CVE-2001-1039

The CVE describes a vulnerability in the JetAdmin web interface for HP JetDirect where the telnet interface password is not set after the admin password is changed. This allows remote attackers to gain access to the printer over the network (attack vector: network, low complexity). The available ...

CVE-2001-1076

CVE-2001-1076 : Buffer overflow in the Solaris SunOS whodo utility (versions 5.5.1–5.8) allows local users to execute arbitrary code via overly long environment variables (SOR or CFIME). The connected documents confirm the affected platform and vulnerable component, and that exploitation is local...

CVE-2001-1007

CVE-2001-1007 affects Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA. The vulnerability arises from a small keyspace for device keys and the absence of a delay on incorrect keys, enabling faster brute-force guessing of the key. The NVD entry lists a MEDIUM base score (5.0/10) with net...

CVE-2001-0996

POP3Lite before 0.2.4 is vulnerable due to improper quoting of a dot in an email message, allowing a remote attacker to append arbitrary text to the end of an email. This text could be interpreted by mail clients as valid POP server responses or other input, potentially causing clients to crash o...

CVE-2001-0950

CVE-2001-0950 concerns the ValiCert Enterprise Validation Authority (EVA) Administration Server, version 3.3–4.2.1. The root cause is the use of insufficiently random data: session tokens for HSMs are generated with the C rand() function, and certificate/key generation may rely on /dev/urandom in...

CVE-2001-0985

shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter...

CVE-2001-0949

CVE-2001-0949 affects ValiCert Enterprise Validation Authority (EVA) Administration Server, versions 3.3–4.2.1. The vulnerability is a buffer overflow in the forms.exe CGI program that enables remote attackers to execute arbitrary code by supplying long arguments to a set of parameters (Mode, Cer...

CVE-2001-0897

The CVE-2001-0897 issue affects Infopop Ultimate Bulletin Board (UBB) versions prior to 5.47e. A cross-site scripting flaw allows remote attackers to steal user cookies by exploiting an [IMG] tag that references an about: URL with an onerror field. The vulnerability is tied to the HTML/img handli...

CVE-2001-1057

CVE-2001-1057 concerns the License Manager (mathlm) for Mathematica 4.0 and 4.1. The issue allows remote attackers to cause a denial of service (resource exhaustion) by connecting to port 16286 and not disconnecting, which prevents legitimate license requests. The available documents do not speci...

CVE-2001-1026

The CVE-2001-1026 entry concerns Trend Micro InterScan AppletTrap 2.0. The vulnerability arises because URL filtering fails when URLs are modified in specific ways: using a double slash //, URL-encoded characters, requesting the IP address instead of the domain, or a leading 0 in an IP octet. The...

CVE-2001-0911

CVE-2001-0911 affects PHP-Nuke 5.1, where user and administrator passwords are stored in a base-64 encoded cookie. This could allow remote attackers to gain privileges by stealing/sniffing the cookie and decoding it. The connected sources corroborate the cookie-based credential exposure, but no p...

CVE-2001-0985

Affected product: Hassan Consulting Shopping Cart 1.23. Vulnerability: arbitrary command execution via shell metacharacters in the URL parameter “page” leading to remote code execution. Root cause is unsafely handling the page parameter in shop.pl, allowing user-supplied input to be interpreted b...

CVE-2001-1003

Affected software : Respondus 1.1.2 for WebCT. Vulnerability : weak encryption used to remember usernames and passwords stored in WEBCT.SVR. Impact : local users who can read WEBCT.SVR can decrypt passwords and gain additional privileges. Remediation : not specified in the provided documents.

CVE-2001-0949

Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority EVA Administration Server 3.3 through 4.2.1 allows remote attackers to execute arbitrary code via long arguments to the parameters 1 Mode, 2 CertificateFile, 3 useExpiredCRLs, 4 listenLength, 5 maxThread, 6...

CVE-2001-0947

Forms.exe CGI program in ValiCert Enterprise Validation Authority EVA 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path...

CVE-2001-0999

Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary to the expected behavior that text/plain messages will not run script...

CVE-2001-1007

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered, which allows attackers to more quickly guess the key via a brute force attack...

CVE-2001-1000

rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to read arbitrary files via a symlink attack on the rlmadmin.help file...

CVE-2001-1012

Vulnerability in screen before 3.9.10, related to a multi-attach error, allows local users to gain root privileges when there is a subdirectory under /tmp/screens/...

CVE-2001-0922

The vulnerability CVE-2001-0922 affects Netdynamics ndcgi.exe (Netdynamics 4.x through 5.x, possibly earlier). The issue allows remote attackers to hijack user sessions by reading SPIDERSESSION and uniqueValue variables from the login field and then reusing them after the next user logs in, enabl...