CVE-2001-1354

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-135510.0Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, CVE-2001-135610.0NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote a CVE-2001-13577.5Multiple vulnerabilities in phpMyChat before 0.14.5 exist in (1) input.php3, (2) handle_inputH.php3, or (3) index.lib.php3 with unknown cons CVE-2001-13587.2Vulnerabilities in phpMyChat before 0.14.4 allow local and possibly remote attackers to gain privileges by specifying an alternate library f CVE-2001-135910.0Volution clients 1.0.7 and earlier attempt to contact the computer creation daemon (CCD) when an LDAP authentication failure occurs, which a CVE-2001-13607.2Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned.CVE-2001-13617.5Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto lin CVE-2001-13627.5Vulnerability in the server for nPULSE before 0.53p4.CVE-2001-136310.0Vulnerability in phpWebSite before 0.7.9 related to running multiple instances in the same domain, which may allow attackers to gain adminis CVE-2001-13647.5Vulnerability in autodns.pl for AutoDNS before 0.0.4 related to domain names that are not fully qualified.CVE-2001-13657.5Vulnerability in IntraGnat before 1.4.CVE-2001-13665.0netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive informatio