CVE-2001-1398

The CVE-2001-1398 issue affects the Linux kernel prior to 2.2.19, arising from the masquerading code where packet length checks were lax, potentially enabling kernel memory writes via the CPIA driver off-by-one bug. Confirmed in multiple advisories (Mandrake MDKSA-2001:037 and Debian/Debian DSA-0...

CVE-2001-1401

Bugzilla before 2.14 contains an access-control flaw where confidential bugs can be viewed by manipulating bug id parameters in multiple scripts (process_bug.cgi, show_activity.cgi, showvotes.cgi, showdependencytree.cgi, showdependencygraph.cgi, showattachment.cgi, describecomponents.cgi). The un...

CVE-2001-1402

Bugzilla before 2.14 does not properly escape untrusted parameters, enabling cross-site scripting (XSS) and potentially SQL injection via multiple input points. Affected areas include reports.cgi (product/output form variables), showvotes.cgi (voteon, bug_id, user), createaccount.cgi (email), sho...

CVE-2001-1390

The CVE-2001-1390 entry concerns an unknown vulnerability in the Linux kernel component binfmt_misc prior to version 2.2.19, related to user pages. Connected advisories (Mandrake MDKSA-2001:037 and Debian DSA-047-1, among others) document that the core issue is an off-by-one error in the CPIA dri...

CVE-2001-1408

CVE-2001-1408 affects WebMail 2.0.1 on Cobalt Qube 3. It is a directory traversal vulnerability in readmsg.php where a crafted mailbox parameter containing .. can cause remote reading of arbitrary files. The OpenVAS NASL detection notes readmsg.php presence and flags the traversal issue; Nessus c...

CVE-2001-1393

CVE-2001-1393 relates to an unknown vulnerability in the Linux kernel classifier code prior to version 2.2.19 that could cause a denial of service (hang). Multiple connected sources (Mandrake/MDKSA-2001:037, Debian/DSA-047-1, OpenVAS entries) describe an off-by-one issue in the CPIA driver within...

CVE-2001-1390

Unknown vulnerability in binfmtmisc in the Linux kernel before 2.2.19, related to user pages...

CVE-2001-1392

The Linux kernel before 2.2.19 does not have unregister calls for 1 CPUID and 2 MSR drivers, which could cause a DoS crash by unloading and reloading the drivers...

CVE-2001-1399

Certain operations in Linux kernel before 2.2.19 on the x86 architecture copy the wrong number of bytes, which might allow attackers to modify memory, aka "User access asm bug on x86."...

CVE-2001-1402

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting CSS and possibly SQL injection attacks on 1 the product or output form variables for reports.cgi, 2 the voteon, bugid, and user...

CVE-2001-1387

The CVE-2001-1387 entry concerns the iptables package, specifically iptables-save in versions before 1.2.4. The issue is that iptables-save records the --reject-with icmp-host-prohibited rule as --reject-with tcp-reset, causing generated responses to diverge from the administrator’s configuration...

CVE-2001-1399

CVE-2001-1399 refers to an off-by-one/byte-copy bug in the Linux kernel prior to 2.2.19 on x86 that could allow a local attacker to modify kernel memory. Public references in 2001 advisories (Mandrake MDKSA-2001:037, Debian DSA-047-1, Debian/OpenVAS entries) describe the CPIA driver and related x...

CVE-2001-1396

CVE-2001-1396 corresponds to an off-by-one vulnerability in the CPIA driver of the Linux kernel prior to 2.2.19. Connected advisories confirm that this flaw could allow a local attacker to modify kernel memory, potentially impacting confidentiality and integrity (and with related disclosures, DoS...

CVE-2001-1394

CVE-2001-1394 is a Linux kernel local vulnerability describing a signedness error in (1) getsockopt and (2) setsockopt prior to kernel version 2.2.19 that allows local users to cause a denial of service. The connected documents confirm the affected component is the Linux kernel and specify the is...

CVE-2001-1404

CVE-2001-1404 describes a vulnerability in Bugzilla prior to version 2.14 where passwords were stored in plaintext and password requests could be sent via email. The underlying issue is insecure password handling, enabling privilege escalation if an attacker could access or intercept credentials....

CVE-2001-1403

This CVE (CVE-2001-1403) affects Bugzilla prior to version 2.14, where username and password were included in URLs. The underlying issue is credentials exposed in URLs, which could enable attackers to gain privileges by reading web server access logs or by shoulder-surfing and observing the brows...

CVE-2001-1401

Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in 1 processbug.cgi, 2 showactivity.cgi, 3 showvotes.cgi, 4 showdependencytree.cgi, 5 showdependencygraph.cgi, 6...

CVE-2001-1400

CVE-2001-1400 describes a local denial-of-service issue in the Linux kernel before 2.2.19 where UDP port allocation could deadlock a system. Connected advisories confirm the vulnerability affects the Linux kernel up to 2.2.18 and are corrected in the 2.2.19 release (e.g., Mandrake MDKSA-2001:037 ...

Gallery includedir Parameter Remote File Inclusion

The version of Gallery installed on the remote host is affected by a remote file inclusion vulnerability due to the application failing to properly sanitize user-supplied input to the 'includedir' parameter. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shel...

phpAdsNew helperfunction.php Remote File Inclusion

It is possible to make the remote host include PHP files hosted on a third-party server using PHPAdsNew. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the HTTP server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...