CVE-2001-0317

The CVE covers a race condition in Linux kernel ptrace handling that lets an unprivileged local user attach to and modify a running setuid process to gain root. Affected: Linux kernel 2.2.x and 2.4.x (ptrace/procfs/execve paths cited). Root cause: race in ptrace usage during privileged operations...

CVE-2001-0267

CVE-2001-0267 concerns a vulnerability in HP MPE/iX’s NM Debug facility. The HP NM Debug mechanism fails to handle breakpoints correctly on MPE/iX versions 5.5 through 6.5, allowing local users to gain unauthorized privileges (potentially root). CERT notes the issue enables local privilege escala...

CVE-2001-0128

Zope before 2.2.4 contains a bug in how local roles are computed, enabling bypass of access restrictions and privilege escalation. The issue is documented across multiple sources (NVD/CVE entry and Mandrake MDKSA-2000:086) and affects Zope 2.2.4 and earlier. Remediation is to apply the update to ...

CVE-2001-0234

NewsDaemon is affected prior to version 0.21b, where a malformed user_username parameter allows remote attackers to execute arbitrary SQL queries and gain administrative privileges on the web site. The issue enables remote access to administer NewsDaemon through the web interface. Remediation: up...

CVE-2001-0154

CVE-2001-0154 affects Microsoft Internet Explorer 5.5 and earlier when rendering HTML and processing MIME parts. The vulnerability arises from a MIME handling table that can cause the browser to execute an embedded attachment if a malicious MIME type is set, without user confirmation. This can al...

CVE-2001-0041

Cisco Catalyst Telnetd memory leak (CVE-2001-0041) affects Cat 4000/5000/6000 series switches. A series of failed Telnet authentication attempts can trigger a memory leak in the Telnet daemon, causing the device to fail to pass traffic or accept management connections until reboot or power cycle....

CVE-2001-0197

CVE-2001-0197 affects the Icecast server: vulnerable in the print_client function for Icecast versions 1.3.8beta2 and earlier. The issue is a format-string vulnerability that allows remote attackers to execute arbitrary commands. The Debian advisory notes fixes in Icecast 1.3.10-1, indicating a p...

CVE-2001-0009

Directory traversal vulnerability in Lotus Domino 5.0.5 web server allows remote attackers to read arbitrary files via a .. attack...

CVE-2001-0006

The Winsock2ProtocolCatalogMutex mutex in Windows NT 4.0 has inappropriate Everyone/Full Control permissions, which allows local users to modify the permissions to "No Access" and disable Winsock network connectivity to cause a denial of service, aka the "Winsock Mutex" vulnerability...

CVE-2001-0219

Vulnerability in Support Tools Manager xstm,cstm,stm in HP-UX 11.11 and earlier allows local users to cause a denial of service...

CVE-2001-0072

CVE-2001-0072 is confirmed via multiple connected sources: GnuPG 1.0.4 and related versions import private keys when importing public keys from key servers without notifying the user, potentially corrupting the user’s web of trust. The Mandrake advisory MDKSA-2000:087 notes this behavior and indi...

CVE-2001-0218

The CVE-2001-0218 entry concerns a format-string vulnerability in mars_nwe 0.99.pl19 that allows remote attackers to execute arbitrary commands. Affected component: mars_nwe 0.99.pl19. Root cause: improper handling of format strings leading to control of program flow and command execution. Impact...

CVE-2001-0126

Oracle XSQL servlet 1.0.3.0 and earlier allows remote attackers to execute arbitrary Java code by redirecting the XSQL server to another source via the xml-stylesheet parameter in the xslt stylesheet...

CVE-2001-0221

Buffer overflow in ja-xklock 2.7.1 and earlier allows local users to gain root privileges...

CVE-2001-0061

The CVE-2001-0061 issue affects procfs in FreeBSD (and possibly other OSes), where access to per-process mem and ctl files is not properly restricted. This lets a local attacker cause a privilege escalation by forking a child process and running a privileged executable from the child, while the p...

CVE-2001-0054

Directory traversal vulnerability in FTP Serv-U before 2.5i allows remote attackers to escape the FTP root and read arbitrary files by appending a string such as "/..%20." to a CD command, a variant of a .. dot dot attack...

CVE-2001-0096

CVE-2001-0096 describes a denial-of-service flaw in Microsoft IIS FrontPage Server Extensions (FPSE) on IIS 4.0/5.0, where a remote attacker can crash the server via a malformed web form submission. OpenVAS/Nessus classify this as a remote DoS that renders the service unusable. Public references ...

CVE-2001-0266

Vulnerability in Software Distributor SD-UX in HP-UX 11.0 and earlier allows local users to gain privileges...

CVE-2001-0274

kicq IRC client 1.0.0, and possibly later versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2001-0089

CVE-2001-0089 affects Internet Explorer 5.0–5.5. The vulnerability allows a remote attacker to read arbitrary files from the client through an HTML form using an INPUT TYPE element, known as the “File Upload via Form” issue. The provided documents do not specify payloads, affected configurations ...