CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2001 (CVSS score >= 7)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2001-1455 Bypass 2001-08-24 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Netegrity SiteMinder 3.6 through 4.5.1 allows remote attackers to bypass filtering via URLs containing Unicode characters.
2 CVE-2001-1444 2001-08-27 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption options sent from the server, which allows remote attackers to downgrade authentication and encryption mechanisms via a man-in-the-middle attack.
3 CVE-2001-1389 DoS Exec Code Overflow 2001-08-29 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
Multiple vulnerabilities in xinetd 2.3.0 and earlier, and additional variants until 2.3.3, may allow remote attackers to cause a denial of service or execute arbitrary code, primarily via buffer overflows or improper NULL termination.
4 CVE-2001-1379 Sql Bypass 2001-08-29 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
The PostgreSQL authentication modules (1) mod_auth_pgsql 0.9.5, and (2) mod_auth_pgsql_sys 0.9.4, allow remote attackers to bypass authentication and execute arbitrary SQL via a SQL injection attack on the user name.
5 CVE-2001-1356 2001-08-04 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.
6 CVE-2001-1292 DoS Exec Code 2001-08-13 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password.
7 CVE-2001-1262 Bypass 2001-08-07 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Avaya Argent Office 2.1 compares a user-provided SNMP community string with the correct string only up to the length of the user-provided string, which allows remote attackers to bypass authentication with a 0 length community string.
8 CVE-2001-1260 +Priv 2001-08-07 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Avaya Argent Office uses weak encryption (trivial encoding) for passwords, which allows remote attackers to gain administrator privileges by sniffing and decrypting the sniffing the passwords during a system reboot.
9 CVE-2001-1157 Bypass 2001-08-12 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode.
10 CVE-2001-1155 Bypass 2001-08-23 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing.
11 CVE-2001-1153 DoS Exec Code 2001-08-28 2008-09-10
7.2
None Local Low Not required Complete Complete Complete
lpsystem in OpenUnix 8.0.0 allows local users to cause a denial of service and possibly execute arbitrary code via a long command line argument.
12 CVE-2001-1135 2001-08-14 2017-12-19
7.5
None Remote Low Not required Partial Partial Partial
ZyXEL Prestige 642R and 642R-I routers do not filter the routers' Telnet and FTP ports on the external WAN interface from inside access, allowing someone on an internal computer to reconfigure the router, if the password is known.
13 CVE-2001-1130 Exec Code 2001-08-02 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file.
14 CVE-2001-1118 Exec Code 2001-08-02 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.
15 CVE-2001-1114 Exec Code 2001-08-13 2017-12-19
7.5
None Remote Low Not required Partial Partial Partial
book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the "current" parameter.
16 CVE-2001-1113 Exec Code Overflow 2001-08-13 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories with long names, then running the ls -R (recursive) command.
17 CVE-2001-1091 +Priv 2001-08-23 2017-12-19
7.2
None Local Low Not required Complete Complete Complete
The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable.
18 CVE-2001-1069 2001-08-31 2017-10-10
7.2
None Local Low Not required Complete Complete Complete
libCoolType library as used in Adobe Acrobat (acroread) on Linux creates the AdobeFnt.lst file with world-writable permissions, which allows local users to modify the file and possibly modify acroread's behavior.
19 CVE-2001-1067 DoS Exec Code Overflow 2001-08-31 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in AOLserver 3.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via an HTTP request with a long Authorization header.
20 CVE-2001-1063 Overflow +Priv 2001-08-31 2017-10-10
7.2
None Local Low Not required Complete Complete Complete
Buffer overflow in uidadmin in Caldera Open Unix 8.0.0 and UnixWare 7 allows local users to gain root privileges via a long -S (scheme) command line argument.
21 CVE-2001-1062 Exec Code Overflow 2001-08-31 2008-09-10
7.2
None Local Low Not required Complete Complete Complete
Buffer overflow in mana in OpenServer 5.0.6a and earlier allows local users to execute arbitrary code.
22 CVE-2001-1061 2001-08-31 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Vulnerability in lsmcode in unknown versions of AIX, possibly related to a usage error.
23 CVE-2001-1039 2001-08-31 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
The JetAdmin web interface for HP JetDirect does not set a password for the telnet interface when the admin password is changed, which allows remote attackers to gain access to the printer.
24 CVE-2001-1036 +Priv 2001-08-31 2017-10-10
7.2
None Local Low Not required Complete Complete Complete
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.
25 CVE-2001-1027 Exec Code Overflow 2001-08-31 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in WindowMaker (aka wmaker) 0.64 and earlier allows remote attackers to execute arbitrary code via a long window title.
26 CVE-2001-1025 2001-08-31 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" variable when calling any scripts that do not already define the prefix variable (e.g., by including mainfile.php), such as article.php.
27 CVE-2001-1009 264 +Priv 2001-08-31 2011-02-16
10.0
None Remote Low Not required Complete Complete Complete
Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request.
28 CVE-2001-1008 2001-08-31 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities via an applet that has been signed by an expired certificate.
29 CVE-2001-1005 +Priv 2001-08-31 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges.
30 CVE-2001-1002 Exec Code +Priv 2001-08-31 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
The default configuration of the DVI print filter (dvips) in Red Hat Linux 7.0 and earlier does not run dvips in secure mode when dvips is executed by lpd, which could allow remote attackers to gain privileges by printing a DVI file that contains malicious commands.
31 CVE-2001-0995 2001-08-31 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
PHProjekt before 2.4a allows remote attackers to perform actions as other PHProjekt users by modifying the ID number in an HTTP request to PHProjekt CGI programs.
32 CVE-2001-0981 2001-08-31 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
HP CIFS/9000 Server (SAMBA) A.01.07 and earlier with the "unix password sync" option enabled calls the passwd program without specifying the username of the user making the request, which could cause the server to change the password of a different user.
33 CVE-2001-0976 +Priv 2001-08-31 2008-09-05
7.2
None Local Low Not required Complete Complete Complete
Vulnerability in HP Process Resource Manager (PRM) C.01.08.2 and earlier, as used by HP-UX Workload Manager (WLM), allows local users to gain root privileges via modified libraries or environment variables.
34 CVE-2001-0972 +Priv 2001-08-31 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculating the value of the admin cookie (UserID 1), i.e. "0888888."
35 CVE-2001-0970 XSS 2001-08-31 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in TDForum 1.2 CGI script (tdforum12.cgi) allows remote attackers to execute arbitrary script on other clients via a forum message that contains the script.
36 CVE-2001-0969 2001-08-31 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
ipfw in FreeBSD does not properly handle the use of "me" in its rules when point to point interfaces are used, which causes ipfw to allow connections from arbitrary remote hosts.
37 CVE-2001-0968 +Priv 2001-08-31 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Knox Arkeia server 4.2, and possibly other versions, installs its root user with a null password by default, which allows local and remote users to gain privileges.
38 CVE-2001-0967 2001-08-31 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an attacker to conduct brute force password guessing.
39 CVE-2001-0966 Dir. Trav. 2001-08-31 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in Nudester 1.10 and earlier allows remote attackers to read or write arbitrary files via a .. (dot dot) in the CD (CWD) command.
40 CVE-2001-0943 Exec Code 2001-08-31 2008-09-05
7.2
None Local Low Not required Complete Complete Complete
dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands, which allows local users to execute arbitrary code by modifying the PATH to point to Trojan Horse programs.
41 CVE-2001-0634 DoS +Priv 2001-08-22 2017-10-10
7.2
None Local Low Not required Complete Complete Complete
Sun Chili!Soft ASP has weak permissions on various configuration files, which allows a local attacker to gain additional privileges and create a denial of service.
42 CVE-2001-0632 +Priv 2001-08-22 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Sun Chili!Soft 3.5.2 on Linux and 3.6 on AIX creates a default admin username and password in the default installation, which can allow a remote attacker to gain additional privileges.
43 CVE-2001-0629 119 Overflow +Priv 2001-08-14 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
HP Event Correlation Service (ecsd) as included with OpenView Network Node Manager 6.1 allows a remote attacker to gain addition privileges via a buffer overflow attack in the '-restore_config' command line parameter.
44 CVE-2001-0628 2001-08-14 2017-10-10
7.2
None Local Low Not required Complete Complete Complete
Microsoft Word 2000 does not check AutoRecovery (.asd) files for macros, which allows a local attacker to execute arbitrary macros with the user ID of the Word user.
45 CVE-2001-0626 2001-08-22 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
O'Reilly Website Professional 2.5.4 and earlier allows remote attackers to determine the physical path to the root directory via a URL request containing a ":" character.
46 CVE-2001-0625 2001-08-22 2021-04-09
7.2
None Local Low Not required Complete Complete Complete
ftpdownload in Computer Associates InoculateIT 6.0 allows a local attacker to overwrite arbitrary files via a symlink attack on /tmp/ftpdownload.log .
47 CVE-2001-0622 +Priv 2001-08-14 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
The web management service on Cisco Content Service series 11000 switches (CSS) before WebNS 4.01B29s or WebNS 4.10B17s allows a remote attacker to gain additional privileges by directly requesting the web management URL instead of navigating through the interface.
48 CVE-2001-0621 2001-08-14 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
The FTP server on Cisco Content Service 11000 series switches (CSS) before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands.
49 CVE-2001-0619 2001-08-02 2008-09-10
7.5
None Remote Low Not required Partial Partial Partial
The Lucent Closed Network protocol can allow remote attackers to join Closed Network networks which they do not have access to. The 'Network Name' or SSID, which is used as a shared secret to join the network, is transmitted in the clear.
50 CVE-2001-0618 2001-08-02 2017-12-19
7.5
None Remote Low Not required Partial Partial Partial
Orinoco RG-1000 wireless Residential Gateway uses the last 5 digits of the 'Network Name' or SSID as the default Wired Equivalent Privacy (WEP) encryption key. Since the SSID occurs in the clear during communications, a remote attacker could determine the WEP key and decrypt RG-1000 traffic.
Total number of vulnerabilities : 89   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.