CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Microsoft : Security Vulnerabilities Published In 2001 (Execute Code)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2001-1547 Exec Code 2001-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email attachments from forwarded messages, which could allow remote attackers to execute arbitrary code.
2 CVE-2001-0909 Exec Code Overflow 2001-11-21 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in helpctr.exe program in Microsoft Help Center for Windows XP allows remote attackers to execute arbitrary code via a long hcp: URL.
3 CVE-2001-0876 Exec Code Overflow 2001-12-20 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.
4 CVE-2001-0727 Exec Code 2001-12-14 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability."
5 CVE-2001-0719 Exec Code Overflow 2001-12-06 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via a malformed Advanced Streaming Format (ASF) file.
6 CVE-2001-0718 Exec Code Bypass 2001-10-30 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Vulnerability in (1) Microsoft Excel 2002 and earlier and (2) Microsoft PowerPoint 2002 and earlier allows attackers to bypass macro restrictions and execute arbitrary commands by modifying the data stream in the document.
7 CVE-2001-0667 Exec Code 2001-10-30 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix (SFU) 2.0, allows remote attackers to execute commands by spawning Telnet with a log file option on the command line and writing arbitrary code into an executable file which is later executed, aka a new variant of the Telnet Invocation vulnerability as described in CVE-2001-0150.
8 CVE-2001-0542 Exec Code Overflow 2001-12-20 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879.
9 CVE-2001-0541 Exec Code Overflow 2001-09-20 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft Windows Media Player 7.1 and earlier allows remote attackers to execute arbitrary commands via a malformed Windows Media Station (.NSC) file.
10 CVE-2001-0538 Exec Code 2001-08-14 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page.
11 CVE-2001-0500 Exec Code Overflow 2001-07-21 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
12 CVE-2001-0350 Exec Code 2001-07-21 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it, the second of two variants of this vulnerability.
13 CVE-2001-0349 Exec Code 2001-07-21 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it, the first of two variants of this vulnerability.
14 CVE-2001-0341 Exec Code Overflow 2001-07-21 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.
15 CVE-2001-0340 Exec Code 2001-07-21 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.
16 CVE-2001-0333 Exec Code Dir. Trav. 2001-06-27 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.
17 CVE-2001-0244 Exec Code Overflow 2001-06-27 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft Index Server 2.0 allows remote attackers to execute arbitrary commands via a long search parameter.
18 CVE-2001-0242 Exec Code Overflow 2001-06-27 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the ".ASX Buffer Overrun" vulnerability as discussed in MS:MS00-090.
19 CVE-2001-0153 Exec Code Overflow 2001-05-03 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in VB-TSQL debugger object (vbsdicli.exe) in Visual Studio 6.0 Enterprise Edition allows remote attackers to execute arbitrary commands.
20 CVE-2001-0150 Exec Code 2001-06-02 2008-09-05
5.1
 None Remote High Not required Partial Partial Partial
Internet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are specified by the web site, which could allow remote attackers to execute arbitrary commands if the IE client is using the Telnet client provided in Services for Unix (SFU) 2.0, which creates session transcripts.
21 CVE-2001-0148 Exec Code 2001-06-02 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
The WMP ActiveX Control in Windows Media Player 7 allows remote attackers to execute commands in Internet Explorer via javascript URLs, a variant of the "Frame Domain Verification" vulnerability.
22 CVE-2001-0147 Exec Code Overflow 2001-05-03 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Windows 2000 event viewer snap-in allows attackers to execute arbitrary commands via a malformed field that is improperly handled during the detailed view of event records.
23 CVE-2001-0145 Exec Code Overflow 2001-05-03 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in VCard handler in Outlook 2000 and 98, and Outlook Express 5.x, allows an attacker to execute arbitrary commands via a malformed vCard birthday field.
24 CVE-2001-0137 Exec Code 2001-03-12 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
Windows Media Player 7 allows remote attackers to execute malicious Java applets in Internet Explorer clients by enclosing the applet in a skin file named skin.wmz, then referencing that skin in the codebase parameter to an applet tag, aka the Windows Media Player Skins File Download" vulnerability.
25 CVE-2001-0045 Exec Code 2001-02-16 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
The default permissions for the RAS Administration key in Windows NT 4.0 allows local users to execute arbitrary commands by changing the value to point to a malicious DLL, aka one of the "Registry Permissions" vulnerabilities.
26 CVE-2001-0005 Exec Code Overflow 2001-02-12 2008-09-10
6.2
 Admin Local High Not required Complete Complete Complete
Buffer overflow in the parsing mechanism of the file loader in Microsoft PowerPoint 2000 allows attackers to execute arbitrary commands.
27 CVE-2000-1149 Exec Code Overflow 2001-01-09 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in RegAPI.DLL used by Windows NT 4.0 Terminal Server allows remote attackers to execute arbitrary commands via a long username, aka the "Terminal Server Login Buffer Overflow" vulnerability.
28 CVE-2000-1147 Exec Code Overflow 2001-01-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands via a long string to the "LANGUAGE" argument in a script tag.
29 CVE-2000-1113 Exec Code Overflow 2001-01-09 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft Windows Media Player allows remote attackers to execute arbitrary commands via a malformed Active Stream Redirector (.ASX) file, aka the ".ASX Buffer Overrun" vulnerability.
30 CVE-2000-1089 Exec Code Overflow 2001-01-09 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, aka the "Phone Book Service Buffer Overflow" vulnerability.
31 CVE-2000-1088 DoS Exec Code 2001-01-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
32 CVE-2000-1087 DoS Exec Code 2001-01-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
33 CVE-2000-1086 DoS Exec Code 2001-01-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
34 CVE-2000-1085 DoS Exec Code 2001-01-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
35 CVE-2000-1084 DoS Exec Code 2001-01-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
36 CVE-2000-1083 DoS Exec Code 2001-01-09 2008-09-05
2.1
 None Local Low Not required None None Partial
The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
37 CVE-2000-1082 DoS Exec Code 2001-01-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
38 CVE-2000-1081 DoS Exec Code 2001-01-09 2008-09-10
4.6
 None Local Low Not required Partial Partial Partial
The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
Total number of vulnerabilities : 38   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.