CVE-2001-1302

The change password option in the Windows Security interface for Windows 2000 allows attackers to use the option to attempt to change passwords of other users on other systems or identify valid accounts by monitoring error messages, possibly due to a problem in the NetuserChangePassword function...

CVE-2001-1103

FTP Voyager ActiveX control before 8.0, when it is marked as safe for scripting the default or if allowed by the IObjectSafety interface, allows remote attackers to execute arbitrary commands...

CVE-2001-0485

The CVE concerns SGI IRIX netprint: a local-privilege escalation in /usr/lib/print/netprint (IRIX 6.2 and potentially other versions) that allows a local user with lp privileges to run arbitrary commands via the -n option. The SGI advisory documents confirmed affected installations and provides r...

CVE-2001-0837

DeltaThree Pc-To-Phone 3.0.3 is affected by a local-privilege issue where sensitive data is placed in world-readable locations within the installation directory. The vulnerable components include access to temp.html, the log folder, and the PhoneBook folder, enabling local users to read sensitive...

CVE-2001-0612

CVE-2001-0612 affects McAfee Remote Desktop 3.0 and earlier. The vulnerability allows a remote attacker to cause a denial of service (crash) by sending a large number of packets to port 5045. The NVD entry lists a CVSS v2 base score of 5.0 (Medium) with network access, no authentication, and part...

CVE-2001-1279

CVE-2001-1279 affects tcpdump 3.x (likely 3.6x) with a buffer overflow in the AFS RPC decoding path (print-rx.c). Exploitation via crafted AFS RPC packets with invalid lengths can cause a denial of service and may allow remote code execution with the privileges of tcpdump (typically root). The is...

CVE-2001-1200

CVE-2001-1200 affects Microsoft Windows XP. The vulnerability allows local users to bypass a locked screen and execute programs associated with hot keys. The NVD entry lists a local attack vector with low complexity and complete impact to confidentiality, integrity, and availability (base score 7...

CVE-2001-0825

The CVE-2001-0825 entry concerns xinetd prior to 2.1.8.8, where a buffer overflow in internal string handling routines enables remote command execution. The vulnerability stems from a length argument of zero or less, which disables the length check and may allow an attacker to run arbitrary comma...

CVE-2001-1055

The CVE-2001-1055 entry affects the Microsoft Windows network stack . The vulnerability allows a remote attacker to exhaust CPU resources by sending a flood of malformed ARP request packets with random source IP and MAC addresses, resulting in denial of service . The effect is described as CPU co...

CVE-2001-1302

CVE-2001-1302 relates to Windows 2000 where the Change Password option in the Windows Security UI can be misused to attempt to change passwords for other accounts on remote systems or to identify valid accounts via error messages. The vulnerability is attributed to a potential problem in the NetU...

CVE-2001-1351

CVE-2001-1351 concerns a cross-site scripting vulnerability in Namazu 2.0.8 and earlier. The issue allows remote attackers to execute arbitrary JavaScript in the context of other web users when displaying hit numbers, via the index file name shown in results. Affected component: Namazu search int...

CVE-2001-0423

Buffer overflow in ipcs in Solaris 7 x86 allows local users to execute arbitrary code via a long TZ timezone environmental variable, a different vulnerability than CAN-2002-0093...

CVE-2001-1081

Vulnerability details: CVE-2001-1081 concerns Livingston/Lucent RADIUS prior to 2.1.va.1, where format string vulnerabilities in log message handling can allow local or remote attackers to cause a denial of service and potentially execute arbitrary code via crafted format specifiers. The provided...

Mandrake Linux Security Advisory : glibc (MDKSA-2001:095)

Flavio Veloso found an overflowable buffer problem in earlier versions of the glibc glob3 implementation. It may be possible to exploit some programs that pass input to the glibc glob function in a manner that can be modified by the user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : squid (MDKSA-2001:088)

Vladimir Ivaschenko found a problem in the squid proxy server. Certain FTP requests could cause the squid daemon to abort, making it unavailable for a few seconds. If enough of these requests are sent in a short period of time, the squid daemon will not restart itself. %NASLMINLEVEL 70300 C Tenab...

Mandrake Linux Security Advisory : gftp (MDKSA-2001:044)

A format string vulnerability exists in all versions of gftp prior to version 2.0.8. This vulnerability has been fixed upstream in version 2.0.8. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security...

Mandrake Linux Security Advisory : openssl (MDKSA-2001:065)

The pseudo-random number generator in OpenSSL versions up to 0.9.6a has a design flaw. By knowing the output of specific PRNG requests, an attacker would be able to determine the PRNG's internal state and thus predict future PRNG output. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : openldap (MDKSA-2001:069)

CERT released an advisory that details a number of vulnerabilities as found in a variety of different LDAP implementations. The results of these tests showed one vulnerability in OpenLDAP with slapd not handling packets with certain invalid fields. A malicious attacker could craft such invalid...

Mandrake Linux Security Advisory : util-linux (MDKSA-2001:084)

Tarhon-Onu Victor found a problem in /bin/login's PAM implementation. It stored the value of a static pwent buffer across PAM calls, and when used with some PAM modules in non-default configurations ie. using pamlimits, it would overwrite the buffer and cause the user to get the credentials of...

Mandrake Linux Security Advisory : squid (MDKSA-2001:066)

The Squid proxy server has a serious security flaw in versions 2.3.STABLE2 through 2.3.STABLE4. This problem surfaces when Squid is used in httpdaccel mode. If you configure httpaccelwithproxy off then any request to Squid is allowed. Malicious users may use your proxy to portscan remote systems,...