CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 2 and 2.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
4351 CVE-2002-0355 2002-05-29 2008-09-10
2.1
None Local Low Not required Partial None None
netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions.
4352 CVE-2002-0334 2002-06-25 2016-10-17
2.1
None Local Low Not required None Partial None
xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file.
4353 CVE-2002-0294 2002-05-31 2016-10-17
2.1
None Local Low Not required None None Partial
Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system.
4354 CVE-2002-0292 XSS 2002-05-31 2016-10-17
2.6
None Remote High Not required Partial None None
Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field.
4355 CVE-2002-0284 2002-05-31 2016-10-17
2.6
None Remote High Not required Partial None None
Winamp 2.78 and 2.77, when opening a wma file that requires a license, sends the full path of the Temporary Internet Files directory to the web page that is processing the license, which could allow malicious web servers to obtain the pathname.
4356 CVE-2002-0234 DoS 2002-05-29 2016-10-17
2.1
None Local Low Not required None None Partial
NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trusted network to cause a denial of service (resource exhaustion) via a port scan to an external network, which consumes all available connections.
4357 CVE-2002-0214 2002-05-16 2008-09-10
2.1
None Local Low Not required Partial None None
Compaq Intel PRO/Wireless 2011B LAN USB Device Driver 1.5.16.0 through 1.5.18.0 stores the 128-bit WEP (Wired Equivalent Privacy) key in plaintext in a registry key with weak permissions, which allows local users to decrypt network traffic by reading the WEP key from the registry key.
4358 CVE-2002-0213 2002-05-16 2016-10-17
2.1
None Local Low Not required Partial None None
xkas in Xinet K-AShare 0.011.01 for IRIX allows local users to read arbitrary files via a symlink attack on the VOLICON file, which is copied to the .HSicon file in a shared directory.
4359 CVE-2002-0172 DoS 2002-05-16 2008-09-10
2.1
None Local Low Not required None None Partial
/dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions (644), which could allow a local user to cause a denial of service (traffic disruption).
4360 CVE-2002-0138 2002-03-25 2016-10-17
2.1
None Local Low Not required Partial None None
CDRDAO 1.1.4 and 1.1.5 allows local users to read arbitrary files via the show-data command.
4361 CVE-2002-0129 2002-03-25 2016-10-17
2.1
None Local Low Not required Partial None None
efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message.
4362 CVE-2002-0121 2002-03-25 2008-09-10
2.1
None Local Low Not required Partial None None
PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections.
4363 CVE-2002-0120 +Info 2002-03-25 2008-09-10
2.1
None Local Low Not required Partial None None
Apple Palm Desktop 4.0b76 and 4.0b77 creates world-readable backup files and folders when a hotsync is performed, which could allow a local user to obtain sensitive information.
4364 CVE-2002-0110 +Priv 2002-03-25 2016-10-17
2.1
None Local Low Not required Partial None None
Nevrona Designs MiraMail 1.04 and earlier stores authentication information such as POP usernames and passwords in plaintext in a .ini file, which allows an attacker to gain privileges by reading the passwords from the file.
4365 CVE-2002-0087 2002-03-15 2017-07-10
2.1
None Local Low Not required None Partial None
bindsock in Lotus Domino 5.07 on Solaris allows local users to create arbitrary files via a symlink attack on temporary files.
4366 CVE-2002-0080 2002-03-15 2008-09-05
2.1
None Local Low Not required Partial None None
rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.
4367 CVE-2002-0069 DoS 2002-03-08 2016-10-17
2.6
None Remote High Not required None None Partial
Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service.
4368 CVE-2002-0042 DoS 2002-06-18 2008-09-05
2.1
None Local Low Not required None None Partial
Vulnerability in the XFS file system for SGI IRIX before 6.5.12 allows local users to cause a denial of service (hang) by creating a file that is not properly processed by XFS.
4369 CVE-2002-0040 +Priv 2002-03-28 2008-09-05
2.1
None Local Low Not required None None Partial
Vulnerability in SGI IRIX 6.5.11 through 6.5.15f allows local users to cause privileged applications to dump core via the HOSTALIASES environment variable, which might allow the users to gain privileges.
4370 CVE-2001-1593 59 2014-04-05 2014-04-30
2.1
None Local Low Not required None Partial None
The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.
4371 CVE-2001-1578 2001-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Unknown vulnerability in SCO OpenServer 5.0.6 and earlier allows local users to modify critical information such as certain CPU registers and segment descriptors.
4372 CVE-2001-1570 2001-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
Windows XP with fast user switching and account lockout enabled allows local users to deny user account access by setting the fast user switch to the same user (self) multiple times, which causes other accounts to be locked out.
4373 CVE-2001-1565 +Info 2001-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which allows local users to obtain authentication information via the ps command.
4374 CVE-2001-1564 DoS 2001-12-31 2017-10-11
2.1
None Local Low Not required None None Partial
setrlimit in HP-UX 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11 does not properly enforce core file size on processes after setuid or setgid privileges are dropped, which could allow local users to cause a denial of service by exhausting available disk space.
