2001

Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIM

RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which coul

Directory traversal vulnerability in EFTP 2.0.7.337 allows remote authenticated users to reveal directory contents via a

Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing

Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists a

EFTP 2.0.7.337 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a ne

EFTP 2.0.7.337 stores user passwords in plaintext in the eftp2users.dat file.

Textor Webmasters Ltd listrec.pl CGI program allows remote attackers to execute arbitrary commands via shell metacharact

Find-By-Content in Mac OS X 10.0 through 10.0.4 creates world-readable index files named .FBCIndex in every directory, w

speechd 0.54 and earlier, with the Festival or rsynth speech synthesis package, allows attackers to execute arbitrary co

NetOp School 1.5 allows local users to bypass access restrictions on the administration version by logging into the stud

libnss-pgsql in nss-pgsql 0.9.0 and earlier allows remote attackers to execute arbitrary SQL queries by inserting SQL co

nss_postgresql 0.6.1 and before allows a remote attacker to execute arbitrary SQL queries by inserting SQL code into an

Leon J Breedt pam-pgsql before 0.5.2 allows remote attackers to execute arbitrary SQL code and bypass authentication or

Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauth

Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by readi

Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could all

Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restri

Buffer overflow in msgchk in Digital UNIX 4.0G and earlier allows local users to execute arbitrary code via a long comma

msgchk in Digital UNIX 4.0G and earlier allows a local user to read the first line of arbitrary files via a symlink atta

Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service

process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, whic

shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metachar

The Log Viewer function in the Check Point FireWall-1 GUI for Solaris 3.0b through 4.1 SP2 does not check for the existe

Check Point FireWall-1 3.0b through 4.1 for Solaris allows local users to overwrite arbitrary files via a symlink attack

Directory traversal vulnerability in view_item CGI program in sglMerchant 1.0 allows remote attackers to read arbitrary

Directory traversal vulnerability in r.pl (aka r.cgi) of Randy Parker Power Up HTML 0.8033beta allows remote attackers t

The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to identify the re

rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to re

D-Link DI-704 Internet Gateway firmware earlier than V2.56b6 allows remote attackers to cause a denial of service (reboo

fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on tem

shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in

edit_image.php in Vibechild Directory Manager before 0.91 allows remote attackers to execute arbitrary commands via shel

Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty si

Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist

Vulnerability in screen before 3.9.10, related to a multi-attach error, allows local users to gain root privileges when

PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.

Buffer overflow in the (1) smap/smapd and (2) CSMAP daemons for Gauntlet Firewall 5.0 through 6.0 allows remote attacker

rmuser utility in FreeBSD 4.2 and 4.3 creates a copy of the master.passwd file with world-readable permissions while upd

Marconi ForeThought 7.1 allows remote attackers to cause a denial of service by causing both telnet sessions to be locke

Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into

login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brut

Buffer overflow in swverify in HP-UX 11.0, and possibly other programs, allows local users to gain privileges via a long

keyinit in S/Key does not require authentication to initialize a one-time password sequence, which allows an attacker wh

POP3Lite before 0.2.4 does not properly quote a . (dot) in an email message, which could allow a remote attacker to appe

Directory traversal vulnerability in Nudester 1.10 and earlier allows remote attackers to read or write arbitrary files

Knox Arkeia server 4.2, and possibly other versions, installs its root user with a null password by default, which allow

ipfw in FreeBSD does not properly handle the use of "me" in its rules when point to point interfaces are used, which cau

Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain