CVE-2001-0972

Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculating the value of the admin cookie UserID 1, i.e. "0888888."...

CVE-2001-0964

The CVE-2001-0964 entry concerns the Half-Life client (versions 1.1.0.8 and earlier). The vulnerability is a buffer overflow in the client triggered by a long console command, allowing a malicious remote server to execute arbitrary code on the affected system. The impact is remote code execution ...

CVE-2001-1033

The CVE-2001-1033 entry describes a vulnerability in Compaq TruCluster 1.5 where remote attackers can trigger a denial of service by performing a port scan from a system lacking a DNS PTR record, causing the cluster to enter a split-brain state.

CVE-2001-1023

CVE-2001-1023 affects Xcache 2.1. Remote attackers can disclose the server’s absolute paths by requesting a URL that Xcache has not cached; the product returns the full pathname in the Content-PageName header. The vulnerability is an information disclosure: partial confidentiality impact. Affecte...

CVE-2001-0930

Technical details about CVE-2001-0930 are not publicly provided in the connected documents. Monitor for updates to confirm affected products, impact and remediation when additional details become available.

CVE-2001-1073

CVE-2001-1073 affects Webridge PX Application Suite and enables information disclosure: a malformed request triggers a server error that reveals internal path/IP data in variables APPL_PHYSICAL_PATH, PATH_TRANSLATED, and LOCAL_ADDR. The description does not provide exploit specifics, affected ver...

CVE-2001-0968

Knox Arkeia server 4.2 (and possibly other versions) installs its root user with a null password by default, enabling privilege escalation for local and remote users. The available documents describe the vulnerable condition but do not specify patches or fixes. No explicit exploit details or reme...

CVE-2001-0919

Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when a cookie is set using Javascript...

CVE-2001-1078

CVE-2001-1078 affects eXtremail 1.1.9 and earlier. The vulnerability is a format-string issue in the flog function that can be exploited remotely to gain root privileges by supplying format specifiers through SMTP commands (HELO, EHLO, MAIL FROM, RCPT TO) and via POP3 commands after authenticatio...

CVE-2001-1009

CVE-2001-1009 affects fetchmail (fetchmail-ssl) prior to 5.8.17. Multiple OpenVAS/DSA/Nessus entries describe a memory corruption in the IMAP and POP3 code where unverified input and missing bounds checking can allow a remote attacker—by controlling the server the client connects to—to cause writ...

CVE-2001-0989

CVE-2001-0989 maps to a local privilege escalation in Pileup before version 1.2. The vulnerability arises from buffer overflows that permit a local user to gain root privileges via excessively long command line arguments or an overly long callsign. The NVD entry lists a base score of 7.2 (HIGH) w...

CVE-2001-0956

CVE-2001-0956 affects speechd 0.54 and earlier when used with the Festival or rsynth speech synthesis packages. The root issue is that shell metacharacters can be exploited to execute arbitrary commands, leading to full compromise of the affected system. The vulnerability is local-privilege relat...

CVE-2001-0924

CVE-2001-0924 describes a directory traversal vulnerability in the Informix SQL Web DataBlade CGI (LO parameter) that allows remote attackers to read arbitrary files on the affected system. The issue arises from improper handling of the .. (dot dot) path traversal in the LO parameter of the ifx C...

CVE-2001-0970

The CVE-2001-0970 vulnerability affects TDForum 1.2 (tdforum12.cgi) where input is not properly filtered, enabling cross-site scripting by malicious forum posts. CERT/CC notes TDForum 1.2 and earlier do not properly filter HTML/script tags, with no practical vendor patch available (as of the sour...

CVE-2001-1024

CVE-2001-1024 : Entrust getAccess CGI scripts (e.g., login.gas.bat) are vulnerable to remote command execution via an alternate -classpath argument, allowing an attacker to run Java programs. The CVSS data indicates a Network-exposed, low complexity, no-auth exploit with Partial impact on confide...

CVE-2001-0958

CVE-2001-0958 affects Trend Micro InterScan eManager for NT Ver.3.51 (English) and NT Ver.3.51J. The vulnerability is a remotely exploitable buffer overflow in the eManager CGI interface, caused by long arguments to multiple DLLs (register.dll, ContentFilter.dll, SFNofitication.dll, TOP10.dll, Sp...

CVE-2001-1005

CVE-2001-1005 affects Starfish Truesync Desktop 2.0b used on the REX 5000 PDA. The underlying issue is weak encryption used to store the user password in a registry key, enabling an attacker with registry access to decrypt the password and gain privileges. NVD lists CVSSv2 base score 7.5 (HIGH) w...

CVE-2001-0990

Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, stores authentication data in cleartext inside the libvpopmail.a library. This enables local users to recover MySQL credentials by inspecting vpopmail programs linked against the library. Affected component: vpopmail (MySQL module)...

CVE-2001-0898

Opera 6.0 and earlier are affected by a remote information disclosure vulnerability where JavaScript using setTimeout can access data across domains (1) after opening a new window to a different domain, and (2) via about:cache, exposing cookies and cross-domain links. Root cause: cross-origin dat...

CVE-2001-0933

Cooolsoft PowerFTP Server 2.03 allows remote attackers to list the contents of arbitrary drives via a ls LIST command that includes the drive letter as an argument, e.g. "ls C:"...