Hyperseek 2000 hsx.cgi does not adequately filter user input disclosing directory listings and file contents

Overview iWeb Systems Hyperseek search engine may allow malformed URL requests to access files outside the document root of a vulnerable system. Description A specially crafted URL can disclose the directory listing and files of the target system with read permissions. --- Impact Remote attackers...

Oracle 9iAS Nonexistent .jsp File Request Error Message Path Disclosure

Oracle 9iAS allows remote attackers to obtain the physical path of a file under the server root via a request for a nonexistent .JSP file. The default error generated leaks the pathname in an error message. %NASLMINLEVEL 70300 This script was written by Javier Fernandez-Sanguino This software is...

CVE-2001-1451

Memory leak in the SNMP LAN Manager LANMAN MIB extension for Microsoft Windows 2000 before SP3, when the Print Spooler is not running, allows remote attackers to cause a denial of service memory consumption via a large number of GET or GETNEXT requests...

CVE-2002-0399

CVE-2007-4559 is a directory traversal vulnerability in the tarfile module of Python, allowing a tar archive containing a .. sequence to overwrite arbitrary files during extraction. The issue is referenced in multiple Nessus advisories (e.g., Alibaba Cloud Linux 3 advisory ALINUX3-SA-2024:0040 an...

Alchemy Eye HTTP Server does not adequately validate user input thereby allowing remote command execution

Overview Alchemy Eye does not properly validate HTTP requests, allowing arbitrary command execution. Description Alchemy Eye includes an HTTP server for remote system monitoring and control. In versions 2.0 through 2.6 of Alchemy Eye, the HTTP server component does not adequately validate HTTP...

phpMyAdmin sql.php Traversal Arbitrary File Access

It is possible to make the remote phpMyAdmin installation read arbitrary data on the remote host. An attacker may use this flaw to read arbitrary files that your web server has the right to access or execute arbitrary PHP code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref:...

phpPgAdmin sql.php goto Parameter Traversal Arbitrary File Access

It is possible to make the remote phpPgAdmin installation read arbitrary data on the remote host. An attacker could use this flaw to read /etc/passwd or any file that your web server has the right to access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref:...

CVE-2001-1402

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting CSS and possibly SQL injection attacks on 1 the product or output form variables for reports.cgi, 2 the voteon, bugid, and user...

CVE-2001-1390

Unknown vulnerability in binfmtmisc in the Linux kernel before 2.2.19, related to user pages...

CVE-2001-1404

CVE-2001-1404 describes a vulnerability in Bugzilla prior to version 2.14 where passwords were stored in plaintext and password requests could be sent via email. The underlying issue is insecure password handling, enabling privilege escalation if an attacker could access or intercept credentials....

CVE-2001-1394

CVE-2001-1394 is a Linux kernel local vulnerability describing a signedness error in (1) getsockopt and (2) setsockopt prior to kernel version 2.2.19 that allows local users to cause a denial of service. The connected documents confirm the affected component is the Linux kernel and specify the is...

CVE-2001-1397

CVE-2001-1397 affects the System V shared memory implementation in the Linux kernel before version 2.2.19. The issue allows attackers to modify recently freed memory within SYSV shared memory. Public sources consistently describe this as a kernel memory handling flaw rather than a user-space vuln...

CVE-2001-1392

The Linux kernel before 2.2.19 does not have unregister calls for 1 CPUID and 2 MSR drivers, which could cause a DoS crash by unloading and reloading the drivers...

CVE-2001-1401

Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in 1 processbug.cgi, 2 showactivity.cgi, 3 showvotes.cgi, 4 showdependencytree.cgi, 5 showdependencygraph.cgi, 6...

CVE-2001-1387

The CVE-2001-1387 entry concerns the iptables package, specifically iptables-save in versions before 1.2.4. The issue is that iptables-save records the --reject-with icmp-host-prohibited rule as --reject-with tcp-reset, causing generated responses to diverge from the administrator’s configuration...

CVE-2001-1403

This CVE (CVE-2001-1403) affects Bugzilla prior to version 2.14, where username and password were included in URLs. The underlying issue is credentials exposed in URLs, which could enable attackers to gain privileges by reading web server access logs or by shoulder-surfing and observing the brows...

CVE-2001-1395

CVE-2001-1395 is a vulnerability described as unknown in sockfilter for Linux kernel before 2.2.19. Connected sources corroborate an off-by-one issue in the CPIA driver that could allow a local kernel-memory write and potentially expose or compromise kernel integrity; remediation in practice is t...

CVE-2001-1390

The CVE-2001-1390 entry concerns an unknown vulnerability in the Linux kernel component binfmt_misc prior to version 2.2.19, related to user pages. Connected advisories (Mandrake MDKSA-2001:037 and Debian DSA-047-1, among others) document that the core issue is an off-by-one error in the CPIA dri...

CVE-2001-1389

Concrete details from connected sources show that CVE-2001-1389 affects xinetd up to version 2.3.3, with remote code execution and denial-of-service possibilities caused by buffer overflows and improper NULL termination. The Mandrake advisory confirms patches were applied in the 2.3.1 release, in...

CVE-2001-1388

CVE-2001-1388 affects iptables prior to 1.2.4. The vulnerability stems from an inaccuracy in converting rate limits specified on the command line, which could cause administrators to see mismatched traffic levels (more or less) than intended. The articles do not provide exploit details or confirm...