CVE-2001-1516

Affected software: phpReview, versions 0.9.0 rc2 and earlier. Vulnerability: Cross-site scripting (XSS) via user-submitted reviews, enabling remote attackers to inject arbitrary script/HTML. Root cause: inadequate input sanitization in the review submission pathway. Impact: not quantified beyond ...

CVE-2001-1517

CVE-2001-1517 affects Windows 2000 RunAs (runas.exe). The issue is that cleartext authentication data is stored in memory, potentially allowing a attacker to recover usernames and passwords by a process sharing the same memory page after a RunAs operation ends. Evidence in connected sources confi...

CVE-2001-1518

CVE-2001-1518 affects Windows 2000 where RunAs (runas.exe) can hang by a local user launching a named pipe session with the authentication server, because only a single session instance is created at a time. The Red Hat/NVD/CVEs reproduce the same description; no explicit affected build numbers b...

CVE-2001-1519

CVE-2001-1519 affects Windows 2000 RunAs (runas.exe). Multiple sources describe a local-privilege issue where, if the RunAs service is stopped, a local attacker can create a spoofed named pipe and potentially capture cleartext usernames and passwords when clients connect. The Red Hat and CVE/CVE-...

CVE-2001-1521

CVE-2001-1521 is an XSS vulnerability in PostNuke 0.64, specifically in the file/user component user.php , where the uname parameter can be exploited to inject arbitrary web script or HTML. The public records identify the affected software as PostNuke 0.64 and the vulnerability as a cross-site sc...

CVE-2001-1523

CVE-2001-1523 describes a cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke. The issue stems from improper handling of the topic parameter, allowing remote attackers to inject arbitrary web script or HTML. Affected component: DMOZGateway within PHP-Nuke (topic parame...

CVE-2001-1524

CVE-2001-1524 describes an XSS vulnerability in PHP-Nuke 5.3.1 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via multiple parameters: (1) uname in user.php; (2) ttitle, letter and file in modules.php; (3) subject, story and storyext in submit.php; (4) upload...

CVE-2001-1525

The CVE-2001-1525 vulnerability affects easyNews 1.5 and earlier, where the comments action is vulnerable to directory traversal. An attacker can modify files such as news.dat and template.dat by supplying a ".." in the cid parameter, indicating a path traversal through the comments functionality...

CVE-2001-1526

The CVE-2001-1526 entry describes a Cross-site scripting (XSS) vulnerability in the comments action of index.php in easyNews 1.5 and earlier . The issue allows remote attackers to inject arbitrary web script or HTML via the zeit parameter. Several connected records (Red Hat CVE, NVD, CVE List, CV...

CVE-2001-1527

The CVE affects easyNews 1.5 and earlier, where administration passwords are stored in cleartext in the file settings.php. This enables local users to obtain passwords and gain access due to improper password storage. The provided documents do not specify a vendor patch or remediation steps; no e...

CVE-2001-1528

The CVE-2001-1528 entry concerns AmTote International homebet software. It describes a vulnerability where the authentication process reveals different error messages for invalid account numbers and PINs, enabling remote attackers to brute-force and determine the existence of valid accounts. Affe...

CVE-2001-1529

CVE-2001-1529 describes a buffer overflow in rpc.yppasswdd (yppasswd server) that, on affected systems (notably AIX as per the description, and Solaris historically for CVE-2001-0779), permits unauthorized access via a long string. The OpenVAS entries emphasize that this vulnerability can allow a...

CVE-2001-1534

CVE-2001-1534 affects Apache with the mod_usertrack module (versions 1.3.11–1.3.20). The vulnerability arises from generating session IDs with predictable information (host IP, system time, server PID), enabling local users to obtain session IDs and bypass authentication when those IDs are used f...

CVE-2001-1535

CVE-2001-1535 concerns Slashcode 2.0, where new accounts are created with an 8-character random password. The flaw can let local attackers obtain session IDs from cookies and use a brute‑force attack to gain unauthorized access. This impacts confidentiality, integrity, and availability on affecte...

CVE-2001-1538

CVE-2001-1538 affects the SpeedXess HA-120 DSL router. The vulnerability arises from a default administrative password of "speedxess" that allows remote access. The connected sources confirm the issue and its basic impact (unauthorized access to admin functions) but do not provide any remediation...

CVE-2001-1543

Axis Network Camera models 2120, 2110, 2100, 200+ and 200 are affected by CVE-2001-1543 due to a default administrator password. This root cause allows remote attackers to gain access using the credentials pass. Impact stated across multiple sources is unauthorized access to the camera. No explic...

CVE-2001-1544

The CVE-2001-1544 entry applies to Macromedia/Allaire JRun Web Server (JWS) versions 2.3.3, 3.0 and 3.1. The vulnerability is a directory traversal via a dot-dot (..) in the HTTP GET request that allows reading arbitrary files on the affected host. Concrete details are supported by connected sour...

CVE-2001-1546

Pathways Homecare 6.5 is affected by a vulnerability where weak encryption protects usernames and passwords, enabling local attackers to recover credentials from the pwhc.ini file and gain privileges. Affected component: Pathways Homecare 6.5; root cause: weak encryption/storage of credentials in...

CVE-2001-1547

Outlook Express 6.0 vulnerability: when the setting to block potentially virus-laden attachments is enabled, forwarded messages may bypass this and allow remote code execution. Affected component is attachments handling in forwarded email. The provided documents state the issue but do not specify...

CVE-2001-1548

CVE-2001-1548 affects ZoneAlarm versions 2.1–2.6 and ZoneAlarm Pro 2.4–2.6. The root cause is bypass of filtering by local users through non-standard TCP packets crafted with non-Windows protocol adapters, enabling potential evasion of security controls. The public records describe the vulnerabil...