CVE-2001-0929

The CVE-2001-0929 issue affects Cisco IOS CBAC (Context-Based Access Control) / Cisco Secure Integrated Software in IOS 11.2P–12.2T. The root cause is improper checking of the IP protocol type, enabling remote attackers to bypass dynamic ACLs and gain access to denied traffic. Documented as Cisco...

CVE-2001-0939

CVE-2001-0939 affects Lotus Domino 5.08 and earlier. A remote attacker can crash the service by sending a SunRPC NULL command to port 443, resulting in a denial of service. The connected documents do not specify a remediation (patch/workaround) within the provided details. The entry lists a CVSS ...

CVE-2001-0946

The vulnerability CVE-2001-0946 affects Red Hat 7.2 (Enigma) via apmd/apmscript, where a local attacker can craft a symlink to the LOW_POWER temporary file to create or modify the modification times of arbitrary files. This could be used to trigger a denial of service, for example by creating /et...

CVE-2001-0977

CVE-2001-0977 affects slapd in OpenLDAP, where OpenLDAP 1.x prior to 1.2.12 and 2.x prior to 2.0.8 are vulnerable. The issue is triggered by receiving LDAP BER length fields with invalid lengths, allowing remote attackers to cause a denial-of-service crash. Public advisories describe this as a re...

CVE-2001-1002

The CVE-2001-1002 issue affects the DVI print filter (dvips) used by lpd on Red Hat Linux 7.0 and earlier. The default configuration does not run dvips in secure mode when dvips is executed by lpd, which could allow a remote attacker to gain privileges by printing a DVI file containing malicious ...

CVE-2001-1032

PHP-Nuke 5.2 and earlier (except 5.0RC1) is vulnerable to an arbitrary file upload via admin.php due to missing authentication for upload operations. An attacker can copy/upload arbitrary files and read the PHP-Nuke configuration by invoking admin.php with an upload parameter and a target file. T...

CVE-2001-1074

Summary: CVE-2001-1074 affects Webmin 0.84 and earlier. The vulnerability arises because Webmin does not properly clear the HTTP_AUTHORIZATION environment variable when the web server restarts, causing authentication information to be exposed to all CGI programs and enabling local privilege escal...

CVE-2001-1079

CVE-2001-1079 concerns the creation of keyfile directories with world-writable permissions in PSSP 3.2 with DCE 3.1 authentication on AIX. The underlying issue is that a local user can exploit these permissions to delete key files, leading to a denial of service. The description specifies the aff...

CVE-2001-1083

Icecast versions 1.3.7 and earlier (including 1.3.7 and other

CVE-2001-1084

Affected software: Allaire JRun 3.0 and 2.3.3. Vulnerability: cross-site scripting via error messages when a request targets non-existent files (.JSP, .shtml, .jsp10, .jrun, .thtml). Root cause: uploaded/embedded Javascript from attacker is echoed into an error page, enabling script execution. Im...

CVE-2001-1085

CVE-2001-1085 concerns Lmail 2.7 and earlier. The vulnerability arises from a symlink attack on a temporary file, allowing local users to overwrite arbitrary files. The reports indicate local access is required; impact is partial on confidentiality, integrity, and availability per the provided me...

CVE-2001-1100

CVE-2001-1100 affects W3Mail 1.0.2 (and possibly other CGI programs). The issue allows remote attackers to execute arbitrary commands via shell metacharacters in any field of the ‘Compose Message’ page. This is a remote command execution vulnerability with network scope and low complexity, but no...

CVE-2001-1116

CVE-2001-1116 affects Identix BioLogon 2.03 and earlier. On multi-monitor systems running Windows 98/ME, it does not lock secondary displays, allowing an attacker with physical access to bypass authentication via a secondary display. The available sources confirm the affected product/versions and...

CVE-2001-1117

The affected product is LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware prior to 1.39.3 Beta. The vulnerability allows a remote attacker to view administration and user passwords by connecting to the router and inspecting the HTML source of (1) index.htm and (2) Password.htm). Root c...

CVE-2001-1119

CVE-2001-1119 affects xmcd's cda (on SuSE Linux) in versions 3.0.2 and 2.6, where local users can overwrite arbitrary files via a symlink attack on insecure temporary files (in /tmp). The root cause is a symbolic link redirection vulnerability tied to setuid-enabled cda. Impact; local privilege e...

CVE-2001-1121

CVE-2001-1121 is a duplicate of CVE-2001-1084; connected data provide concrete details for CVE-2001-1084: Cross-site scripting in Allaire JRun 3.0 and 2.3.3. A malicious webmaster can embed JavaScript in a request targeting a non-existent file (.JSP, .shtml, .jsp10, .jrun, or .thtml), causing the...

CVE-2001-1130

The CVE-2001-1130 issue involves SuSE Linux versions 6.0–7.2 using the sdbsearch.cgi CGI. The vulnerability allows remote command execution by uploading a keylist.txt containing filenames with shell metacharacters and then triggering a search that uses the HTTP_REFERER to access the directory hol...

CVE-2001-1146

AllCommerce with debugging enabled in EnGarde Secure Linux 1.0.1 is affected. The issue stems from creating temporary files with predictable names, enabling local users to perform a symlink attack to modify files. The description in the Connected documents confirms the root cause as predictable t...

CVE-2001-1149

Panda Antivirus Platinum before 6.23.00 is affected. Affects handling of malformed UPX-packed executables; triggering a denial of service (crash) when a user selects an action for such files. The available sources (NVD/CVE records) confirm the product/version and impact but do not provide exploit...

CVE-2001-1166

The CVE-2001-1166 entry concerns linprocfs on FreeBSD 4.3 and earlier that does not properly restrict access to kernel memory. The vulnerability enables a process with debugging rights on a privileged process to read restricted memory from that process. Affected component: linprocfs in FreeBSD; r...