CVE-2001-1509

The CVE-2001-1509 entry concerns HP-UX 11.20 on Itanium (IA) systems. The vulnerability arises in geteuid failing to correctly identify a user’s effective UID, which could allow local users to escalate privileges. Affected context: Itanium Architecture (IA) running HP-UX 11.20. Documented impact:...

CVE-2001-1546

Pathways Homecare 6.5 is affected by a vulnerability where weak encryption protects usernames and passwords, enabling local attackers to recover credentials from the pwhc.ini file and gain privileges. Affected component: Pathways Homecare 6.5; root cause: weak encryption/storage of credentials in...

CVE-2002-2001

The CVE relates to jmcce 1.3.8 on Mandrake 8.1. It creates log files in /tmp with predictable names, enabling a local user to perform a symlink attack to overwrite arbitrary files. Root-level risk is implied by Mandrake advisory context (jmcce runs with elevated privileges and writes logs to a wo...

CVE-2001-1562

Format string vulnerability in nvi before 1.79 allows local users to gain privileges via format string specifiers in a filename...

CVE-2001-1560

CVE-2001-1560 involves Win32k.sys (Graphics Device Interface, GDI) on Windows 2000/XP. The vulnerability arises when a local user calls the ShowWindow function after receiving a WM_NCCREATE message, enabling a local DoS (system crash). Documents consistently reference this by name and description...

CVE-2001-1558

Removed by vendor...

CVE-2001-1523

CVE-2001-1523 describes a cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke. The issue stems from improper handling of the topic parameter, allowing remote attackers to inject arbitrary web script or HTML. Affected component: DMOZGateway within PHP-Nuke (topic parame...

CVE-2001-1539

CVE-2001-1539 describes a stack consumption vulnerability in Internet Explorer involving the JavaScript setTimeout function. It allows remote attackers to cause a denial of service (crash) via setTimeout. The CVE notes that the vendor could not reproduce the problem. Connected records (CVE and NV...

CVE-2001-1516

Affected software: phpReview, versions 0.9.0 rc2 and earlier. Vulnerability: Cross-site scripting (XSS) via user-submitted reviews, enabling remote attackers to inject arbitrary script/HTML. Root cause: inadequate input sanitization in the review submission pathway. Impact: not quantified beyond ...

CVE-2001-1566

CVE-2001-1566 describes a format-string vulnerability in libvanessa_logger 0.0.1 used by Perdition 0.1.8 that allows remote code execution via format specifiers in the __vanessa_logger_log function. The NVD entry lists a CVSSv2 base score of 7.5 (HIGH) with network access, low attack complexity, ...

CVE-2001-1540

CVE-2001-1540 affects IPRoute versions 0.973, 0.974, and 1.18. According to the connected sources, remote attackers can cause a denial of service by sending fragmented IP packets that split the TCP header. The information consistently describes a network-exposed DoS condition but does not provide...

CVE-2001-1511

The CVE-2001-1511 issue affects JRun 3.0/3.1 running on JRun Web Server (JWS) and IIS, where remote attackers can read arbitrary JSP source code by requesting a URL containing a source filename ending in jsp%00 or js%2570. This indicates a file-disclosure vulnerability enabling access to server-s...

CVE-2001-1534

CVE-2001-1534 affects Apache with the mod_usertrack module (versions 1.3.11–1.3.20). The vulnerability arises from generating session IDs with predictable information (host IP, system time, server PID), enabling local users to obtain session IDs and bypass authentication when those IDs are used f...

CVE-2001-1556

Technical details for CVE-2001-1556 are not publicly provided in the connected documents. Monitor for updates.

CVE-2001-1564

CVE-2001-1564 affects HP-UX kernels prior to some later patch levels (versions 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11). The issue is that setrlimit does not correctly enforce core file size after the process drops setuid/setgid privileges, which could allow a local user to cause a den...

CVE-2001-1535

CVE-2001-1535 concerns Slashcode 2.0, where new accounts are created with an 8-character random password. The flaw can let local attackers obtain session IDs from cookies and use a brute‑force attack to gain unauthorized access. This impacts confidentiality, integrity, and availability on affecte...

CVE-2001-1552

CVE-2001-1552 affects Windows ME where the service ssdpsrv.exe can be triggered remotely to cause a denial of service by sending multiple newline characters in an SSDP message. The NVD/CVE records describe the vulnerability as a DoS condition without mentioning code-level details, impacted versio...

CVE-2001-1508

CVE-2001-1508 : A buffer overflow in the lpstat utility on SCO OpenServer 5.0–5.0.6a allows local users to run arbitrary code as group bin through a long command line argument. The documents specify a local exploit path but do not provide explicit exploited details or patch information. The vulne...

CVE-2001-1519

RunAs runas.exe in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to...

CVE-2001-1515

This CVE (CVE-2001-1515) affects Windows 2000 SP1 when Macintosh clients access NTFS volumes. The issue arises as subdirectories created by Macintosh clients automatically modify inherited NTFS permissions, potentially giving less restrictive permissions than intended. Documented by multiple sour...