Overview 1,331 matches · 8 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 459 public PoC · 18 EPSS ≥ 0.5
1,331matches
8in Waratek scope0.6%
0protected0.0%
2exploited0.2%
0CISA KEV0.0%
459public PoC34.5%
18EPSS ≥ 0.51.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
4
0.3%
No exploit published
4
0.3%
Outside Waratek scope
3
0.2%
Not applicable
1,320
99.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
1,331
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
0.2%
Working exploit published
458
34.4%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
871
65.4%
split by
peak 467 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001286
No exploit published1
Outside Waratek scope2
Not applicable283
Medium286
not blocked286
Working exploit published105
No public exploit181
1989199119931995199719992001
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2001-1251 | Medium | 2001-06-29 | Not applicable | No public exploit | SmallHTTP 1.204 through 3.00 beta 8 allows remote attackers to cause a denial of service via multiple long URL requests. |
| CVE-2001-1250 | Medium | 2001-06-29 | Not applicable | No public exploit | vWebServer 1.2.0 allows remote attackers to cause a denial of service (hang) via a small number of long URL requests, possibly due to a buffer overflow. |
| CVE-2001-1249 | Medium | 2001-06-29 | Not applicable | No public exploit | vWebServer 1.2.0 allows remote attackers to cause a denial of service via a URL that contains MS-DOS device names. |
| CVE-2001-1248 | Medium | 2001-06-29 | Not applicable | No public exploit | vWebServer 1.2.0 allows remote attackers to view arbitrary ASP scripts via a request for an ASP script that ends with a URL-encoded space character (%20). |
| CVE-2001-1239 | Medium | 2001-06-29 | Not applicable | No public exploit | PowerNet IX allows remote attackers to cause a denial of service via a port scan. |
| CVE-2001-1290 | Medium | 2001-06-28 | Not applicable | Working exploit published | admin.cgi in Active Classifieds Free Edition 1.0, and possibly commercial versions, allows remote attackers to modify the configuration, gain privileges, and execute arbitrary Perl code via the table_width parameter. |
| CVE-2001-0496 | Medium | 2001-06-27 | Not applicable | No public exploit | kdesu in kdelibs package creates world readable temporary files containing authentication info, which can allow local users to gain privileges. |
| CVE-2001-0495 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal in DataWizard WebXQ server 1.204 allows remote attackers to view files outside of the web root via a .. (dot dot) attack. |
| CVE-2001-0493 | Medium | 2001-06-27 | Not applicable | No public exploit | Small HTTP server 2.03 allows remote attackers to cause a denial of service via a URL that contains an MS-DOS device name such as aux. |
| CVE-2001-0492 | Medium | 2001-06-27 | Not applicable | No public exploit | Netcruiser Web server version 0.1.2.8 and earlier allows remote attackers to determine the physical path of the server via a URL containing (1) con, (2) com2, or (3) com3. |
| CVE-2001-0491 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal vulnerability in RaidenFTPD Server 2.1 before build 952 allows attackers to access files outside the ftp root via dot dot attacks, such as (1) .... in CWD, (2) .. in NLST, or (3) ... in NLST. |
| CVE-2001-0487 | Medium | 2001-06-27 | Not applicable | No public exploit | AIX SNMP server snmpd allows remote attackers to cause a denial of service via a RST during the TCP connection. |
| CVE-2001-0484 | Medium | 2001-06-27 | Not applicable | Working exploit published | Tektronix PhaserLink 850 does not require authentication for access to configuration pages such as _ncl_subjects.shtml and _ncl_items.shtml, which allows remote attackers to modify configuration information and cause a denial of service by accessing the pages. |
| CVE-2001-0480 | Medium | 2001-06-27 | Not applicable | No public exploit | Directory traversal vulnerability in Alex's FTP Server 0.7 allows remote attackers to read arbitrary files via a ... (modified dot dot) in the (1) GET or (2) CD commands. |
| CVE-2001-0472 | Medium | 2001-06-27 | Not applicable | No public exploit | Hursley Software Laboratories Consumer Transaction Framework (HSLCTF) HTTP object allows remote attackers to cause a denial of service (crash) via an extremely long HTTP request. |
| CVE-2001-0469 | Medium | 2001-06-27 | Not applicable | No public exploit | rwho daemon rwhod in FreeBSD 4.2 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service via malformed packets with a short length. |
