CVE-2001-1162

Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file...

CVE-2001-1166

linprocfs on FreeBSD 4.3 and earlier does not properly restrict access to kernel memory, which allows one process with debugging rights on a privileged process to read restricted memory from that process...

CVE-2001-1174

Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header...

CVE-2001-1175

vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing...

CVE-2001-1201

Buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file...

CVE-2001-1203

Format string vulnerability in gpm-root in gpm 1.17.8 through 1.17.18 allows local users to gain root privileges...

CVE-2001-1234

Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable...

CVE-2001-1236

myphpPagetool PHP script 0.4.3-1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable...

CVE-2001-1237

Phormation PHP script 0.9.1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the phormationdir variable...

CVE-2001-1276

ispell before 3.1.20 allows local users to overwrite files of other users via a symlink attack on a temporary file...

CVE-2001-1299

Zorbat Zorbstats PHP script before 0.9 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable...

CVE-2001-1342

Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service GPF via an HTTP request for a URI that contains a large number of / slash or other characters, which causes certain functions to dereference a null pointer...

CVE-2001-1180

FreeBSD 4.3 does not properly clear shared signal handlers when executing a process, which allows local users to gain privileges by calling rfork with a shared signal handler, having the child process execute a setuid program, and sending a signal to the child...

CVE-2001-1183

Cisco IOS PPTP vulnerability (CVE-2001-1183) affects PPTP implementation in Cisco IOS 12.1 and 12.2. A crafted/malformed PPTP packet can crash the router when PPTP is enabled, causing a denial of service. The issue can be triggered by sending to the PPTP control port (port 1723/tcp). Exploitation...

CVE-2001-0917

The CVE-2001-0917 entry concerns Apache Tomcat 4.0.1. The provided materials confirm an information-disclosure vulnerability where remote attackers can reveal the full install path of Tomcat by requesting a long URL that ends with a .JSP extension. The issue is tied to path disclosure via crafted...

CVE-2001-1345

The CVE concerns bctool in Jetico BestCrypt 0.7 and earlier, which trusts a user-supplied PATH to locate and execute an fsck utility. This PATH manipulation allows local users to gain privileges by renaming or placing a Trojan horse program earlier in PATH. Affected component: bctool within Jetic...

CVE-2001-1030

CVE-2001-1030 affects the Squid proxy server when used in HTTP accelerator mode. The vulnerability exists if httpd_accel_host and http_accel_with_proxy are off, enabling an attacker to bypass ACLs and perform unauthorized activities such as port scanning. Concrete details from connected sources i...

CVE-2001-1215

PFinger 0.7.5–0.7.7 is affected by a format-string vulnerability in .plan files that allows remote code execution. The issue arises from format specifiers used in a .plan, enabling an attacker to execute arbitrary code on affected systems. Affected component: PFinger (versions 0.7.5–0.7.7). Root ...

CVE-2001-0920

Format string vulnerability in auto nice daemon AND 1.0.4 and earlier allows a local user to possibly execute arbitrary code via a process name containing a format string...

CVE-2001-1118

CVE-2001-1118 affects Roxen Web platform (Roxen 2.0 prior to 2.0.92 and Roxen 2.1 prior to 2.1.264). The issue is a failure to properly decode UTF-8, Mac, and ISO-2202 encoded URLs, enabling a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL. Affected compo...