CVE-2001-1202

CVE-2001-1202 affects DeleGate versions 7.7.0 and 7.7.1. The root cause is that scripting commands are not quoted in a 403 Forbidden error page, enabling remote attackers to trigger cross‑site scripting by using a URL that generates an error. Consequence is arbitrary Javascript execution on other...

CVE-2001-1194

CVE-2001-1194 affects Zyxel Prestige 681 and 1600 SDSL Routers. Remote attackers can cause a denial of service by sending malformed packets: (1) IP length shorter than the actual packet size, or (2) fragmented packets whose reassembly size exceeds 64 KB. Impact is denial of service/partial availa...

CVE-2001-1188

The CVE-2001-1188 entry concerns mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier. The vulnerability arises because remote attackers can modify hidden form fields (sendto, email, server, subject, resulturl) to cause the program to send SPAM via remote servers. Affected component is the mail...

CVE-2001-1184

CVE-2001-1184 affects Denicomp Winsock RSHD/NT, versions 2.21.00 and earlier. The issue allows remote attackers to cause denial of service (CPU consumption) by connecting to an invalid port number: in 2.20.00 and earlier, a negative/invalid port triggers a connection attempt to that port and all ...

CVE-2001-1138

CVE-2001-1138 affects Randy Parker Power Up HTML 0.8033beta (r.pl/r.cgi). The vulnerability is a directory traversal via the FILE parameter (.. ) that lets remote attackers read arbitrary files and, per some sources, potentially execute code. Connected OpenVAS NASL notes describe the CGI as expos...

CVE-2001-1137

The CVE-2001-1137 entry relates to D-Link DI-704 Internet Gateway firmware versions earlier than V2.56b6. It describes a denial-of-service condition where remote attackers can cause a reboot by sending malformed IP datagram fragments. The impact is a partial availability loss for the device. No r...

CVE-2001-1115

The CVE-2001-1115 issue affects SIX-webboard 2.01 and earlier where generate.cgi does not properly validate the content parameter, allowing a remote attacker to perform directory traversal and read arbitrary files on the server with the web server’s permissions. This is caused by directory traver...

CVE-2001-1112

Summary: CVE-2001-1112 is a buffer overflow in EFTP 2.0.7.337 that can be triggered by uploading a crafted .lnk file. The OpenVAS entries confirm a remote overflow vulnerability in the EFTP server, with the impact described as a crash and potential arbitrary code execution. The exploit vector inv...

CVE-2001-1109

EFTP 2.0.7.337 is affected by a directory traversal vulnerability that allows remote authenticated users to reveal directory contents by injecting dot-dot sequences in LIST, QUOTE SIZE, and QUOTE MDTM commands. Multiple security tools summarize this as an information-disclosure flaw (installation...

CVE-2001-1107

CVE-2001-1107 affects SnapStream PVS 1.2a, where passwords are stored in plaintext in the SSD.ini file. This storage flaw could allow a remote attacker to gain privileges on the affected server. The available documents do not specify a patch or version that fixes the issue, nor provide exploit de...

CVE-2001-1093

CVE-2001-1093 concerns a buffer overflow in the msgchk utility of Digital UNIX 4.0G and earlier. A command-line argument of excessive length can overflow a buffer, enabling a local attacker to execute arbitrary code with the effective user ID of the msgchk process. The vulnerability is described ...

CVE-2001-1092

CVE-2001-1092 concerns msgchk in Digital UNIX 4.0G and earlier that allows a local user to read the first line of arbitrary files by a symlink attack on the user’s .mh_profile. The root cause is msgchk reads the profile to obtain configuration options, and if linked to a target file readable by t...

CVE-2001-1187

This entry describes CVE-2001-1187 affecting csvform.pl 0.1, where remote attackers can execute arbitrary commands through metacharacters in the file parameter. The vulnerability is linked to unsanitized handling of the file parameter, enabling arbitrary command execution over the network. The NV...

CVE-2001-1104

SonicWALL SOHO is affected by CVE-2001-1104 due to predictable TCP Initial Sequence Numbers, enabling remote attackers to spoof/hijack sessions. The vulnerability affects the firewall component handling TCP connections; exploitation could allow session hijacking without user interaction. A remedi...

CVE-2001-1206

CVE-2001-1206 affects Matrix CGI vault Last Lines 2.0. The vulnerability: remote attackers can execute arbitrary commands via shell metacharacters in the $error_log variable, enabling remote code execution over the network. The provided sources do not specify affected versions beyond Last Lines 2...

CVE-2001-1139

Directory traversal vulnerability in ASCII NT WinWrapper Professional allows remote attackers to read arbitrary files via a .. dot dot in the server request...

CVE-2001-1221

The CVE-2001-1221 entry affects D‑Link DWL-1000AP Wireless LAN Access Point with firmware 3.2.28 #483. The issue is use of a default SNMP community string 'public', allowing remote attackers to obtain sensitive information. The provided documents do not specify affected versions beyond the listed...

CVE-2001-1224

The CVE-2001-1224 entry concerns Les VanBrunt AdRotate Pro 2.0. The vulnerability is in get_input within adrotate.pm, allowing remote attackers to modify the database and potentially execute arbitrary commands via a SQL injection attack. This constitutes a client/server impact on data integrity a...

CVE-2001-0723

Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript, aka the "Second Cookie Handling Vulnerability."...

CVE-2001-1017

rmuser utility in FreeBSD 4.2 and 4.3 creates a copy of the master.passwd file with world-readable permissions while updating the original file, which could allow local users to gain privileges by reading the copied file while rmuser is running, obtain the password hashes, and crack the passwords...