CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2001

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
951 CVE-2001-0821 2001-12-06 2017-12-19
5.0
 None Remote Low Not required Partial None None
The default configuration of DCShop 1.002 beta places sensitive files in the cgi-bin directory, which could allow remote attackers to read sensitive data via an HTTP GET request for (1) orders.txt or (2) auth_user_file.txt.
952 CVE-2001-0822 DoS 2001-12-06 2017-10-10
5.0
 None Remote Low Not required None None Partial
FPF kernel module 1.0 allows a remote attacker to cause a denial of service via fragmented packets.
953 CVE-2001-0823 +Priv 2001-12-06 2017-10-10
7.2
 None Local Low Not required Complete Complete Complete
The pmpost program in Performance Co-Pilot (PCP) before 2.2.1-3 allows a local user to gain privileges via a symlink attack on the NOTICES file in the PCP log directory (PCP_LOG_DIR).
954 CVE-2001-0824 XSS 2001-12-06 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in IBM WebSphere 3.02 and 3.5 FP2 allows remote attackers to execute Javascript by inserting the Javascript into (1) a request for a .JSP file, or (2) a request to the webapp/examples/ directory, which inserts the Javascript into an error page.
955 CVE-2001-0825 Exec Code Overflow 2001-12-06 2018-05-03
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in internal string handling routines of xinetd before 2.1.8.8 allows remote attackers to execute arbitrary commands via a length argument of zero or less, which disables the length check.
956 CVE-2001-0826 Exec Code Overflow 2001-12-06 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflows in CesarFTPD 0.98b allows remote attackers to execute arbitrary commands via long arguments to (1) HELP, (2) USER, (3) PASS, (4) PORT, (5) DELE, (6) REST, (7) RMD, or (8) MKD.
957 CVE-2001-0827 DoS 2001-12-06 2008-09-10
5.0
 None Remote Low Not required None None Partial
Cerberus FTP server 1.0 - 1.5 allows remote attackers to cause a denial of service (crash) via a large number of "PASV" requests.
958 CVE-2001-0828 XSS 2001-12-06 2017-10-10
5.1
 None Remote High Not required Partial Partial Partial
A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript.
959 CVE-2001-0829 XSS 2001-12-06 2008-09-10
5.1
 None Remote High Not required Partial Partial Partial
A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
960 CVE-2001-0830 DoS 2001-12-06 2017-10-10
5.0
 None Remote Low Not required None None Partial
6tunnel 0.08 and earlier does not properly close sockets that were initiated by a client, which allows remote attackers to cause a denial of service (resource exhaustion) by repeatedly connecting to and disconnecting from the server.
961 CVE-2001-0831 2001-12-06 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Unknown vulnerability in Oracle Label Security in Oracle 8.1.7 and 9.0.1, when audit functionality, SET_LABEL, or SQL*Predicate is being used, allows local users to gain additional access.
962 CVE-2001-0832 2001-12-06 2016-10-18
2.1
 None Local Low Not required None Partial None
Vulnerability in Oracle 8.0.x through 9.0.1 on Unix allows local users to overwrite arbitrary files, possibly via a symlink attack or incorrect file permissions in (1) the ORACLE_HOME/rdbms/log directory or (2) an alternate directory as specified in the ORACLE_HOME environmental variable, aka the "Oracle File Overwrite Security Vulnerability."
963 CVE-2001-0833 Exec Code Overflow 2001-12-06 2018-05-03
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in otrcrep in Oracle 8.0.x through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable, aka the "Oracle Trace Collection Security Vulnerability."
964 CVE-2001-0834 DoS 2001-12-06 2017-10-10
6.4
 None Remote Low Not required Partial None Partial
htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to (1) cause a denial of service (CPU consumption) by specifying a large file such as /dev/zero, or (2) read arbitrary files by uploading an alternate configuration file that specifies the target file.
965 CVE-2001-0835 XSS 2001-12-06 2017-12-19
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in (1) search keywords embedded in HTTP referrer information, or (2) host names that are retrieved via a reverse DNS lookup.
966 CVE-2001-0836 Exec Code Overflow 2001-12-06 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Oracle9iAS Web Cache 2.0.0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request.
