[CLOSE] OSVDB ID : 5407 - Disclosed: 2001-11-30

Description:

(Description Provided by CVE) : The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.

[CLOSE] OSVDB ID : 1998 - Disclosed: 2001-11-30

Description:

Lotus Domino HTTP Server contains a flaw that may allow a remote denial of service. The issue is triggered when a SunRPC NULL string is sent to the SSL port (443), and will result in loss of availability for the service

[CLOSE] OSVDB ID : 8953 - Disclosed: 2001-11-30

Description:

(Description Provided by CVE) : Directory traversal vulnerability in AspUpload 2.1, in certain configurations, allows remote attackers to upload and read arbitrary files, and list arbitrary directories, via a .. (dot dot) in the Filename parameter in (1) UploadScript11.asp or (2) DirectoryListing.asp.

[CLOSE] OSVDB ID : 8954 - Disclosed: 2001-11-30

Description:

(Description Provided by CVE) : Directory traversal vulnerability in AspUpload 2.1, in certain configurations, allows remote attackers to upload and read arbitrary files, and list arbitrary directories, via a .. (dot dot) in the Filename parameter in (1) UploadScript11.asp or (2) DirectoryListing.asp.

[CLOSE] OSVDB ID : 11639 - Disclosed: 2001-11-30

Description:

(Description Provided by CVE) : HTTP server in Alchemy Eye and Alchemy Network Monitor 1.9x through 2.6.18 is enabled without authentication by default, which allows remote attackers to obtain network monitoring logs with potentially sensitive information by directly requesting the eye.ini file.

[CLOSE] OSVDB ID : 19398 - Disclosed: 2001-11-29

Description:

(Description Provided by CVE) : Unknown vulnerability in SCO OpenServer 5.0.6 and earlier allows local users to modify critical information such as certain CPU registers and segment descriptors.

[CLOSE] OSVDB ID : 20353 - Disclosed: 2001-11-29

Description:

Snort contains a flaw related to the 'frag2' IP defragmenter plugin that may allow a remote attacker to crash the application. No further details have been provided.

[CLOSE] OSVDB ID : 9432 - Disclosed: 2001-11-29

Description:

A local overflow exists in Oracle. Oracle fails to perform proper bounds checking on the user supplied ORACLE_HOME variable in dbsnmp resulting in a buffer overflow. With a specially crafted request in which the value of ORACLE_HOME is more than 750 bytes, an attacker can cause execution of arbitrary code resulting in a loss of integrity.

[CLOSE] OSVDB ID : 54034 - Disclosed: 2001-11-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 44600 - Disclosed: 2001-11-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 684 - Disclosed: 2001-11-29

Description:

(Description Provided by CVE) : Directory traversal vulnerability in HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP request containing (1) a .. in versions 2.0 through 2.6.18, or (2) a DOS device name followed by a .. in versions 2.6.19 through 3.0.10.

[CLOSE] OSVDB ID : 1997 - Disclosed: 2001-11-29

Description:

(Description Provided by CVE) : Buffer overflow in Frox transparent FTP proxy 0.6.6 and earlier, with the local caching method selected, allows remote FTP servers to run arbitrary code via a long response to an MDTM request.

[CLOSE] OSVDB ID : 4739 - Disclosed: 2001-11-29

Description:

(Description Provided by CVE) : NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter improperly MIME encoded email attachments, which could allow remote attackers to bypass filtering and possibly execute arbitrary code in email clients that process the invalid attachments.

[CLOSE] OSVDB ID : 9455 - Disclosed: 2001-11-29

Description:

(Description Provided by CVE) : dbsnmp in Oracle 8.1.6 and 8.1.7 uses the ORACLE_HOME environment variable to find and execute the dbsnmp program, which allows local users to execute arbitrary programs by pointing the ORACLE_HOME to an alternate directory that contains a malicious version of dbsnmp.

[CLOSE] OSVDB ID : 9456 - Disclosed: 2001-11-29

Description:

(Description Provided by CVE) : dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands, which allows local users to execute arbitrary code by modifying the PATH to point to Trojan Horse programs.

[CLOSE] OSVDB ID : 11968 - Disclosed: 2001-11-29

Description:

(Description Provided by CVE) : PGPMail.pl 1.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) recipient or (2) pgpuserid parameters.

[CLOSE] OSVDB ID : 14265 - Disclosed: 2001-11-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 20273 - Disclosed: 2001-11-29

Description:

A local overflow exists in uucp on BSD. The program fails to check bounds, resulting in a buffer overflow. By passing a long string of data, an attacker can execute arbitrary code on the system with the privileges of uucp, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 686 - Disclosed: 2001-11-28

Description:

WU-FTPD contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is triggered when when the 'ftpglob()' function fails to properly set the 'globerr' variable when the malformed string '~{' is inserted after a valid command by a valid user. This causes the heap to become corrupt and potentially allow a remote attacker to place and point to arbitrary commands on the heap. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 14053 - Disclosed: 2001-11-28

Description:

A remote overflow exists in Cooolsoft PowerFTP server. The PowerFTP server fails to correctly check the size of incoming commands resulting in a buffer overflow. With a specially crafted request composed of a command longer than 2048 characters, an attacker can cause a denial of service to the PowerFTP server resulting in a loss of availability.

