privileges by setting the logged_in parameter.
Key phrases: gain privileges, gain privileges by setting the logged_in parameter
CVE-2001-1424: Alcatel Speed Touch ADSL modem running firmware KHDSAA.108, KHDSAA.132, KHDSBA.133, and KHDSAA.134 has a blank default password, which allows remote attackers to gain unauthorized access.
Key phrases: gain unauthorized access, blank default password
CVE-2001-1425: The challenge-response authentication of the EXPERT user for Alcatel Speed Touch running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 allows remote attackers to gain privileges by directly computing the response based on information that is provided by the device during login.
Key phrases: gain privileges, gain privileges by directly computing the response based
CVE-2001-1426: Alcatel Speed Touch running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 has a TFTP server running without a password, which allows remote attackers to change firmware versions or the device's configurations.
Key phrases: change firmware versions or the device's configurations, tftp server
CVE-2001-1427: Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors.
Key phrases: overwrite templates with zero byte files via unknown, unknown attack vectors
CVE-2001-1428: The (1) FTP and (2) Telnet services in Beck GmbH IPC@Chip are shipped with a default password, which allows remote attackers to gain unauthorized access.
Key phrases: gain unauthorized access, default password
CVE-2001-1429: Buffer overflow in mcedit in Midnight Commander 4.5.1 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted text file.
Key phrases: execute arbitrary code, denial of service (segmentation fault), cause a denial of service (segmentation fault, buffer overflow
CVE-2001-1430: Cayman 3220-H DSL Router 1.0 ship without a password set, which allows remote attackers to gain unauthorized access.
Key phrases: gain unauthorized access, password set
CVE-2001-1431: Nokia Firewall Appliances running IPSO 3.3 and VPN-1/FireWall-1 4.1 Service Pack 3, IPSO 3.4 and VPN-1/FireWall-1 4.1 Service Pack 4, and IPSO 3.4 or IPSO 3.4.1 and VPN-1/FireWall-1 4.1 Service Pack 5, when SYN Defender is configured in Active Gateway mode, does not properly rewrite the third packet of a TCP three-way handshake to use the NAT IP address, which allows remote attackers to gain sensitive information.
Key phrases: gain sensitive information
CVE-2001-1432: Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2001-1433: Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain privileges via other vulnerabilities.
Key phrases: gain privileges, gain privileges via other vulnerabilities, root privileges
CVE-2001-1434: Cisco IOS 12.0(5)XU through 12.1(2) allows remote attackers to read system administration and topology information via an "snmp-server host" command, which creates a readable "community" community string if one has not been previously created.
Key phrases: read system administration and topology information via an
CVE-2001-1435: inetd in Compaq Tru64 UNIX 5.1 allows attackers to cause a denial of service (network connection loss) by causing one of the services handled by inetd to core dump during startup, which causes inetd to stop accepting connections to all of its services.
Key phrases: denial of service (network connection loss), cause a denial of service (network connection, core dump
CVE-2001-1436: Dallas Semiconductor iButton DS1991 returns predictable values when given an incorrect password, which makes it easier for users with physical access to conduct dictionary attacks against the device password.
Key phrases: incorrect password, dictionary
CVE-2001-1437: easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when the script times out.
Key phrases: obtain the full path of the web root, non-integer news message id field
CVE-2001-1438: Handspring Visor 1.0 and 1.0.1 with the VisorPhone Springboard module installed allows remote attackers to cause a denial of service (PalmOS crash and VisorPhone database corruption) by sending a large or crafted SMS image.
Key phrases: denial of service (PalmOS crash and VisorPhone database corruption), cause a denial of service (PalmOS crash, visorphone database corruption
CVE-2001-1439: Buffer overflow in the text editor functionality in HP-UX 10.01 through 11.04 on HP9000 Series 700 and Series 800 allows local users to cause a denial of service ("system availability") via text editors such as (1) e, (2) ex, (3) vi, (4) edit, (5) view, and (6) vedit.
