CVE-2001-0328

CVE-2001-0328 describes a vulnerability in TCP initial sequence number (ISN) generation where random increments can enable remote attackers to hijack sessions or disrupt traffic by sending a flood of packets with varying ISNs. Connected documents show this is discussed across multiple UNIX system...

CVE-2001-0332

Internet Explorer 5.5 and earlier are vulnerable to a Frame Domain Verification flaw where an attacker can read local files by abusing frame domain checks via MSScriptControl.ScriptControl and GetObject. Affected product: IE up to version 5.5 and earlier. Root cause: improper domain verification ...

CVE-2001-0417

The CVE-2001-0417 entry concerns Kerberos 4 (krb4) where local users can overwrite arbitrary files via a symlink attack on new ticket files. The connected records corroborate a local-privilege impact vector with a partial integrity impact, and a low overall CVSS score (2.1/10, AV:L/AC:L/Au:N/I:P/...

CVE-2001-0437

CVE-2001-0437 affects DCForum 2000 1.0: the upload_file.pl handler allows remote attackers to upload arbitrary files without authentication by setting the az parameter to upload_file. This enables potential unauthorized file upload and abuse on affected installations. Public references corroborat...

CVE-2001-0367

The vulnerability CVE-2001-0367 affects Mirabilis ICQ WebFront Plug-in for ICQ2000b (Build 3278). A remote attacker can cause a denial of service by sending HTTP URL requests containing a large number of percent characters. The issue impacts availability (PARTIAL) with a CVSS v2 base score of 5.0...

CVE-2001-0415

The CVE-2001-0415 entry concerns the REDIPlus program (REDI.exe), which logs passwords and user names in cleartext to StartLog.txt. Root cause is cleartext credential logging, enabling local users to access other accounts. Reported impact affects confidentiality, integrity, and availability parti...

CVE-2001-0464

CVE-2001-0464 describes a buffer overflow in the Cyberscheduler component websync.exe . The overflow is triggered by a long tzs (timezone) parameter, allowing a remote attacker to execute arbitrary commands. The vulnerability is rated with a HIGH base score and network attack Vector with no authe...

CVE-2001-0400

CVE-2001-0400 affects the script nph-maillist.pl , where remote attackers can execute arbitrary commands by injecting shell metacharacters ("`") into the email address. Public records in the connected OpenVAS entries refer to nph-publish.cgi with a known flaw that allows command execution with th...

CVE-2001-0406

CVE-2001-0406 affects Samba before 2.2.0, allowing local attackers to overwrite arbitrary files via a symlink attack triggered by (1) a printer queue query, (2) the smbclient 'more' command, or (3) the smbclient 'mput' command. The vulnerability arises from insecure temporary file handling; attac...

CVE-2001-0426

CVE-2001-0426 describes a buffer overflow in the dtsession component affecting Solaris (and possibly other OSes) that lets local users gain privileges when a long LANG environment variable is processed. The vulnerability is triggered by excessively long LANG values, leading to privilege escalatio...

CVE-2001-0477

CVE-2001-0477 affects WebCalendar 0.9.26 and enables remote command execution due to improper input validation in the WebCalendar Web application (PHP). The CERT entry states that arbitrary commands can be executed by a malicious WebCalendar user, with the potential bypass in single-user mode whe...

CVE-2001-0492

Netcruiser Web server (versions

CVE-2001-0451

The CVE-2001-0451 entry concerns INDEXU 2.0 beta and earlier. Affected component: authentication/session handling via the cookie_admin_authenticated cookie. Root cause: setting the cookie value to 1 allows remote attackers to bypass authentication and gain privileges. Documented impact: privilege...

CVE-2001-0451

INDEXU 2.0 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the cookieadminauthenticated cookie value to 1...

CVE-2001-0358

CVE-2001-0358 affects Sierra Half-Life builds 1573 and earlier. It is a buffer overflow vulnerability that lets remote attackers execute arbitrary code by sending overly long map commands, long exec commands, or excessive input in a configuration file. The NVD entry lists a network attack vector,...

CVE-2001-0420

CVE-2001-0420 is a directory traversal vulnerability in the talkback.cgi program that allows remote attackers to read arbitrary files by sending a dot-dot sequence (.. ) in the article parameter. The vulnerability stems from insufficient input validation in talkback.cgi and enables access to file...

CVE-2001-0484

CVE-2001-0484 : Tektronix PhaserLink 850 allows remote attackers to access configuration pages (_ncl_subjects.shtml, _ncl_items.shtml) without authentication, enabling modification of configuration information and causing a Denial of Service by accessing those pages. Affected software: PhaserLink...

CVE-2001-0360

The CVE-2001-0360 entry describes a directory traversal flaw in Ikonboard 2.1.7b and earlier, where help.cgi process accepts a malformed helpon parameter containing .. to read arbitrary files. The affected software is Ikonboard; the vulnerable component is help.cgi; root cause is improper validat...

CVE-2001-0369

The CVE-2001-0369 entry describes a buffer overflow in the DGUX lpsched service on versions R4.20MU06 and MU02. The vulnerability allows a local attacker to gain root privileges by supplying a long command line argument (an non-existent printer name). The available documents confirm the affected ...

CVE-2001-0393

CVE-2001-0393 affects Navision Financials Server 2.0. The issue allows remote attackers to cause a denial of service by establishing a series of connections to the server without providing a username/password, consuming license limits. The available references (NVD/NVD entry) describe the impact ...