[CLOSE] OSVDB ID : 20269 - Disclosed: 2001-11-28

Description:

(Description Provided by CVE) : The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges.

[CLOSE] OSVDB ID : 808 - Disclosed: 2001-11-28

Description:

IOS contains a flaw that may allow a malicious user to direct network traffic to a protected host. The issue is triggered when IOS fails to check the protocol type of return traffic which otherwise matches a dynamic access list entry. It is possible that the flaw may allow unauthorized traffic to pass into a protected network.

[CLOSE] OSVDB ID : 7756 - Disclosed: 2001-11-28

Description:

PowerFTP contains a flaw that allows a remote attacker to access unauthorized files. The issue is due to the PowerFTP Server inproperly checking for permissions on other drives. By sending the LS or GET command with "dot dot" sequences (/../), a remote attacker can access other files outside of the FTP server root directory, resulting a loss of confidentiality and integrity.

[CLOSE] OSVDB ID : 13994 - Disclosed: 2001-11-28

Description:

(Description Provided by CVE) : Buffer overflow in the permitted function of GNOME gtop daemon (libgtop_daemon) in libgtop 1.0.13 and earlier may allow remote attackers to execute arbitrary code via long authentication data.

[CLOSE] OSVDB ID : 13998 - Disclosed: 2001-11-28

Description:

WU-FTPD contains an unspecified flaw that may allow a remote attacker to execute arbitrary code. No further details have been provided.

[CLOSE] OSVDB ID : 14054 - Disclosed: 2001-11-28

Description:

(Description Provided by CVE) : Cooolsoft PowerFTP Server 2.03 allows remote attackers to list the contents of arbitrary drives via a ls (LIST) command that includes the drive letter as an argument, e.g. "ls C:".

[CLOSE] OSVDB ID : 14055 - Disclosed: 2001-11-28

Description:

(Description Provided by CVE) : Cooolsoft PowerFTP Server 2.03 allows remote attackers to obtain the physical path of the server root via the pwd command, which lists the full pathname.

[CLOSE] OSVDB ID : 3275 - Disclosed: 2001-11-27

Description:

Unicos' Network Queuing System (NQS), part of the Network Queuing Environment (NQE), contains a flaw that allows any local user gain root privileges. The issue is due to a format string vulnerability in the NQS Daemon that incorrectly processes batch files with malcrafted names. When the name is passed to the NQS daemon via the "qsub" utility, the vulnerable function can be exploited to gain elevated privileges.

[CLOSE] OSVDB ID : 20225 - Disclosed: 2001-11-27

Description:

(Description Provided by CVE) : ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to (1) child processes created with <CFEXECUTE> and (2) child processes that call the CreateProcess function and are executed with <CFOBJECT> or end with the CFX extension, which allows attackers to execute programs with the permissions of the System account.

[CLOSE] OSVDB ID : 24872 - Disclosed: 2001-11-27

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 20268 - Disclosed: 2001-11-27

Description:

(Description Provided by CVE) : Autogalaxy stores usernames and passwords in cleartext in cookies, which makes it easier for remote attackers to obtain authentication information and gain unauthorized access via sniffing or a cross-site scripting attack.

[CLOSE] OSVDB ID : 680 - Disclosed: 2001-11-27

Description:

(Description Provided by CVE) : Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.

[CLOSE] OSVDB ID : 6443 - Disclosed: 2001-11-27

Description:

PowerPhlogger contains a flaw that may allow an attacker to access the mySQL dump of an arbitrary user. The issue is due to improper argument checking in the db_dump.php script. No further details have been provided.

[CLOSE] OSVDB ID : 6629 - Disclosed: 2001-11-27

Description:

(Description Provided by CVE) : SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page, in which the request's body has an #include statement.

[CLOSE] OSVDB ID : 7143 - Disclosed: 2001-11-27

Description:

Interchange contains a flaw related to the Safe :base_io group default behavior. No further details have been provided.

[CLOSE] OSVDB ID : 13243 - Disclosed: 2001-11-27

Description:

(Description Provided by CVE) : Sendpage.pl allows remote attackers to execute arbitrary commands via a message containing shell metacharacters.

[CLOSE] OSVDB ID : 13993 - Disclosed: 2001-11-27

Description:

(Description Provided by CVE) : Format string vulnerability in the permitted function of GNOME libgtop_daemon in libgtop 1.0.12 and earlier allows remote attackers to execute arbitrary code via an argument that contains format specifiers that are passed into the (1) syslog_message and (2) syslog_io_message functions.

[CLOSE] OSVDB ID : 1995 - Disclosed: 2001-11-26

Description:

(Description Provided by CVE) : Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download.

[CLOSE] OSVDB ID : 20195 - Disclosed: 2001-11-26

Description:

(Description Provided by CVE) : Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows remote attackers to gain privileges.

[CLOSE] OSVDB ID : 20219 - Disclosed: 2001-11-26

Description:

(Description Provided by CVE) : Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the web application directory without the trailing '/' (slash), as demonstrated using ctx.