967 CVE-2001-0837 2001-12-06 2017-10-10
2.1
 None Local Low Not required Partial None None
DeltaThree Pc-To-Phone 3.0.3 places sensitive data in world-readable locations in the installation directory, which allows local users to read the information in (1) temp.html, (2) the log folder, and (3) the PhoneBook folder.
968 CVE-2001-0838 Exec Code 2001-12-06 2017-07-12
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in Network Solutions Rwhoisd 1.5.x allows remote attackers to execute arbitrary code via format string specifiers in the -soa command.
969 CVE-2001-0839 2001-12-06 2017-12-19
7.5
 None Remote Low Not required Partial Partial Partial
ibillpm.pl in iBill password management system generates weak passwords based on a client's MASTER_ACCOUNT, which allows remote attackers to modify account information in the .htpasswd file via brute force password guessing.
970 CVE-2001-0840 Exec Code Overflow 2001-12-06 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in Compaq Insight Manager XE 2.1b and earlier allows remote attackers to execute arbitrary code via (1) SNMP and (2) DMI.
971 CVE-2001-0841 +Priv Dir. Trav. 2001-12-06 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Search.cgi in Ikonboard ib219 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie.
972 CVE-2001-0842 +Priv Dir. Trav. 2001-12-06 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Search.cgi in Leoboard LB5000 LB5000II 1029 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie.
973 CVE-2001-0843 DoS 2001-12-06 2017-10-10
5.0
 None Remote Low Not required None None Partial
Squid proxy server 2.4 and earlier allows remote attackers to cause a denial of service (crash) via a mkdir-only FTP PUT request.
974 CVE-2001-0844 Exec Code 2001-12-06 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Vulnerability in (1) Book of guests and (2) Post it! allows remote attackers to execute arbitrary code via shell metacharacters in the email parameter.
975 CVE-2001-0845 2001-12-06 2017-12-19
4.6
 None Local Low Not required Partial Partial Partial
Vulnerability in DECwindows Motif Server on OpenVMS VAX or Alpha 6.2 through 7.3, and SEVMS VAX or Alpha 6.2, allows local users to gain access to unauthorized resources.
976 CVE-2001-0846 Exec Code 2001-12-06 2017-10-10
10.0
 None Remote Low Not required Complete Complete Complete
Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by requesting the ReplicaID of the Web Administrator template file (webadmin.ntf).
977 CVE-2001-0847 2001-12-06 2017-12-19
7.5
 None Remote Low Not required Partial Partial Partial
Lotus Domino Web Server 5.x allows remote attackers to gain sensitive information by accessing the default navigator $defaultNav via (1) URL encoding the request, or (2) directly requesting the ReplicaID.
978 CVE-2001-0848 Exec Code 2001-12-06 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
join.cfm in e-Zone Media Fuse Talk allows a local user to execute arbitrary SQL code via a semi-colon (;) in a form variable.
979 CVE-2001-0849 Exec Code 2001-12-06 2017-12-19
7.5
 None Remote Low Not required Partial Partial Partial
viralator CGI script in Viralator 0.9pre1 and earlier allows remote attackers to execute arbitrary code via a URL for a file being downloaded, which is insecurely passed to a call to wget.
980 CVE-2001-0850 Overflow 2001-12-06 2017-10-10
10.0
 None Remote Low Not required Complete Complete Complete
A configuration error in the libdb1 package in OpenLinux 3.1 uses insecure versions of the snprintf and vsnprintf functions, which could allow local or remote users to exploit those functions with a buffer overflow.
981 CVE-2001-0851 Bypass 2001-12-06 2017-10-10
5.0
 None Remote Low Not required Partial None None
Linux kernel 2.0, 2.2 and 2.4 with syncookies enabled allows remote attackers to bypass firewall rules by brute force guessing the cookie.
982 CVE-2001-0852 DoS 2001-12-06 2018-05-03
5.0
 None Remote Low Not required None None Partial
TUX HTTP server 2.1.0-2 in Red Hat Linux allows remote attackers to cause a denial of service via a long Host: header.
