Browse CVE records published in June 2001, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 153 matching CVEs · Page 1 of 4.
One-Time Passwords In Everything (a.k.a OPIE) 2.32 and 2.4 allows remote attackers to determine the existence of user accounts by printing random passphrases if the user account does not exist and static passphrases if the user account does exist.
Published Jun 21, 2005 · Updated Aug 8, 2024
ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged.
Published Jun 21, 2005 · Updated Aug 8, 2024
Unknown vulnerability in the file system protection subsystem in HP Secure OS Software for Linux 1.0 allows additional user privileges on some files beyond what is specified in the file system protection rules, which allows local users to conduct unauthorized operations on restricted files.
Published Jun 21, 2005 · Updated Aug 8, 2024
Java Runtime Environment (JRE) and SDK 1.2 through 1.3.0_04 allows untrusted applets to access the system clipboard.
Published Jun 21, 2005 · Updated Aug 8, 2024
Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack.
Published Jun 21, 2005 · Updated Aug 8, 2024
Alcatel ADSL modems allow remote attackers to access the Trivial File Transfer Protocol (TFTP) to modify firmware and configuration via a bounce attack from a system on the local area network (LAN) side, which is allowed to access TFTP without authentication.
Published Jun 21, 2005 · Updated Aug 8, 2024
Buffer overflow in mod_bf 0.2 allows local users to execute arbitrary commands via a long script.
Published Jun 21, 2005 · Updated Aug 8, 2024
SQL injection vulnerability in bb_memberlist.php for phpBB 1.4.2 allows remote attackers to execute arbitrary SQL queries via the $sortby variable.
Published Jun 21, 2005 · Updated Aug 8, 2024
network_query.php in Network Query Tool 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the target parameter.
Published Jun 21, 2005 · Updated Aug 8, 2024
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images.
Published Jun 21, 2005 · Updated Aug 8, 2024
tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets.
Published Jun 21, 2005 · Updated Aug 8, 2024
webcart.cgi in Mountain Network Systems WebCart 8.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEXTPAGE parameter.
Published Jun 21, 2005 · Updated Aug 8, 2024
Mozilla 0.9.6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images.
Published Jun 21, 2005 · Updated Aug 8, 2024
Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Published Jun 21, 2005 · Updated Aug 8, 2024
Lotus Notes R5 Client 4.6 allows remote attackers to execute arbitrary commands via a Lotus Notes object with code in an event, which is automatically executed when the user processes the e-mail message.
Published Jun 21, 2005 · Updated Aug 8, 2024
The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via commands with large numbers of wildcard and other special characters, as demonstrated using an ls command with multiple (1) "*/..", (2) "*/.*", or (3) ".*./*?/" sequences in the argument.
Published Jun 21, 2005 · Updated Aug 8, 2024
Check Point VPN-1 4.1SP4 using SecuRemote returns different error messages for valid and invalid users, with prompts that vary depending on the authentication method being used, which makes it easier for remote attackers to conduct brute force attacks.
Published Jun 21, 2005 · Updated Aug 8, 2024
popauth utility in Qualcomm Qpopper 4.0 and earlier allows local users to overwrite arbitrary files and execute commands as the pop user via a symlink attack on the -trace file option.
Published Jun 21, 2005 · Updated Aug 8, 2024
The finger daemon (in.fingerd) in Sun Solaris 2.5 through 8 and SunOS 5.5 through 5.8 allows remote attackers to list all accounts on a host by typing finger 'a b c d e f g h'@host.
Published Jun 21, 2005 · Updated Aug 8, 2024
Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows remote attackers to gain privileges.
Published Jun 21, 2005 · Updated Aug 8, 2024
Open Projects Network Internet Relay Chat (IRC) daemon u2.10.05.18 does not perform a double-reverse DNS lookup, which allows remote attackers to spoof any valid hostname on the Internet. NOTE: a followup post suggests that this is not an issue in the daemon.
Published Jun 21, 2005 · Updated Aug 8, 2024
script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.
Published Jun 21, 2005 · Updated Aug 8, 2024
smcboot in Sun SMC (Sun Management Center) 2.0 in Solaris 8 allows local users to delete arbitrary files via a symlink attack on /tmp/smc$SMC_PORT.
