3467 matches found
CVE-2001-1286
Ipswitch IMail 7.04 and earlier stores a user’s session ID in a URL, enabling session hijacking if an attacker can obtain the URL (e.g., via an HTML email that causes the Referrer to reveal the URL under the attacker’s control). Affected product: Ipswitch IMail Web Interface. Root cause: session ...
CVE-2001-1242
The CVE-2001-1242 entry concerns a directory traversal in Un-CGI 1.9 and earlier, where an attacker can trigger arbitrary code execution by supplying a .. (dot dot) in an HTML form. The vulnerability arises in the way path components are processed, enabling remote exploitation. Affected software:...
CVE-2001-1278
Zope vulnerable before 2.2.4: partially trusted users could bypass security checks by invoking methods via the fmt attribute of dtml-var tags. The Mandrake MDKSA-2001:080 hotfix addresses this DTML scripting issue, remedying the fmt access problem and preventing unauthorized method calls. The vul...
CVE-2001-1262
CVE-2001-1262 affects Avaya Argent Office 2.1, where a user-provided SNMP community string is compared only up to its length, allowing remote attackers to bypass authentication with a 0-length string. The documents do not provide any remediation or patch details. No exploitation status or in-the-...
CVE-2001-1320
Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via exceptional BER encodings possibly buffer overflows, as demonstrated by the PROTOS LDAPv3 test suite...
CVE-2001-1270
CVE-2001-1270 affects the PKZip console tool (pkzipc) 4.00 and earlier. The vulnerability is a directory traversal during archive extraction when using the -rec option, allowing an attacker to overwrite arbitrary files via a .. path in archived filenames. The available documents confirm the affec...
CVE-2001-1255
CVE-2001-1255 affects WinMySQLadmin 1.1, where the MySQL password is stored in plain text in the my.ini file. This allows local users to obtain unauthorized access to the MySQL database. The available sources describe the root cause as plaintext storage of credentials in a configuration file, ena...
CVE-2001-1258
Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...
CVE-2001-1317
The connected CERT CERT Advisory CA-2001-18 documents multiple vulnerabilities in Teamware Office LDAP server that may allow remote denial-of-service and possibly arbitrary code execution, triggered by malformed/invalid BER-encoded LDAP data (as demonstrated by PROTOS LDAPv3 tests). Affected prod...
CVE-2001-1232
GroupWise WebAccess 5.5 with directory indexing enabled allows a remote attacker to view arbitrary directory contents via an HTTP request with a lowercase "get"...
CVE-2001-1257
Cross-site scripting vulnerability in Horde Internet Messaging Program IMP before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email...
CVE-2001-1337
Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request...
CVE-2001-1253
Alexis 2.0 and 2.1 in COM2001 InternetPBX stores voicemail passwords in plain text in the com2001.ini file, which could allow local users to make long distance calls as other users...
CVE-2001-1340
Beck GmbH IPC@Chip TelnetD service supports only one connection and does not disconnect a user who does not complete the login process, which allows remote attackers to lock out the administrator account by connecting to the service...
CVE-2001-1274
Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service and possibly gain privileges...
CVE-2001-1280
POP3 Server for Ipswitch IMail 7.04 and earlier generates different responses to valid and invalid user names, which allows remote attackers to determine users on the system...
CVE-2001-1308
Format string vulnerabilities in iPlanet Directory Server 4.1.4 and earlier LDAP allow remote attackers to cause a denial of service crash and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite...
CVE-2001-1311
CVE-2001-1311 refers to buffer overflows in Lotus Domino R5 pre-5.0.7a that allow a remote attacker to cause a denial of service and potentially execute arbitrary code, demonstrated by the PROTOS LDAPv3 test suite. The vulnerability affects Domino R5.0.7 and earlier versions, with remediation doc...
CVE-2001-1261
CVE-2001-1261 affects Avaya Argent Office 2.1. The vulnerability allows remote attackers to alter hold music by spoofing a legitimate server’s response to a TFTP broadcast and supplying an alternate HoldMusic file. Root cause is spoofed TFTP responses enabling an attacker to substitute playback m...