CVE-2001-1118

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://download.roxen.com/2.0/patch/security-notice.html
http://www.securityfocus.com/archive/1/201476Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/201499
http://www.securityfocus.com/bid/3145Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6937
http://download.roxen.com/2.0/patch/security-notice.html
http://www.securityfocus.com/archive/1/201476Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/201499
http://www.securityfocus.com/bid/3145Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6937

Timeline

Published: Aug 2, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-11196.2cda in xmcd 3.0.2 and 2.6 in SuSE Linux allows local users to overwrite arbitrary files via a symlink attack.CVE-2001-11206.4Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary files, or (2) overwrite ColdFusi CVE-2001-11222.1Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running th CVE-2001-11237.2Vulnerability in Network Node Manager (NNM) 6.2 and earlier in HP OpenView allows a local user to execute arbitrary code, possibly via a buf CVE-2001-11245.0rpcbind in HP-UX 11.00, 11.04 and 11.11 allows remote attackers to cause a denial of service (core dump) via a malformed RPC portmap request CVE-2001-11259.8Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute CVE-2001-11265.0Symantec LiveUpdate 1.4 through 1.6, and possibly later versions, allows remote attackers to cause a denial of service (flood) via DNS spoof CVE-2001-11277.2Buffer overflow in Progress database 8.3D and 9.1C could allow a local user to execute arbitrary code via (1) _proapsv, (2) _mprosrv, (3) _m CVE-2001-11287.2Buffer overflow in Progress database 8.3D and 9.1C allows local users to execute arbitrary code via long entries in files that are specified CVE-2001-11297.2Format string vulnerabilities in (1) _probuild, (2) _dbutil, (3) _mprosrv, (4) _mprshut, (5) _proapsv, (6) _progres, (7) _proutil, (8) _rfut CVE-2001-11307.5Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains CVE-2001-11315.0Directory traversal vulnerability in WhitSoft Development SlimFTPd 2.2 allows an attacker to read arbitrary files and directories via a ...