| CVE-2001-0467 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal vulnerability in RobTex Viking Web server before 1.07-381 allows remote attackers to read arbitrary files via a \... (modified dot dot) in an HTTP URL request. |
| CVE-2001-0463 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal vulnerability in cal_make.pl in PerlCal allows remote attackers to read arbitrary files via a .. (dot dot) in the p0 parameter. |
| CVE-2001-0462 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal vulnerability in Perl web server 0.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. |
| CVE-2001-0460 | Medium | 2001-06-27 | Not applicable | Working exploit published | Websweeper 4.0 does not limit the length of certain HTTP headers, which allows remote attackers to cause a denial of service (memory exhaustion) via an extremely large HTTP Referrer: header. |
| CVE-2001-0457 | Medium | 2001-06-27 | Not applicable | No public exploit | man2html before 1.5-22 allows remote attackers to cause a denial of service (memory exhaustion). |
| CVE-2001-0454 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal vulnerability in SlimServe HTTPd 1.1a allows remote attackers to read arbitrary files via a ... (modified dot dot) in the HTTP request. |
| CVE-2001-0453 | Medium | 2001-06-27 | Not applicable | No public exploit | Directory traversal vulnerability in BRS WebWeaver HTTP server allows remote attackers to read arbitrary files via a .. (dot dot) attack in the (1) syshelp, (2) sysimages, or (3) scripts directories. |
| CVE-2001-0452 | Medium | 2001-06-27 | Not applicable | Working exploit published | BRS WebWeaver FTP server before 0.64 Beta allows remote attackers to obtain the real pathname of the server via a "CD *" command followed by an ls command. |
| CVE-2001-0450 | Medium | 2001-06-27 | Not applicable | No public exploit | Directory traversal vulnerability in Transsoft FTP Broker before 5.5 allows attackers to (1) delete arbitrary files via DELETE, or (2) list arbitrary directories via LIST, via a .. (dot dot) in the file name. |
| CVE-2001-0449 | Medium | 2001-06-27 | Not applicable | No public exploit | Buffer overflow in WinZip 8.0 allows attackers to execute arbitrary commands via a long file name that is processed by the /zipandemail command line option. |
| CVE-2001-0415 | Medium | 2001-06-27 | Not applicable | No public exploit | REDIPlus program, REDI.exe, stores passwords and user names in cleartext in the StartLog.txt log file, which allows local users to gain access to other accounts. |
| CVE-2001-0407 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal vulnerability in MySQL before 3.23.36 allows local users to modify arbitrary files and gain privileges by creating a database whose name starts with .. (dot dot). |
| CVE-2001-0381 | Medium | 2001-06-27 | Not applicable | No public exploit | The OpenPGP PGP standard allows an attacker to determine the private signature key via a cryptanalytic attack in which the attacker alters the encrypted private key file and captures a single message signed with the signature key. |
| CVE-2001-0370 | Medium | 2001-06-27 | Not applicable | No public exploit | fcheck prior to 2.57.59 calls the file signature checking program insecurely, which can allow a local user to run arbitrary commands via a file name that contains shell metacharacters. |
| CVE-2001-0368 | Medium | 2001-06-27 | Not applicable | No public exploit | Directory traversal vulnerability in BearShare 2.2.2 and earlier allows a remote attacker to read certain files via a URL containing a series of . characters, a variation of the .. (dot dot) attack. |
| CVE-2001-0367 | Medium | 2001-06-27 | Not applicable | No public exploit | Mirabilis ICQ WebFront Plug-in ICQ2000b Build 3278 allows a remote attacker to create a denial of service via HTTP URL requests containing a large number of % characters. |
| CVE-2001-0364 | Medium | 2001-06-27 | Not applicable | No public exploit | SSH Communications Security sshd 2.4 for Windows allows remote attackers to create a denial of service via a large number of simultaneous connections. |
| CVE-2001-0361 | Medium | 2001-06-27 | Not applicable | No public exploit | Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5. |
| CVE-2001-0360 | Medium | 2001-06-27 | Not applicable | Working exploit published | Directory traversal vulnerability in help.cgi in Ikonboard 2.1.7b and earlier allows a remote attacker to read arbitrary files via a .. (dot dot) attack in the helpon parameter. |
| CVE-2001-0355 | Medium | 2001-06-27 | Not applicable | No public exploit | Novell Groupwise 5.5 (sp1 and sp2) allows a remote user to access arbitrary files via an implementation error in Groupwise system policies. |
| CVE-2001-0338 | Medium | 2001-06-27 | Not applicable | No public exploit | Internet Explorer 5.5 and earlier does not properly validate digital certificates when Certificate Revocation List (CRL) checking is enabled, which could allow remote attackers to spoof trusted web sites, aka the "Server certificate validation vulnerability." |
| CVE-2001-0337 | Medium | 2001-06-27 | Not applicable | No public exploit | The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of service via a series of requests. |
| CVE-2001-0336 | Medium | 2001-06-27 | Not applicable | Working exploit published | The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request. |
| CVE-2001-0335 | Medium | 2001-06-27 | Not applicable | No public exploit | FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a special sequence of characters. |
| CVE-2001-0332 | Medium | 2001-06-27 | Not applicable | No public exploit | Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different domain using MSScriptControl.ScriptControl and GetObject, aka a variant of the "Frame Domain Verification" vulnerability. |
| CVE-2001-0328 | Medium | 2001-06-27 | Not applicable | Working exploit published | TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform session hijacking or disruption by injecting a flood of packets with a range of ISN values, one of which may match the expected ISN. |
| CVE-2001-0246 | Medium | 2001-06-27 | Not applicable | No public exploit | Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different domain, aka a variant of the "Frame Domain Verification" vulnerability. |
| CVE-2001-0245 | Medium | 2001-06-27 | Not applicable | No public exploit | Microsoft Index Server 2.0 in Windows NT 4.0, and Indexing Service in Windows 2000, allows remote attackers to read server-side include files via a malformed search request, aka a new variant of the "Malformed Hit-Highlighting" vulnerability. |
| CVE-2001-0243 | Medium | 2001-06-27 | Not applicable | No public exploit | Windows Media Player 7 and earlier stores Internet shortcuts in a user's Temporary Files folder with a fixed filename instead of in the Internet Explorer cache, which causes the HTML in those shortcuts to run in the Local Computer Zone instead of the Internet Zone, which allows remote attackers to read certain files. |
| CVE-2001-0240 | Medium | 2001-06-27 | Not applicable | No public exploit | Microsoft Word before Word 2002 allows attackers to automatically execute macros without warning the user via a Rich Text Format (RTF) document that links to a template with the embedded macro. |
| CVE-2001-0237 | Medium | 2001-06-27 | Not applicable | No public exploit | Memory leak in Microsoft 2000 domain controller allows remote attackers to cause a denial of service by repeatedly connecting to the Kerberos service and then disconnecting without sending any data. |
| CVE-2001-1324 | Medium | 2001-06-26 | Not applicable | No public exploit | cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges. |
| CVE-2001-1083 | Medium | 2001-06-26 | Not applicable | Working exploit published | Icecast 1.3.7, and other versions before 1.3.11 with HTTP server file streaming support enabled allows remote attackers to cause a denial of service (crash) via a URL that ends in . (dot), / (forward slash), or \ (backward slash). |
| CVE-2001-0906 | Medium | 2001-06-22 | Not applicable | Working exploit published | teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files using lpr. |
| CVE-2001-0466 | Medium | 2001-06-18 | Not applicable | Working exploit published | Directory traversal vulnerability in ustorekeeper 1.61 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. |
| CVE-2001-0465 | Medium | 2001-06-18 | Not applicable | No public exploit | TurboTax saves passwords in a temporary file when a user imports investment tax information from a financial institution, which could allow local users to obtain sensitive information. |
| CVE-2001-0448 | Medium | 2001-06-18 | Not applicable | No public exploit | Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service via an HTTP GET HTTP request to the aux directory, and possibly other directories with legacy DOS device names. |
| CVE-2001-0446 | Medium | 2001-06-18 | Not applicable | No public exploit | IBM WCS (WebSphere Commerce Suite) 4.0.1 with Application Server 3.0.2 allows remote attackers to read source code for .jsp files by appending a / to the requested URL. |
| CVE-2001-0420 | Medium | 2001-06-18 | Not applicable | No public exploit | Directory traversal vulnerability in talkback.cgi program allows remote attackers to read arbitrary files via a .. (dot dot) in the article parameter. |
| CVE-2001-0413 | Medium | 2001-06-18 | Not applicable | No public exploit | BinTec X4000 Access router, and possibly other versions, allows remote attackers to cause a denial of service via a SYN port scan, which causes the router to hang. |
| CVE-2001-0411 | Medium | 2001-06-18 | Not applicable | No public exploit | Reliant Unix 5.44 and earlier allows remote attackers to cause a denial of service via an ICMP port unreachable packet, which causes Reliant to drop all connections to the source address of the packet. |
| CVE-2001-0408 | Medium | 2001-06-18 | Not applicable | No public exploit | vim (aka gvim) processes VIM control codes that are embedded in a file, which could allow attackers to execute arbitrary commands when another user opens a file containing malicious VIM control codes. |
| CVE-2001-0404 | Medium | 2001-06-18 | Not applicable | No public exploit | Directory traversal vulnerability in JavaServer Web Dev Kit (JSWDK) 1.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request to the WEB-INF directory. |
| CVE-2001-0399 | Medium | 2001-06-18 | Not applicable | Working exploit published | Caucho Resin 1.3b1 and earlier allows remote attackers to read source code for Javabean files by inserting a .jsp before the WEB-INF specifier in an HTTP request. |
| CVE-2001-0393 | Medium | 2001-06-18 | Not applicable | No public exploit | Navision Financials Server 2.0 allows remote attackers to cause a denial of service via a series of connections to the server without providing a username/password combination, which consumes the license limits. |
| CVE-2001-0392 | Medium | 2001-06-18 | Not applicable | No public exploit | Navision Financials Server 2.60 and earlier allows remote attackers to cause a denial of service by sending a null character and a long string to the server port (2407), which causes the server to crash. |
| CVE-2001-0383 | Medium | 2001-06-18 | Not applicable | Working exploit published | banners.php in PHP-Nuke 4.4 and earlier allows remote attackers to modify banner ad URLs by directly calling the Change operation, which does not require authentication. |
| CVE-2001-0380 | Medium | 2001-06-18 | Not applicable | Working exploit published | Crosscom/Olicom XLT-F running XL 80 IM Version 5.5 Build Level 2 allows a remote attacker SNMP read and write access via a default, undocumented community string 'ILMI'. |
| CVE-2001-0379 | Medium | 2001-06-18 | Not applicable | No public exploit | Vulnerability in the newgrp program included with HP9000 servers running HP-UX 11.11 allows a local attacker to obtain higher access rights. |
| CVE-2001-0377 | Medium | 2001-06-18 | Not applicable | No public exploit | Infradig Inframail prior to 3.98a allows a remote attacker to create a denial of service via a malformed POST request which includes a space followed by a large string. |
| CVE-2001-0375 | Medium | 2001-06-18 | Not applicable | Working exploit published | Cisco PIX Firewall 515 and 520 with 5.1.4 OS running aaa authentication to a TACACS+ server allows remote attackers to cause a denial of service via a large number of authentication requests. |
| CVE-2001-0371 | Medium | 2001-06-18 | Not applicable | No public exploit | Race condition in the UFS and EXT2FS file systems in FreeBSD 4.2 and earlier, and possibly other operating systems, makes deleted data available to user processes before it is zeroed out, which allows a local user to access otherwise restricted information. |
| CVE-2001-0264 | Medium | 2001-06-18 | Not applicable | Working exploit published | Gene6 G6 FTP Server 2.0 (aka BPFTP Server 2.10) allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection. |
| CVE-2001-1077 | Medium | 2001-06-15 | Not applicable | Working exploit published | Buffer overflow in tt_printf function of rxvt 2.6.2 allows local users to gain privileges via a long (1) -T or (2) -name argument. |
| CVE-2001-1148 | Medium | 2001-06-13 | Not applicable | No public exploit | Multiple buffer overflows in programs used by scoadmin and sysadmsh in SCO OpenServer 5.0.6a and earlier allow local users to gain privileges via a long TERM environment variable to (1) atcronsh, (2) auditsh, (3) authsh, (4) backupsh, (5) lpsh, (6) sysadm.menu, or (7) termsh. |
| CVE-2001-1368 | Medium | 2001-06-11 | