CVE-2001-1172

OmniSecure HTTProtect 1.1.1 is affected by a local privilege escalation: a superuser without omnish privileges can modify a protected file by creating a symbolic link to that file. Root cause is improper protection against symbolic link exploitation in HTTProtect, allowing bypass of protection me...

CVE-2001-1174

The CVE-2001-1174 issue affects the Elm email client (Elm 2.5.5 and earlier). The root cause is a buffer overflow when handling very long Message-ID headers, allowing remote attackers to potentially execute arbitrary code. Mandrake/MKSA advisory MDKSA-2001:067 notes that the overflow could overwr...

CVE-2001-1175

CVE-2001-1175 : In vipw from the util-linux package, before version 2.10, editing /etc/shadow could leave the file world-readable in some cases, enabling local users to more easily perform brute-force password guessing. Supported details in connected docs show Red Hat advisories (RHSA-2001:95, 13...

CVE-2001-1176

CVE-2001-1176 describes a format-string vulnerability in Check Point VPN-1/FireWall-1 4.1. The issue allows a remote authenticated firewall administrator to execute arbitrary code via format strings in the control connection. Exploitation details are not provided in the connected documents; no ex...

CVE-2001-1193

The CVE-2001-1193 issue affects EFTP, specifically version 2.0.8.346, where the CWD (change working directory) command does not properly validate input, allowing authenticated local users to perform a directory traversal and read arbitrary directories/files on the server. This is a confirmed vuln...

CVE-2001-1199

Agora CGI Cross Site Scripting (CVE-2001-1199) affects Agora versions 3.0a–4.0g due to improper input validation in the cart_id parameter when debug mode is on, enabling remote attackers to execute JavaScript in other clients. The vulnerability is documented in multiple sources (e.g., OpenVAS des...

CVE-2001-1201

CVE-2001-1201 : A buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file. Affected: wmcube-gdk component of WMCube/GDK 0.98. Root cause: unbounded input in object description handling leads to overflow. Impact: ...

CVE-2001-1235

CVE-2001-1235 affects PSlash Web Portal (PHP script 0.7 and earlier). Affected component: index.php; vulnerability arises when an HTTP request modifies the includedir variable, allowing a remote attacker to include remote files and execute arbitrary code on the server. Documented impact is remote...

CVE-2001-1237

CVE-2001-1237 affects Phormation PHP script versions 0.9.1 and earlier. The issue is a remote file inclusion flaw: an HTTP request that modifies the phormationdir variable can cause the application to include files from remote Web sites, enabling remote attackers to execute arbitrary code. This y...

CVE-2001-1277

The CVE-2001-1277 issue affects the makewhatis component of the man package prior to version 1.5i2. A local attacker belonging to the group man can cause arbitrary files to be overwritten by crafting a man page name containing shell metacharacters, exploiting insufficient validation during proces...

CVE-2001-1295

CVE-2001-1295 is a directory traversal vulnerability in Cerberus FTP Server 1.5 and earlier. The issue allows remote attackers to read arbitrary files by using a .. (dot dot) in the CD command. The available sources confirm the affected software and the traversal nature but do not provide exploit...

CVE-2001-1322

The CVE-2001-1322 issue concerns xinetd up to version 2.1.8 (and earlier) running with a default umask of 0, allowing local users to read or modify files created by processes started by xinetd that don’t set a safe umask. Public sources in the connected docs identify this as a local-privilege ris...

CVE-2001-1119

cda in xmcd 3.0.2 and 2.6 in SuSE Linux allows local users to overwrite arbitrary files via a symlink attack...

CVE-2001-0770

CVE-2001-0770 affects GuildFTPd Server 0.97, with a buffer overflow in the processing of long SITE commands. This allows a remote attacker to potentially execute arbitrary code or crash the service. OpenVAS/Nessus entries corroborate the denial-of-service risk and potential code execution, but no...

CVE-2001-1053

AdLogin.pm in AdCycle 1.15 and earlier allows remote attackers to bypass authentication and gain privileges by injecting SQL code in the $password argument. Affected component: AdLogin.pm in AdCycle. Impact: authentication bypass and privileges escalation (confidentiality, integrity, and availabi...

CVE-2001-0770

Buffer overflow in GuildFTPd Server 0.97 allows remote attacker to execute arbitrary code via a long SITE command...

CVE-2001-1227

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

CVE-2001-1089

Summary of CVE-2001-1089: The vulnerable component is libnss-pgsql in the nss-pgsql package (version 0.9.0 and earlier). The issue allows remote attackers to execute arbitrary SQL queries by injecting SQL code into an HTTP request, indicating a server-side input handling flaw that can affect conf...

CVE-2001-0940

Buffer overflow in the GUI authentication code of Check Point VPN-1/FireWall-1 Management Server 4.0 and 4.1 allows remote attackers to execute arbitrary code via a long user name...

CVE-2001-1160

CVE-2001-1160 affects Microburst Technologies uDirectory 2.0 and earlier. The vulnerability enables remote attackers to execute arbitrary commands by supplying shell metacharacters in the category_file field. No remediation details are provided in the supplied documents. The connected EUVD record...