Netwin Surge FTP Server does not adequately validate user input thereby allowing directory traversal

Overview Surge FTP Server 2.0a contains a directory traversal vulnerability. Description Surge FTP Server 2.0a allows remote users to list files outside the FTP root directory. --- Impact Attackers may list files from directories to which access was not granted. --- Solution Upgrade to version...

CVE-2001-1222

Plesk Server Administrator PSA 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid account name for the domain...

CVE-2001-1125

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site...

CVE-2001-1087

The CVE-2001-1087 entry applies to NetCache devices where the default config.http.tunnel.allow_ports is +all, enabling remote attackers to connect to arbitrary ports on remote systems behind the device. This could impact confidentiality, integrity, and availability as per NVD metrics. The connect...

CVE-2001-1090

CVE-2001-1090 affects nss_postgresql 0.6.1 and earlier. The vulnerability allows a remote attacker to execute arbitrary SQL by inserting SQL code into an HTTP request. The provided documents do not specify affected versions beyond 0.6.1, nor patch/remediation details. Exploitation status is not p...

CVE-2001-1094

CVE-2001-1094 affects NetOp School 1.5. Local users can bypass access restrictions on the administration version by first logging into the student version, closing it, and then starting the administration version. The provided sources describe the bypass but do not include exploit code, affected ...

CVE-2001-1105

The CVE-2001-1105 entry affects RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1 as used in Cisco iCND 2.0. The vulnerability is that the product caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and access sensitive data after an initial fail...

CVE-2001-1114

CVE-2001-1114 affects NetCode NC Book 0.2b, where the CGI script book.cgi vulnerable to remote command execution via shell metacharacters in the parameter. The underlying issue is that user-controlled input can be executed by the shell, enabling an attacker to run arbitrary commands on the serve...

CVE-2001-1120

CVE-2001-1120 affects Allaire/Macromedia ColdFusion Server (versions 2.0–4.5.1 SP2). The issue allows remote attackers to read or delete arbitrary files or overwrite ColdFusion server templates via network access. The vulnerability is documented across multiple sources (NVD, CVE list, CERT/CC) wi...

CVE-2001-1123

The CVE-2001-1123 vulnerability affects HP OpenView Network Node Manager (NNM) versions 6.2 and earlier. It allows a local attacker to potentially execute arbitrary code due to a suspected buffer overflow when processing a long hostname or object ID, enabling local privilege impact on the host ru...

CVE-2001-1127

CVE-2001-1127 describes a buffer overflow in Progress Database 8.3D and 9.1C that could let a local user execute arbitrary code via the eight entry points: _proapsv, _mprosrv, _mprshut, orarx, sqlcpp, _probrkr, _sqlschema, and _sqldump. The NVD entry assigns a base score 7.2 (HIGH) with LOCAL att...

CVE-2001-1129

The CVE-2001-1129 entry covers multiple components of Progress database 9.1C (probuild, dbutil, mprosrv, mprshut, proapsv, progres, proutil, rfutil, and prolib). The vulnerability is a local format-string flaw in the PROMSGS environment file that allows a local user to execute arbitrary code. The...

CVE-2001-1139

The CVE-2001-1139 entry concerns a Directory traversal vulnerability in ASCII NT WinWrapper Professional. The underlying issue allows an attacker to read arbitrary files by injecting a .. in the server request, indicating a path traversal flaw in the software’s handling of input paths. Public det...

CVE-2001-1142

The CVE-2001-1142 entry concerns ArGoSoft FTP Server 1.2.2.2, which uses weak password encryption. The underlying issue, as described in the connected sources, is that passwords stored in the password file are protected by weak encryption, enabling an attacker with access to that file to gain pri...

CVE-2001-1143

CVE-2001-1143 affects IBM DB2 7.0. A remote attacker can cause a denial-of-service (crash) by sending a single byte to (1) db2ccs.exe on port 6790 or (2) db2jds.exe on port 6789. This vulnerability is documented across multiple feeds (NVD, CVE List, Nessus/DOS plugin) with CVSSv2 vector AV:N/AC:L...

CVE-2001-1150

CVE-2001-1150 corresponds to a vulnerability in Trend Micro OfficeScan Corporate Edition (Virus Buster) 3.5.2–3.5.4 where the CGI binary cgiWebupdate.exe exposes an information-disclosure/privilege-escalation flaw. The available connected sources describe an information disclosure vulnerability t...

CVE-2001-1151

Affected product : Trend Micro OfficeScan Corporate Edition (Virus Buster Corporate Edition). Vulnerability : Remote disclosure of sensitive configuration data via unauthenticated access to /officescan/hotdownload, specifically reading the configuration file ofcscan.ini which contains a weakly en...

CVE-2001-1157

Baltimore Technologies WEBsweeper 4.0 and 4.02 are described as failing to properly filter Javascript from HTML pages, enabling remote bypass of the filter via (1) an extra leading

CVE-2001-1165

The CVE-2001-1165 entry concerns Intego FileGuard 4.0, which stores user information and passwords with weak encryption. This weak crypto enables local users to escalate privileges by decrypting stored data, for example using the Disengage tool. The vulnerability is localized (local access requir...

CVE-2001-1167

CVE-2001-1167 is a duplicate of CVE-2001-0976. The connected CVE-2001-0976 describes a vulnerability in HP Process Resource Manager (PRM) C.01.08.2 and earlier, used by HP-UX Workload Manager (WLM), that allows local users to gain root privileges via modified libraries or environment variables. T...