3489 matches found
CVE-2001-1568
The CVE-2001-1568 issue affects the CMG WAP gateway, where the system fails to verify the fully qualified domain name in the URL against X.509 certificates issued by root CAs. This hostname verification gap enables remote attackers to perform a man-in-the-middle attack to spoof SSL certificates, ...
CVE-2001-1569
Openwave WAP gateway is affected by CVE-2001-1569: it does not verify the fully-qualified domain name in X.509 certificates against root CAs, enabling remote attackers to spoof SSL via a man-in-the-middle. Affected component: Openwave WAP gateway; root-cause: missing hostname verification. Impact...
CVE-2001-1570
Technical details about CVE-2001-1570 are not publicly available in the provided connected documents. Monitor for updates.
CVE-2001-1572
CVE-2001-1572 affects the Linux kernel Netfilter MAC module (versions 2.4.1–2.4.11) and allows remote attackers to bypass MAC-based packet filters by sending small packets. This is a network-vector, low-complexity, no-authentication exploit with partial impacts on confidentiality , integrity , an...
CVE-2001-1533
Microsoft Internet Security and Acceleration ISA Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability...
CVE-2001-1513
Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the web application directory without the trailing '/' slash, as demonstrated using ctx...
CVE-2001-1514
ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to 1 child processes created with and 2 child processes that call the CreateProcess function and are executed with or end with the CFX extension...
CVE-2001-1519
RunAs runas.exe in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to...
CVE-2001-1527
easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and gain access...
CVE-2001-1534
modusertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication...
CVE-2001-1545
Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...
CVE-2001-1567
Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database files and possibly sensitive Notes template files .ntf via an HTTP request with a large number of "+" characters before the .nsf file extension, which are converted to spaces by...
CVE-2001-1522
The CVE-2001-1522 entry describes an XSS vulnerability in im.php of IMessenger for PHP-Nuke , allowing remote attackers to inject arbitrary script or HTML via a message. Affected software: IMessenger for PHP-Nuke; root cause: insufficient input sanitization in im.php. Impact: partial integrity im...
CVE-2001-1545
Macromedia JRun 3.0/3.1 is affected by CVE-2001-1545, where the server appends the jsessionid to URLs (URL rewriting) when cookies are enabled. This can allow remote attackers to obtain session IDs and hijack sessions via HTTP referrer headers or sniffing. Public sources across NVD/Red Hat/CVE li...
CVE-2001-1540
CVE-2001-1540 affects IPRoute versions 0.973, 0.974, and 1.18. According to the connected sources, remote attackers can cause a denial of service by sending fragmented IP packets that split the TCP header. The information consistently describes a network-exposed DoS condition but does not provide...
CVE-2001-1564
CVE-2001-1564 affects HP-UX kernels prior to some later patch levels (versions 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11). The issue is that setrlimit does not correctly enforce core file size after the process drops setuid/setgid privileges, which could allow a local user to cause a den...
CVE-2001-1559
The CVE-2001-1559 issue affects OpenBSD 2.9 and 3.0, where the uipc_syscalls.c logic returns user-mode values to the fdrelease kernel function, enabling local users to trigger a denial of service and a null dereference. The root cause is the mismatched value returned by uipc system calls to a ker...
CVE-2001-1567
CVE-2001-1567 affects IBM Lotus Domino Server up to 5.0.9a. A crafted HTTP request containing many "+" characters before a .nsf extension can cause Domino to convert pluses to spaces, allowing remote attackers to bypass security restrictions and view Notes database files and possibly sensitive No...
CVE-2001-1542
CVE-2001-1542 concerns NAI WebShield SMTP 4.5 (and possibly 4.5 MR1a), where the product does not filter improperly MIME-encoded email attachments. The consequence described across connected records is that this could allow remote attackers to bypass filtering and potentially execute arbitrary co...
