CVE-2001-1567

Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database files and possibly sensitive Notes template files .ntf via an HTTP request with a large number of "+" characters before the .nsf file extension, which are converted to spaces by...

CVE-2001-1568

The CVE-2001-1568 issue affects the CMG WAP gateway, where the system fails to verify the fully qualified domain name in the URL against X.509 certificates issued by root CAs. This hostname verification gap enables remote attackers to perform a man-in-the-middle attack to spoof SSL certificates, ...

CVE-2001-1524

CVE-2001-1524 describes an XSS vulnerability in PHP-Nuke 5.3.1 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via multiple parameters: (1) uname in user.php; (2) ttitle, letter and file in modules.php; (3) subject, story and storyext in submit.php; (4) upload...

CVE-2001-1553

CVE-2001-1553 describes a local buffer overflow in SETI@home 3.03 when the binary is installed setuid. An attacker could trigger arbitrary code execution via overly long command line options (socks_server, socks_user, socks_passwd). The note indicates the default SETI@home configuration is not se...

CVE-2001-1544

The CVE-2001-1544 entry applies to Macromedia/Allaire JRun Web Server (JWS) versions 2.3.3, 3.0 and 3.1. The vulnerability is a directory traversal via a dot-dot (..) in the HTTP GET request that allows reading arbitrary files on the affected host. Concrete details are supported by connected sour...

CVE-2001-1567

CVE-2001-1567 affects IBM Lotus Domino Server up to 5.0.9a. A crafted HTTP request containing many "+" characters before a .nsf extension can cause Domino to convert pluses to spaces, allowing remote attackers to bypass security restrictions and view Notes database files and possibly sensitive No...

CVE-2001-1514

CVE-2001-1514 affects ColdFusion 4.5 and 5 on Windows when the advanced security sandbox type is set to operating system. The issue is that security context is not properly passed to child processes created with or to those that call CreateProcess and are run via or end with the CFX extension, ...

CVE-2001-1518

CVE-2001-1518 affects Windows 2000 where RunAs (runas.exe) can hang by a local user launching a named pipe session with the authentication server, because only a single session instance is created at a time. The Red Hat/NVD/CVEs reproduce the same description; no explicit affected build numbers b...

CVE-2001-1542

CVE-2001-1542 concerns NAI WebShield SMTP 4.5 (and possibly 4.5 MR1a), where the product does not filter improperly MIME-encoded email attachments. The consequence described across connected records is that this could allow remote attackers to bypass filtering and potentially execute arbitrary co...

CVE-2001-1528

The CVE-2001-1528 entry concerns AmTote International homebet software. It describes a vulnerability where the authentication process reveals different error messages for invalid account numbers and PINs, enabling remote attackers to brute-force and determine the existence of valid accounts. Affe...

CVE-2001-1526

The CVE-2001-1526 entry describes a Cross-site scripting (XSS) vulnerability in the comments action of index.php in easyNews 1.5 and earlier . The issue allows remote attackers to inject arbitrary web script or HTML via the zeit parameter. Several connected records (Red Hat CVE, NVD, CVE List, CV...

CVE-2001-1545

Macromedia JRun 3.0/3.1 is affected by CVE-2001-1545, where the server appends the jsessionid to URLs (URL rewriting) when cookies are enabled. This can allow remote attackers to obtain session IDs and hijack sessions via HTTP referrer headers or sniffing. Public sources across NVD/Red Hat/CVE li...

CVE-2001-1545

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...

CVE-2001-1521

CVE-2001-1521 is an XSS vulnerability in PostNuke 0.64, specifically in the file/user component user.php , where the uname parameter can be exploited to inject arbitrary web script or HTML. The public records identify the affected software as PostNuke 0.64 and the vulnerability as a cross-site sc...

CVE-2001-1534

CVE-2001-1534 affects Apache with the mod_usertrack module (versions 1.3.11–1.3.20). The vulnerability arises from generating session IDs with predictable information (host IP, system time, server PID), enabling local users to obtain session IDs and bypass authentication when those IDs are used f...

CVE-2001-1552

CVE-2001-1552 affects Windows ME where the service ssdpsrv.exe can be triggered remotely to cause a denial of service by sending multiple newline characters in an SSDP message. The NVD/CVE records describe the vulnerability as a DoS condition without mentioning code-level details, impacted versio...

CVE-2001-1508

CVE-2001-1508 : A buffer overflow in the lpstat utility on SCO OpenServer 5.0–5.0.6a allows local users to run arbitrary code as group bin through a long command line argument. The documents specify a local exploit path but do not provide explicit exploited details or patch information. The vulne...

CVE-2001-1556

Technical details for CVE-2001-1556 are not publicly provided in the connected documents. Monitor for updates.

CVE-2001-1564

CVE-2001-1564 affects HP-UX kernels prior to some later patch levels (versions 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11). The issue is that setrlimit does not correctly enforce core file size after the process drops setuid/setgid privileges, which could allow a local user to cause a den...

CVE-2001-1535

CVE-2001-1535 concerns Slashcode 2.0, where new accounts are created with an 8-character random password. The flaw can let local attackers obtain session IDs from cookies and use a brute‑force attack to gain unauthorized access. This impacts confidentiality, integrity, and availability on affecte...