CVE-2001-0229

The CVE affects Chili!Soft ASP for Linux before 3.6. In inherited mode it missets group privileges, enabling local privilege escalation via malicious scripts. Impact is described as complete confidentiality, integrity, and availability losses. No explicit remediation steps are documented in the p...

CVE-2001-0216

The CVE-2001-0216 issue affects the PALS Library System pals-cgi program. The vulnerability arises from shell metacharacters in the documentName parameter, enabling remote attackers to execute arbitrary commands via the CGI. NVD data indicates a NETWORK attack vector with LOW complexity and no au...

CVE-2001-0180

CVE-2001-0180 involves a vulnerability in Lars Ellingsen’s guestserver.cgi where remote attackers can execute arbitrary commands through shell metacharacters in the email parameter. The issue is a command injection in the CGI handling of user-provided input, enabling full compromise of confidenti...

CVE-2001-0202

The CVE-2001-0202 entry affects the Picserver web server, where a directory traversal (..) in an HTTP GET request allows an attacker to read arbitrary files. This root cause is described across multiple sources (e.g., NVD/NVD entry and CVE record) as a remote-access vulnerability with a notable i...

CVE-2001-0200

HSWeb 2.0 HTTP server is affected by a path-disclosure vulnerability: remote attackers can obtain the server’s physical path by requesting the /cgi/ directory if directory browsing is enabled. This results in partial confidentiality impact. The available sources do not provide exploit details, af...

CVE-2001-0184

CVE-2001-0184 concerns eEye Iris 1.01 beta, where a remote attacker can trigger a denial of service by sending a malformed packet that crashes Iris when viewed. Affected component is the Iris client; underlying cause is mishandling of a crafted packet leading to crash. Exploitation details are no...

CVE-2001-0217

The connected Nessus source (PALS Library System WebPALS pals-cgi Multiple Vulnerabilities) confirms a directory traversal flaw in the pals-cgi CGI of the PALS Library System. The vulnerability allows an attacker to read arbitrary files via the .. sequence in the documentName parameter, with the ...

CVE-2001-0201

The CVE-2001-0201 entry describes a vulnerability in the Postaci frontend for PostgreSQL where improper filtering of characters (e.g., semicolons) could allow remote attackers to execute arbitrary SQL queries via the deletecontact.php program. This yields partial confidentiality, integrity, and a...

CVE-2001-0199

CVE-2001-0199 affects the SEDUM HTTP Server 2.0. A directory traversal flaw allows remote attackers to read files outside the web root by sending a GET request containing "..". The issue is exploitable over the network without authentication, with no required user interaction. The NVD entry lists...

CVE-2001-0167

CVE-2001-0167 describes a buffer overflow in the RealVNC/WinVNC client prior to or at version 3.3.3r7 (WinVNC) that can be triggered by a crafted rfbConnFailed packet and a long reason string, allowing a remote attacker to execute arbitrary code with the user’s privileges. Connected sources show ...

CVE-2001-0168

CVE-2001-0168 affects AT&T WinVNC Windows server up to version 3.3.3r7. A buffer overflow in the HTTP handling (vncHTTPConnect/Log.cpp) can be triggered by an overly long HTTP GET when the DebugLevel registry key > 0, allowing remote code execution with the privileges of the VNC server user. P...

CVE-2001-0211

CVE-2001-0211 describes a directory traversal vulnerability in WebSPIRS 3.1 where the CGI parameter sp.nextform can be manipulated with a .. sequence to read arbitrary files. Multiple sources (NVD and CVE listings) confirm the affected product as WebSPIRS 3.1 and the impact as information disclos...

CVE-2001-0209

CVE-2001-0209 : Buffer overflow in Shoutcast Distributed Network Audio Server (DNAS) 1.7.1 enables remote attackers to cause a denial of service, and possibly execute arbitrary commands, through a long description. The provided documents confirm DNAS as affected and describe the vulnerability as ...

CVE-2001-0146

IIS 5.0 and Exchange 2000 are vulnerable to a DoS via repeated malformed URLs that trigger a memory allocation error, disrupting IIS (and web-based mail on Exchange). The CERT/MS MS01-014 patch (and MS01-044 for IIS-only scenarios) are the remediation paths described; no exploitation details are ...

CVE-2001-0192

CVE-2001-0192 describes a buffer overflow in CTRLServer (XMail) that can be triggered via the cfgfileget or domaindel functions, allowing arbitrary command execution. The vulnerability is categorized with a NETWORK attack vector and HIGH impact (complete confidentiality, integrity, and availabili...

CVE-2001-0188

Affected software: GoodTech FTP Server for Windows. Vulnerability: denial-of-service via a flood of connections that causes the server to crash (CVE-2001-0188, affected versions 3.0.1.2.1.0 and earlier). Evidence: multiple sources describe an DoS condition from rapid/abusive connection attempts; ...

CVE-2001-0214

The Way-board CGI (way-board.cgi) is vulnerable: an attacker can remotely read arbitrary files by supplying a filename in the db parameter terminated with a null byte. The NASL/Tenable data notes the CGI runs with the web server’s privileges (often root or nobody), enabling file disclosure. Remed...

CVE-2001-0173

The CVE-2001-0173 entry describes a buffer overflow in the qDecoder library (versions ≤ 5.08) used by CrazyWWWBoard, CrazySearch, and other CGI programs. The overflow occurs in parsing a long MIME Content-Type header, enabling remote command execution. Affected component: qDecoder library. Root c...

CVE-2001-0212

CVE-2001-0212 describes a directory traversal in HIS Auktion 1.62 allowing remote read of arbitrary files via an encoded dot-dot in the menue parameter, with potential command execution through shell metacharacters. The Nessus plugin for HIS Auktion (auktion.cgi) flags a well-known flaw in the au...

CVE-2001-0224

CVE-2001-0224 affects the Muscat Empower CGI program. A remote attacker can cause disclosure of the server’s absolute pathname via an invalid request in the DB parameter. The issue is demonstrated by a misleading DB parameter in a GET request to the CGI (e.g., GET /cgi-bin/empower?DB=whatever), w...