Key phrases: denial of service ("system availability"), cause a denial of service ("system, buffer overflow
CVE-2001-1440: Unknown vulnerability in login for AIX 5.1L, when using loadable authentication modules, allows remote attackers to gain access to the system.
Key phrases: gain access, gain access to the system, unknown
CVE-2001-1441: Cross-site scripting (XSS) vulnerability in VisualAge for Java 3.5 Professional allows remote attackers to execute JavaScript on other clients via the URL, which injects the script in the resulting error message.
Key phrases: execute JavaScript on other clients via the URL, cross-site scripting (xss)
CVE-2001-1442: Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the "news" group to gain privileges via a long -c command line argument.
Key phrases: gain privileges, gain privileges via a long -c command line, buffer overflow
CVE-2001-1443: KTH Kerberos IV and Kerberos V (Heimdal) for Telnet clients do not encrypt connections if the server does not support the requested encryption, which allows remote attackers to read communications via a man-in-the-middle attack.
Key phrases: read communications via a man-in-, man-in-the-middle, man in the middle
CVE-2001-1444: The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption options sent from the server, which allows remote attackers to downgrade authentication and encryption mechanisms via a man-in-the-middle attack.
Key phrases: downgrade authentication and encryption mechanisms via a man, man-in-the-middle, man in the middle
CVE-2001-1445: Unknown vulnerability in the SMTP server in Lotus Domino 5.0 through 5.7 allows remote attackers to bypass mail relaying restrictions via crafted e-mail addresses in "RCPT TO" commands.
Key phrases: bypass mail relaying restrictions, bypass mail relaying restrictions via crafted e-, unknown
CVE-2001-1446: Find-By-Content in Mac OS X 10.0 through 10.0.4 creates world-readable index files named .FBCIndex in every directory, which allows remote attackers to learn the contents of files in web accessible directories.
Key phrases: learn the contents of files in web accessible
CVE-2001-1447: NetInfo Manager for Mac OS X 10.0 through 10.1 allows local users to gain root privileges by opening applications using the (1) "recent items" and (2) "services" menus, which causes the applications to run with root privileges.
Key phrases: gain root privileges, gain root privileges by opening applications using the
CVE-2001-1448: Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on temporary files created by the (1) mkuserproc, (2) mgrnt, and (3) mgdatasrvr.sc scripts.
Key phrases: overwrite arbitrary files, overwrite arbitrary files and possibly execute code via, symlink
CVE-2001-1449: The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
Key phrases: list the directory index of arbitrary web directories
CVE-2001-1450: Microsoft Internet Explorer 5.0 through 6.0 allows attackers to cause a denial of service (browser crash) via a crafted FTP URL such as "/.#./".
Key phrases: denial of service (browser crash), cause a denial of service (browser crash
CVE-2001-1451: Memory leak in the SNMP LAN Manager (LANMAN) MIB extension for Microsoft Windows 2000 before SP3, when the Print Spooler is not running, allows remote attackers to cause a denial of service (memory consumption) via a large number of GET or GETNEXT requests.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2001-1452: By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to poison the DNS cache via spoofed DNS responses.
Key phrases: poison the DNS cache via spoofed DNS responses, non-delegated name servers, spoofing
CVE-2001-1453: Buffer overflow in libmysqlclient.so in MySQL 3.23.33 and earlier allows remote attackers to execute arbitrary code via a long host parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a long host parameter, buffer overflow
CVE-2001-1454: Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary code via a long drop database request.
Key phrases: execute arbitrary code, execute arbitrary code via a long drop database, buffer overflow
CVE-2001-1455: Netegrity SiteMinder 3.6 through 4.5.1 allows remote attackers to bypass filtering via URLs containing Unicode characters.
