CVE-2001-0905

The provided sources confirm CVE-2001-0905: a race condition in the signal handling of procmail versions 3.20 and earlier when running setuid. This vulnerability allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already ...

CVE-2001-0896

The CVE-2001-0896 entry concerns Inetd on OpenServer 5.0.5. A remote attacker can trigger a denial of service (crash) by issuing a port scan (e.g., with nmap -PO). The connected records (CVE and NVD entries) confirm the affected product and the crash-inducing behavior but do not provide concrete ...

CVE-2001-1235

CVE-2001-1235 affects PSlash Web Portal (PHP script 0.7 and earlier). Affected component: index.php; vulnerability arises when an HTTP request modifies the includedir variable, allowing a remote attacker to include remote files and execute arbitrary code on the server. Documented impact is remote...

CVE-2001-1130

The CVE-2001-1130 issue involves SuSE Linux versions 6.0–7.2 using the sdbsearch.cgi CGI. The vulnerability allows remote command execution by uploading a keylist.txt containing filenames with shell metacharacters and then triggering a search that uses the HTTP_REFERER to access the directory hol...

CVE-2001-1099

The CVE-2001-1099 entry describes a vulnerability in Norton AntiVirus for Microsoft Exchange 2000 (2.x) where the default configuration can leak the recipient’s INBOX file path. An attacker who sends an email with a malicious attachment can trigger a rejection notice that reveals the path, enabli...

CVE-2001-1277

The CVE-2001-1277 issue affects the makewhatis component of the man package prior to version 1.5i2. A local attacker belonging to the group man can cause arbitrary files to be overwritten by crafting a man page name containing shell metacharacters, exploiting insufficient validation during proces...

CVE-2001-0920

The CVE-2001-0920 entry concerns a format string vulnerability in the auto nice daemon (AND) version 1.0.4 and earlier that lets a local user potentially execute arbitrary code by supplying a process name containing a format string. Affected component: the daemon’s handling of process names. Unde...

CVE-2001-1185

CVE-2001-1185 affects FreeBSD 4.4. Some AIO operations may be delayed until after an execve call, allowing a local user to overwrite memory of the new process and gain privileges. The provided documents do not include exploitation details or remediation/fix information.

CVE-2001-1132

Vulnerability details (CVE-2001-1132) : Mailman 2.0.x prior to 2.0.6 is vulnerable. During authentication, an empty site or list password is not properly handled when calling the crypt function, enabling remote attackers to gain access to list administrative pages. This is limited to the affected...

CVE-2001-0900

Directory traversal vulnerability in modules.php in Gallery before 1.2.3 allows remote attackers to read arbitrary files via a .. dot dot in the include parameter...

CVE-2001-1299

Affected software: Zorbat Zorbstats PHP script prior to 0.9. The issue is remote file inclusion via an HTTP request that sets the includedir variable, enabling attackers to include arbitrary files from remote sites. Root cause appears to be insufficient validation of includedir. Impact per source...

CVE-2001-1155

TCP Wrappers tcpwrappers in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing...

CVE-2001-1030

Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists ACLs when the httpdaccelhost and httpaccelwithproxy off settings are used, which allows attackers to bypass the ACLs and conduct unauthorized activities such as port scanning...

CVE-2001-1252

Network Associates PGP Keyserver 7.0 allows remote attackers to bypass authentication and access the administrative web interface via URLs that directly access cgi-bin instead of keyserver/cgi-bin for the programs 1 console, 2 cs, 3 multiconfig and 4 directory...

CVE-2001-1345

bctool in Jetico BestCrypt 0.7 and earlier trusts the user-supplied PATH to find and execute an fsck utility program, which allows local users to gain privileges by modifying the PATH to point to a Trojan horse program...

CVE-2001-0886

Buffer overflow in glob function of glibc allows attackers to cause a denial of service crash and possibly execute arbitrary code via a glob pattern that ends in a brace "" character...

CVE-2001-1084

Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrun, or .thtml file that does not exist, which causes the Javascript to be inserted into an error message...

CVE-2001-0895

Multiple Cisco networking products allow remote attackers to cause a denial of service on the local network via a series of ARP packets sent to the router's interface that contains a different MAC address for the router, which eventually causes the router to overwrite the MAC address in its ARP...

CVE-2001-0770

Buffer overflow in GuildFTPd Server 0.97 allows remote attacker to execute arbitrary code via a long SITE command...

CVE-2001-1118

A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL...