2001

SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-0

Unknown vulnerability in Allaire JRun 3.1 allows remote attackers to directly access the WEB-INF and META-INF directorie

CMG WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate author

Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate a

script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardl

The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mo

Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via

Directory traversal vulnerability in zml.cgi allows remote attackers to read arbitrary files via a .. (dot dot) in the f

One-Time Passwords In Everything (a.k.a OPIE) 2.32 and 2.4 allows remote attackers to determine the existence of user ac

Open Projects Network Internet Relay Chat (IRC) daemon u2.10.05.18 does not perform a double-reverse DNS lookup, which a

Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via

Mozilla 0.9.6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with

Opera 5.11 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a

Check Point VPN-1 4.1SP4 using SecuRemote returns different error messages for valid and invalid users, with prompts tha

The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of servic

tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets.

Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other w

JRun 3.0 and 3.1 running on JRun Web Server (JWS) and IIS allows remote attackers to read arbitrary JavaServer Pages (JS

Directory traversal vulnerability in the comments action in easyNews 1.5 and earlier allows remote attackers to modify n

AmTote International homebet program returns different error messages when invalid account numbers and PIN codes are pro

WebX stores authentication information in the HTTP_REFERER variable, which is included in URL links within bulletin boar

Stack consumption vulnerability in Internet Explorer The JavaScript settimeout function in Internet Explorer allows remo

IPRoute 0.973, 0.974 and 1.18 allows remote attackers to cause a denial of service via fragmented IP packets that split

Directory traversal vulnerability in Macromedia JRun Web Server (JWS) 2.3.3, 3.0 and 3.1 allows remote attackers to read

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests (a.k.a. rewriting) when client browsers have cookies

ssdpsrv.exe in Windows ME allows remote attackers to cause a denial of service by sending multiple newlines in a Simple

IBM AIX 430 does not properly unlock IPPMTU_LOCK, which allows remote attackers to cause a denial of service (hang) via

The log files in Apache web server contain information directly supplied by clients and does not filter or quote control

Unknown vulnerability in IP defragmenter (frag2) in Snort before 1.8.3 allows attackers to cause a denial of service (cr

Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database f

The Remote Desktop client in Windows XP sends the most recent user account name in cleartext, which could allow remote a

Apple Personal Web Sharing (PWS) 1.1, 1.5, and 1.5.5, when Web Sharing authentication is enabled, allows remote attacker

The timed program (in.timed) in UnixWare 7 and OpenUnix 8.0.0 does not properly terminate certain strings with a null, w

Directory traversal vulnerability in ScriptEase viewcode.jse for Netware 5.1 before 5.1 SP3 allows remote attackers to r

The Domain gateway in BEA Tuxedo 7.1 does not perform authorization checks for imported services and qspaces on remote d

popauth utility in Qualcomm Qpopper 4.0 and earlier allows local users to overwrite arbitrary files and execute commands

Unknown vulnerability in the file system protection subsystem in HP Secure OS Software for Linux 1.0 allows additional u

Buffer overflow in lpstat in SCO OpenServer 5.0 through 5.0.6a allows local users to execute arbitrary code as group bin

geteuid in Itanium Architecture (IA) running on HP-UX 11.20 does not properly identify a user's effective user id, which

run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions, which allows local users to exe

Slashcode 2.0 creates new accounts with an 8-character random password, which could allow local users to obtain session

Buffer overflow in setiathome for SETI@home 3.03, if installed setuid, could allow local users to execute arbitrary code

pt_chmod in Solaris 8 does not call fdetach to reset terminal privileges when users log out of terminals, which allows l

Buffer overflow in cron in Caldera UnixWare 7 allows local users to execute arbitrary code via a command line argument.

Cross-site scripting (XSS) vulnerability in phpReview 0.9.0 rc2 and earlier allows remote attackers to inject arbitrary

Cross-site scripting (XSS) vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrar

Cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke allows remote attackers to inject arbitr

Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web s

Cross-site scripting (XSS) vulnerability in the comments action in index.php in easyNews 1.5 and earlier allows remote a

Cisco ubr900 series routers that conform to the Data-over-Cable Service Interface Specifications (DOCSIS) standard must