Published Jun 21, 2005 · Updated Aug 8, 2024
Opera 5.11 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images.
Published Jun 21, 2005 · Updated Aug 8, 2024
Buffer overflow in xlock in UnixWare 7.1.0 and 7.1.1 and Open Unix 8.0.0 allows local users to execute arbitrary code.
Published Jun 21, 2005 · Updated Aug 8, 2024
Vulnerability in autodns.pl for AutoDNS before 0.0.4 related to domain names that are not fully qualified.
Published Jun 11, 2002 · Updated Aug 8, 2024
The default configuration of sudo in Engarde Secure Linux 1.0.1 allows any user in the admin group to run certain commands that could be leveraged to gain full root access.
Published Jun 25, 2002 · Updated Aug 8, 2024
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
Published Jun 11, 2002 · Updated Aug 8, 2024
Vulnerability in IntraGnat before 1.4.
Published Jun 11, 2002 · Updated Aug 8, 2024
ghostscript before 6.51 allows local users to read and write arbitrary files as the 'lp' user via the file operator, even with -dSAFER enabled.
Published Jun 5, 2002 · Updated Aug 8, 2024
pSlash PHP script 0.7 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable.
Published Jun 25, 2002 · Updated Aug 8, 2024
netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive information.
Published Jun 11, 2002 · Updated Aug 8, 2024
dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.
Published Jun 18, 2003 · Updated Aug 8, 2024
Multiple vulnerabilities in phpMyChat before 0.14.5 exist in (1) input.php3, (2) handle_inputH.php3, or (3) index.lib.php3 with unknown consequences, possibly related to user spoofing or improperly initialized variables.
Published Jun 11, 2002 · Updated Aug 8, 2024
Vulnerability in the server for nPULSE before 0.53p4.
Published Jun 11, 2002 · Updated Aug 8, 2024
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Published Jun 25, 2002 · Updated Aug 8, 2024
Vulnerability in iPlanet Web Server 4 included in Virtualvault Operating System (VVOS) 4.0 running HP-UX 11.04 could allow attackers to corrupt data.
Published Jun 11, 2002 · Updated Aug 8, 2024
Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.
Published Jun 11, 2002 · Updated Aug 8, 2024
Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.
Published Jun 11, 2002 · Updated Aug 8, 2024
Vulnerability in phpWebSite before 0.7.9 related to running multiple instances in the same domain, which may allow attackers to gain administrative privileges.
Published Jun 11, 2002 · Updated Aug 8, 2024
Vulnerabilities in phpMyChat before 0.14.4 allow local and possibly remote attackers to gain privileges by specifying an alternate library file in the L (localization) parameter.
Published Jun 11, 2002 · Updated Aug 8, 2024
Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned.
Published Jun 11, 2002 · Updated Aug 8, 2024
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Published Jun 11, 2002 · Updated Aug 8, 2024
Zorbat Zorbstats PHP script before 0.9 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
Published Jun 25, 2002 · Updated Aug 8, 2024
Directory traversal vulnerability in Cerberus FTP Server 1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the CD command.
Published Jun 25, 2002 · Updated Aug 8, 2024
NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.
Published Jun 11, 2002 · Updated Aug 8, 2024
Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to (1) the -del command or (2) the -lookup command.
Published Jun 11, 2002 · Updated Aug 8, 2024
Directory traversal vulnerability in Doug Neal's HTTPD Daemon (DNHTTPD) before 0.4.1 allows remote attackers to view arbitrary files via a .. (dot dot) attack using the dot hex code '%2E'.
Published Jun 25, 2002 · Updated Aug 8, 2024
PHP remote file inclusion vulnerability in Actionpoll PHP script before 1.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter.
Published Jun 25, 2002 · Updated Aug 8, 2024
bctool in Jetico BestCrypt 0.7 and earlier trusts the user-supplied PATH to find and execute an fsck utility program, which allows local users to gain privileges by modifying the PATH to point to a Trojan horse program.
Published Jun 25, 2002 · Updated Aug 8, 2024