Key phrases: bypass filtering, bypass filtering via URLs containing Unicode characters, urls containing unicode characters
CVE-2001-1456: Buffer overflow in the (1) smap/smapd and (2) CSMAP daemons for Gauntlet Firewall 5.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted mail message.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted mail message, buffer overflow
CVE-2001-1457: Buffer overflow in CrazyWWWBoard 2000p4 and 2000LEp5 allows remote attackers to execute arbitrary code via a long HTTP_USER_AGENT CGI environment variable.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP_USER_AGENT CGI, buffer overflow
CVE-2001-1458: Directory traversal vulnerability in Novell GroupWise 5.5 and 6.0 allows remote attackers to read arbitrary files via a request for /servlet/webacc?User.html= that contains "../" (dot dot) sequences and a null character.
Key phrases: read arbitrary files, read arbitrary files via a request for /servlet, directory traversal
CVE-2001-1459: OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d.
Key phrases: bypass resource limits (rlimits) set in pam.d
CVE-2001-1460: SQL injection vulnerability in article.php in PostNuke 0.62 through 0.64 allows remote attackers to bypass authentication via the user parameter.
Key phrases: bypass authentication, bypass authentication via the user parameter, sql injection
CVE-2001-1461: Directory traversal vulnerability in WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to access restricted resources via URL-encoded (1) /.. or (2) \\\\.. sequences.
Key phrases: access restricted resources via URL-encoded (, directory traversal
CVE-2001-1462: WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to cause the WebID agent to enter debug mode via a URL containing null characters, which may allow attackers to obtain sensitive information.
Key phrases: obtain sensitive information, cause the WebID agent to enter debug mode, url containing null characters
CVE-2001-1463: The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, which allows remote attackers to sniff passwords.
Key phrases: sniff passwords, plaintext
CVE-2001-1464: Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.
Key phrases: obtain passwords, cleartext
CVE-2001-1465: SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filtering by fragmenting packets so that no packet contains both data elements.
Key phrases: bypass filtering, bypass filtering by fragmenting packets so that no
CVE-2001-1466: Buffer overflow in VanDyke SecureCRT before 3.4.2, when using the SSH-1 protocol, allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
Key phrases: execute arbitrary code, execute arbitrary code via a long (1, buffer overflow
CVE-2001-1467: mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.
Key phrases: brute force password
CVE-2001-1468: PHP remote file inclusion vulnerability in checklogin.php in phpSecurePages 0.24 and earlier allows remote attackers to execute arbitrary PHP code by modifying the cfgProgDir parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the cfgProgDir, php remote file inclusion
CVE-2001-1469: The RC4 stream cipher as used by SSH1 allows remote attackers to modify messages without detection by XORing the original message's cyclic redundancy check (CRC) with the CRC of a mask consisting of all the bits of the original message that were modified.
Key phrases: modify messages without detection by XORing the original
CVE-2001-1470: The IDEA cipher as implemented by SSH1 does not protect the final block of a message against modification, which allows remote attackers to modify the block without detection by changing its cyclic redundancy check (CRC) to match the modifications to the message.
Key phrases: modify the block without detection by changing its, modification
CVE-2001-1471: prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via an invalid language, invalid language value
CVE-2001-1472: SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter.
Key phrases: execute arbitrary SQL commands, gain administrative access, execute arbitrary SQL commands and gain administrative access, sql injection
CVE-2001-1473: The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target.
Key phrases: conduct man-in-the-middle, compute the corresponding private key and use the, compromised key pair, man in the middle
CVE-2001-1474: SSH before 2.0 disables host key checking when connecting to the localhost, which allows remote attackers to silently redirect connections to the localhost by poisoning the client's DNS cache.
Key phrases: silently redirect connections to the localhost by poisoning
CVE-2001-1475: SSH before 2.0, when using RC4 and password authentication, allows remote attackers to replay messages until a new server key (VK) is generated.
Key phrases: replay messages until a new server key (
CVE-2001-1476: SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications, which trigger different messages depending on whether the guess is correct or not.
Key phrases: different messages