CVE-2001-1286

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Ipswitch IMail 7.04 and earlier stores a user's session ID in a URL, which could allow remote attackers to hijack sessions by obtaining the URL, e.g. via an HTML email that causes the Referrer to be sent to a URL under the attacker's control.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Oct 12, 2001
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2001

CVE-2001-12877.5Buffer overflow in Web Calendar in Ipswitch IMail 7.04 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET reqCVE-2001-12882.1Windows 2000 and Windows NT allows local users to cause a denial of service (reboot) by executing a command at the command prompt and pressiCVE-2001-12895.0Quake 3 arena 1.29f and 1.29g allows remote attackers to cause a denial of service (crash) via a malformed connection packet that begins witCVE-2001-12905.0admin.cgi in Active Classifieds Free Edition 1.0, and possibly commercial versions, allows remote attackers to modify the configuration, gaiCVE-2001-12919.8The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect usernaCVE-2001-12927.5Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password.CVE-2001-12935.0Buffer overflow in web server of 3com HomeConnect Cable Modem External with USB (#3CR29223) allows remote attackers to cause a denial of serCVE-2001-12945.0Buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier allows remote attackers to cause a denial of service (crash) in the Webmail interfCVE-2001-12955.0Directory traversal vulnerability in Cerberus FTP Server 1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) CVE-2001-12965.0More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includeCVE-2001-12977.5PHP remote file inclusion vulnerability in Actionpoll PHP script before 1.1.2 allows remote attackers to execute arbitrary PHP code via a URCVE-2001-12985.0Webodex PHP script 1.0 and earlier allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets th
CVE-2001-1286: High severity, CVSS 7.5 | Vulnix