983 CVE-2001-0853 Dir. Trav. 2001-12-06 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Entrust GetAccess allows remote attackers to read arbitrary files via a .. (dot dot) in the locale parameter to (1) helpwin.gas.bat or (2) AboutBox.gas.bat.
984 CVE-2001-0854 2001-12-06 2016-10-18
5.0
 None Remote Low Not required None Partial None
PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHP_SELF variable and makes it appear that case.filemanager.php is being called by admin.php instead of the user.
985 CVE-2001-0855 Overflow +Priv 2001-12-06 2016-10-18
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in db_loader in ClearCase 4.2 and earlier allows local users to gain root privileges via a long TERM environment variable.
986 CVE-2001-0856 2001-12-06 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Common Cryptographic Architecture (CCA) in IBM 4758 allows an attacker with physical access to the system and Combine_Key_Parts permissions, to steal DES and 3DES keys by using a brute force attack to create a 3DES exporter key.
987 CVE-2001-0857 XSS 2001-12-06 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers to gain access to the e-mail of other users by hijacking session cookies via the message parameter.
988 CVE-2001-0858 Overflow +Priv 2001-12-06 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in pppattach and other linked PPP utilities in Caldera Open Unix 8.0 and UnixWare 7.1.0 and 7.1.1 allows local users to gain privileges.
989 CVE-2001-0859 2001-12-06 2017-10-10
5.0
 None Remote Low Not required None Partial None
2.4.3-12 kernel in Red Hat Linux 7.1 Korean installation program sets the setting default umask for init to 000, which installs files with world-writeable permissions.
990 CVE-2001-0860 2001-12-06 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Terminal Services Manager MMC in Windows 2000 and XP trusts the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through a Network Address Translation (NAT).
991 CVE-2001-0861 DoS 2001-12-06 2017-10-10
5.0
 None Remote Low Not required None None Partial
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 and earlier allows remote attackers to cause a denial of service (CPU consumption) by flooding the router with traffic that generates a large number of ICMP Unreachable replies.
992 CVE-2001-0862 Bypass 2001-12-06 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not block non-initial packet fragments, which allows remote attackers to bypass the ACL.
993 CVE-2001-0863 DoS 2001-12-06 2017-10-10
5.0
 None Remote Low Not required None None Partial
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not handle the "fragment" keyword in a compiled ACL (Turbo ACL) for packets that are sent to the router, which allows remote attackers to cause a denial of service via a flood of fragments.
994 CVE-2001-0864 Bypass 2001-12-06 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly handle the implicit "deny ip any any" rule in an outgoing ACL when the ACL contains exactly 448 entries, which can allow some outgoing packets to bypass access restrictions.
995 CVE-2001-0865 2001-12-06 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the "fragment" keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access.
996 CVE-2001-0866 Bypass 2001-12-06 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Cisco 12000 with IOS 12.0 and lines card based on Engine 2 does not properly handle an outbound ACL when an input ACL is not configured on all the interfaces of a multi port line card, which could allow remote attackers to bypass the intended access controls.
997 CVE-2001-0867 Bypass 2001-12-06 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls.
998 CVE-2001-0868 2001-11-28 2017-12-19
5.0
 None Remote Low Not required Partial None None
Red Hat Stronghold 2.3 to 3.0 allows remote attackers to retrieve system information via an HTTP GET request to (1) stronghold-info or (2) stronghold-status.
999 CVE-2001-0869 Exec Code 2001-12-21 2018-05-03
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in the default logging callback function _sasl_syslog in common.c in Cyrus SASL library (cyrus-sasl) may allow remote attackers to execute arbitrary commands.
1000 CVE-2001-0870 +Info 2001-12-21 2017-12-19
5.0
 None Remote Low Not required Partial None None
HTTP server in Alchemy Eye and Alchemy Network Monitor 1.9x through 2.6.18 is enabled without authentication by default, which allows remote attackers to obtain network monitoring logs with potentially sensitive information by directly requesting the eye.ini file.
Total number of vulnerabilities : 1677   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 (This Page)21 22 23 24 25 26 27 28 29 30 31 32 33 34
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.