4375 CVE-2001-1560 DoS 2001-12-31 2019-04-30
2.1
None Local Low Not required None None Partial
Win32k.sys (aka Graphics Device Interface (GDI)) in Windows 2000 and XP allows local users to cause a denial of service (system crash) by calling the ShowWindow function after receiving a WM_NCCREATE message.
4376 CVE-2001-1559 DoS 2001-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdrelease function, which allows local users to cause a denial of service and trigger a null dereference.
4377 CVE-2001-1551 2001-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Linux kernel 2.2.19 enables CAP_SYS_RESOURCE for setuid processes, which allows local users to exceed disk quota restrictions during execution of setuid programs.
4378 CVE-2001-1550 2001-12-31 2017-07-10
2.1
None Local Low Not required Partial None None
CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to obtain cleartext passwords from decoded log files and impersonate users.
4379 CVE-2001-1549 Bypass 2001-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters.
4380 CVE-2001-1548 Bypass 2001-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters.
4381 CVE-2001-1534 Bypass +Info 2001-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
4382 CVE-2001-1527 2001-12-31 2009-04-03
2.1
None Local Low Not required Partial None None
easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and gain access.
4383 CVE-2001-1521 XSS 2001-12-31 2008-09-10
2.6
None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 allows remote attackers to inject arbitrary web script or HTML via the uname parameter.
4384 CVE-2001-1520 2001-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Xircom REX 6000 allows local users to obtain the 10 digit PIN by starting a serial monitor, connecting to the personal digital assistant (PDA) via Rextools, and capturing the cleartext PIN.
4385 CVE-2001-1518 DoS 2001-12-31 2019-04-30
2.1
None Local Low Not required None None Partial
RunAs (runas.exe) in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service (RunAs hang) by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the vendor also presents a scenario in which other users could be affected if running on a Terminal Server. Therefore this is a vulnerability.
4386 CVE-2001-1517 +Info 2001-12-31 2019-04-30
2.1
None Local Low Not required Partial None None
** DISPUTED ** RunAs (runas.exe) in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it, and the original researcher did not respond to requests for additional information.
4387 CVE-2001-1503 2001-12-31 2018-10-30
2.1
None Local Low Not required Partial None None
The finger daemon (in.fingerd) in Sun Solaris 2.5 through 8 and SunOS 5.5 through 5.8 allows remote attackers to list all accounts on a host by typing finger 'a b c d e f g h'@host.
4388 CVE-2001-1497 2001-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack.
4389 CVE-2001-1494 Exec Code 2001-12-31 2017-10-10
2.1
None Local Low Not required None Partial None
script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.
4390 CVE-2001-1479 2001-12-31 2017-07-10
2.1
None Local Low Not required None Partial None
smcboot in Sun SMC (Sun Management Center) 2.0 in Solaris 8 allows local users to delete arbitrary files via a symlink attack on /tmp/smc$SMC_PORT.
4391 CVE-2001-1450 DoS 2001-05-11 2017-07-10
2.6
None Remote High Not required None None Partial
Microsoft Internet Explorer 5.0 through 6.0 allows attackers to cause a denial of service (browser crash) via a crafted FTP URL such as "/.#./".
4392 CVE-2001-1439 DoS Overflow 2001-02-16 2017-07-10
2.1
None Local Low Not required None None Partial
Buffer overflow in the text editor functionality in HP-UX 10.01 through 11.04 on HP9000 Series 700 and Series 800 allows local users to cause a denial of service ("system availability") via text editors such as (1) e, (2) ex, (3) vi, (4) edit, (5) view, and (6) vedit.
4393 CVE-2001-1412 2003-11-17 2016-10-17
2.1
None Local Low Not required Partial None None
nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command line argument.
4394 CVE-2001-1406 2001-09-10 2016-10-17
2.1
None Local Low Not required Partial None None
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
4395 CVE-2001-1405 DoS 2001-09-10 2016-10-17
2.1
None Local Low Not required None None Partial
Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) via a flood of requests to sanitycheck.cgi.
4396 CVE-2001-1400 DoS 2001-04-17 2016-12-07
2.1
None Local Low Not required None None Partial
Unknown vulnerabilities in the UDP port allocation for Linux kernel before 2.2.19 could allow local users to cause a denial of service (deadlock).
4397 CVE-2001-1399 2001-04-17 2016-12-07
2.1
None Local Low Not required None Partial None
Certain operations in Linux kernel before 2.2.19 on the x86 architecture copy the wrong number of bytes, which might allow attackers to modify memory, aka "User access asm bug on x86."
4398 CVE-2001-1397 2001-04-17 2016-12-07
2.1
None Local Low Not required None Partial None
The System V (SYS5) shared memory implementation for Linux kernel before 2.2.19 could allow attackers to modify recently freed memory.
4399 CVE-2001-1394 DoS 2001-04-17 2016-12-07
2.1
None Local Low Not required None None Partial
Signedness error in (1) getsockopt and (2) setsockopt for Linux kernel before 2.2.19 allows local users to cause a denial of service.
4400 CVE-2001-1393 DoS 2001-04-17 2016-12-07
2.1
None Local Low Not required None None Partial
Unknown vulnerability in classifier code for Linux kernel before 2.2.19 could result in denial of service (hang).
Total number of vulnerabilities : 4610   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 (This Page)89 90 91 92 93
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.