CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2001(Gain Information)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2001-1565 +Info 2001-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which allows local users to obtain authentication information via the ps command.
2 CVE-2001-1537 +Priv +Info 2001-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges.
3 CVE-2001-1536 XSS +Info 2001-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Autogalaxy stores usernames and passwords in cleartext in cookies, which makes it easier for remote attackers to obtain authentication information and gain unauthorized access via sniffing or a cross-site scripting attack.
4 CVE-2001-1534 Bypass +Info 2001-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
5 CVE-2001-1517 +Info 2001-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
** DISPUTED ** RunAs (runas.exe) in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it, and the original researcher did not respond to requests for additional information.
6 CVE-2001-1462 +Info 2001-10-24 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to cause the WebID agent to enter debug mode via a URL containing null characters, which may allow attackers to obtain sensitive information.
7 CVE-2001-1387 +Info 2001-11-05 2008-09-05
2.1
 None Local Low Not required Partial None None
iptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "--reject-with tcp-reset," which causes iptables to generate different responses than specified by the administrator, possibly leading to an information leak.
8 CVE-2001-1366 +Info 2001-07-19 2008-09-05
5.0
 None Remote Low Not required Partial None None
netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive information.
9 CVE-2001-1341 +Info 2001-05-24 2008-09-10
5.0
 None Remote Low Not required Partial None None
The Beck GmbH IPC@Chip embedded web server installs the chipcfg.cgi program by default, which allows remote attackers to obtain sensitive network information via a request to the program.
10 CVE-2001-1303 +Info 2001-07-18 2008-09-10
5.0
 None Remote Low Not required Partial None None
The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for the protected network without authentication.
11 CVE-2001-1282 +Info 2001-10-12 2008-09-10
5.0
 None Remote Low Not required Partial None None
Ipswitch IMail 7.04 and earlier records the physical path of attachments in an e-mail message header, which could allow remote attackers to obtain potentially sensitive configuration information.
12 CVE-2001-1110 +Info 2001-09-12 2008-09-05
5.0
 None Remote Low Not required Partial None None
EFTP 2.0.7.337 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection.
13 CVE-2001-1073 +Info 2001-08-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Webridge PX Application Suite allows remote attackers to obtain sensitive information via a malformed request that generates a server error message, which includes full pathname or internal IP address information in the variables (1) APPL_PHYSICAL_PATH, (2) PATH_TRANSLATED, and (3) LOCAL_ADDR.
14 CVE-2001-1044 +Info 2001-01-11 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Basilix Webmail 0.9.7beta, and possibly other versions, stores *.class and *.inc files under the document root and does not restrict access, which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file.
15 CVE-2001-0990 +Info 2001-09-04 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a library, which allows local users to obtain the MySQL username and password by inspecting the vpopmail programs that use the library.
16 CVE-2001-0988 +Info 2001-07-23 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Arkeia backup server 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwrite the files or obtain sensitive information.
17 CVE-2001-0986 +Info 2001-09-14 2008-09-05
5.0
 None Remote Low Not required Partial None None
SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo, (2) extended_fileinfo, (3) extended_webinfo, or (4) fileinfo.
18 CVE-2001-0959 +Info 2001-09-15 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$, which allows remote attackers to obtain sensitive information and overwrite critical files.
19 CVE-2001-0884 XSS +Info 2001-12-21 2008-09-05
5.1
 None Remote High Not required Partial Partial Partial
Cross-site scripting vulnerability in Mailman email archiver before 2.08 allows attackers to obtain sensitive information or authentication credentials via a malicious link that is accessed by other web users.
20 CVE-2001-0870 +Info 2001-12-21 2008-09-05
5.0
 None Remote Low Not required Partial None None
HTTP server in Alchemy Eye and Alchemy Network Monitor 1.9x through 2.6.18 is enabled without authentication by default, which allows remote attackers to obtain network monitoring logs with potentially sensitive information by directly requesting the eye.ini file.
21 CVE-2001-0745 +Info 2001-10-18 2008-09-05
5.0
 None Remote Low Not required Partial None None
Netscape 4.7x allows remote attackers to obtain sensitive information such as the user's login, mailbox location and installation path via Javascript that accesses the mailbox: URL in the document.referrer property.
22 CVE-2001-0715 +Info 2001-10-30 2008-09-05
2.1
 None Local Low Not required Partial None None
Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to obtain potentially sensitive information about the mail queue by setting debugging flags to enable debug mode.
23 CVE-2001-0572 +Info 2001-08-22 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
24 CVE-2001-0514 DoS +Info 2001-07-21 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain sensitive information such as WEP keys, cause a denial of service, or gain access to the network.
25 CVE-2001-0465 +Info 2001-06-18 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
TurboTax saves passwords in a temporary file when a user imports investment tax information from a financial institution, which could allow local users to obtain sensitive information.
26 CVE-2001-0444 +Info 2001-07-02 2008-09-05
2.1
 None Local Low Not required Partial None None
Cisco CBOS 2.3.0.053 sends output of the "sh nat" (aka "show nat") command to the terminal of the next user who attempts to connect to the router via telnet, which could allow that user to obtain sensitive information.
27 CVE-2001-0396 +Info 2001-07-02 2008-09-05
5.0
 None Remote Low Not required Partial None None
The pre-login mode in the System Administrator interface of Lightwave ConsoleServer 3200 allows remote attackers to obtain sensitive information such as system status, configuration, and users.
28 CVE-2001-0264 +Info 2001-06-18 2008-09-05
5.0
 None Remote Low Not required Partial None None
Gene6 G6 FTP Server 2.0 (aka BPFTP Server 2.10) allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection.
29 CVE-2001-0077 +Info 2001-02-12 2008-09-05
5.0
 None Remote Low Not required Partial None None
The clustmon service in Sun Cluster 2.x does not require authentication, which allows remote attackers to obtain sensitive information such as system logs and cluster configurations.
30 CVE-2001-0046 +Info 2001-02-16 2008-09-10
4.6
 User Local Low Not required Partial Partial Partial
The default permissions for the SNMP Parameters registry key in Windows NT 4.0 allows remote attackers to read and possibly modify the SNMP community strings to obtain sensitive information or modify network configuration, aka one of the "Registry Permissions" vulnerabilities.
31 CVE-2000-1215 +Info 2001-09-19 2008-09-10
5.0
 None Remote Low Not required Partial None None
The default configuration of Lotus Domino server 5.0.8 includes system information (version, operating system, and build date) in the HTTP headers of replies, which allows remote attackers to obtain sensitive information.
32 CVE-2000-1200 +Info 2001-08-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.
33 CVE-2000-1181 +Info 2001-01-09 2008-09-05
5.0
 None Remote Low Not required Partial None None
Real Networks RealServer 7 and earlier allows remote attackers to obtain portions of RealServer's memory contents, possibly including sensitive information, by accessing the /admin/includes/ URL.
34 CVE-2000-1173 +Info 2001-01-09 2008-09-05
5.0
 None Remote Low Not required Partial None None
Microsys CyberPatrol uses weak encryption (trivial encoding) for credit card numbers and uses no encryption for the remainder of the information during registration, which could allow attackers to sniff network traffic and obtain this sensitive information.
35 CVE-2000-0892 +Info 2001-07-21 2008-09-05
2.6
 None Remote High Not required Partial None None
Some telnet clients allow remote telnet servers to request environment variables from the client that may contain sensitive information, or remote web servers to obtain the information via a telnet: URL.
Total number of vulnerabilities : 35   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.