CVE-2001-1464

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/403307Exploit, Third Party Advisory, US Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/7928
http://www.kb.cert.org/vuls/id/403307Exploit, Third Party Advisory, US Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/7928

Timeline

Published: Jan 10, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-14654.6SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filter CVE-2001-14667.5Buffer overflow in VanDyke SecureCRT before 3.4.2, when using the SSH-1 protocol, allows remote attackers to execute arbitrary code via a lo CVE-2001-14677.5mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the CVE-2001-14687.5PHP remote file inclusion vulnerability in checklogin.php in phpSecurePages 0.24 and earlier allows remote attackers to execute arbitrary PH CVE-2001-14695.0The RC4 stream cipher as used by SSH1 allows remote attackers to modify messages without detection by XORing the original message's cyclic r CVE-2001-14705.0The IDEA cipher as implemented by SSH1 does not protect the final block of a message against modification, which allows remote attackers to CVE-2001-14718.8prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which pr CVE-2001-14724.6SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and ga CVE-2001-14737.5The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by c CVE-2001-14745.0SSH before 2.0 disables host key checking when connecting to the localhost, which allows remote attackers to silently redirect connections t CVE-2001-14757.5SSH before 2.0, when using RC4 and password authentication, allows remote attackers to replay messages until a new server key (VK) is genera CVE-2001-14767.5SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portions