CVE Vulnerability Database
Search and browse 394,629 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
1,676 records from 2001Clear filters
- CVE-2001-1200High 7.2Dec 17, 2001Microsoft Windows XP allows local users to bypass a locked screen and run certain programs that are associated with Hot Keys.
- CVE-2001-1199High 7.5Dec 17, 2001Cross-site scripting vulnerability in agora.cgi for Agora 3.0a through 4.0g, when debug mode is enabled, allows remote attackers to execute Javascript on other clients via the cart_id parameter.
- CVE-2001-1196Critical 10.0Dec 17, 2001Directory traversal vulnerability in edit_action.cgi of Webmin Directory 0.91 allows attackers to gain privileges via a '..' (dot dot) in the argument.
- CVE-2001-1214High 7.5Dec 15, 2001manual.php in Marcus S. Xenakis Unix Manual 1.0 allows remote attackers to execute arbitrary code via a URL that contains shell metacharacters.
- CVE-2001-1198High 7.2Dec 15, 2001RLPDaemon in HP-UX 10.20 and 11.0 allows local users to overwrite arbitrary files and gain privileges by specifying the target file in the -L option.
- CVE-2001-1195High 7.5Dec 15, 2001Novell Groupwise 5.5 and 6.0 Servlet Gateway is installed with a default username and password for the servlet manager, which allows remote attackers to gain privileges.
- CVE-2001-1197Medium 4.6Dec 14, 2001klprfax_filter in KDE2 KDEUtils allows local users to overwrite arbitrary files via a symlink attack on the klprfax.filter temporary file.
- CVE-2001-1194Medium 5.0Dec 14, 2001Zyxel Prestige 681 and 1600 SDSL Routers allow remote attackers to cause a denial of service via malformed packets with (1) an IP length less than actual packet size, or (2) fragmented packets whose size exceeds 64 kilobytes after reassembly.
- CVE-2001-0727High 7.5Dec 14, 2001Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability."
- CVE-2001-1193Medium 5.0Dec 13, 2001Directory traversal vulnerability in EFTP 2.0.8.346 allows local users to read directories via a ... (modified dot dot) in the CWD command.
- CVE-2001-1192High 7.5Dec 13, 2001Citrix Independent Computing Architecture (ICA) Client for Windows 6.1 allows remote malicious web sites to execute arbitrary code via a .ICA file, which is downloaded and automatically executed by the client.
- CVE-2001-1189Medium 4.6Dec 13, 2001IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script.
- CVE-2001-0874Medium 5.0Dec 13, 2001Internet Explorer 5.5 and 6.0 allow remote attackers to read certain files via HTML that passes information from a frame in the client's domain to a frame in the web site's domain, a variant of the "Frame Domain Verification" vulnerability.
- CVE-2001-1190Medium 4.6Dec 12, 2001The default PAM files included with passwd in Mandrake Linux 8.1 do not support MD5 passwords, which could result in a lower level of password security than intended.
- CVE-2001-0797Critical 10.0Dec 12, 2001Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
- CVE-2001-1191Medium 5.0Dec 11, 2001WebSeal in IBM Tivoli SecureWay Policy Director 3.8 allows remote attackers to cause a denial of service (crash) via a URL that ends in %2e.
- CVE-2001-1188High 7.5Dec 11, 2001mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier allows remote attackers to send SPAM e-mail through remote servers by modifying the sendto, email, server, subject, and resulturl hidden form fields.
- CVE-2001-1187High 7.5Dec 11, 2001csvform.pl 0.1 allows remote attackers to execute arbitrary commands via metacharacters in the file parameter.
- CVE-2001-1186Medium 5.0Dec 11, 2001Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents IIS from timing out the connection.
- CVE-2001-0890Low 2.1Dec 11, 2001Certain backend drivers in the SANE library 1.0.3 and earlier, as used in frontend software such as XSane, allows local users to modify files via a symlink attack on temporary files.
- CVE-2001-1185Medium 6.2Dec 10, 2001Some AIO operations in FreeBSD 4.4 may be delayed until after a call to execve, which could allow a local user to overwrite memory of the new process and gain privileges.
- CVE-2001-1184Medium 5.0Dec 8, 2001wrshdsp.exe in Denicomp Winsock RSHD/NT 2.21.00 and earlier allows remote attackers to cause a denial of service (CPU consumption) via (1) in 2.20.00 and earlier, an invalid port number such as a negative number, which causes a connection attempt to that port and all ports below 1024, and (2) in 2.21.00, a port number of 1024.
- CVE-2001-0953Critical 10.0Dec 8, 2001Kebi WebMail allows remote attackers to access the administrator menu and gain privileges via the /a/ hidden directory, which is installed under the web document root.
- CVE-2001-0954Medium 5.0Dec 7, 2001Lotus Domino 5.0.5 and 5.0.8, and possibly other versions, allows remote attackers to cause a denial of service (block access to databases that have not been previously accessed) via a URL that includes the . (dot) directory.
- CVE-2001-0952Medium 5.0Dec 7, 2001THQ Volition Red Faction Game allows remote attackers to cause a denial of service (hang) of a client or server via packets to UDP port 7755.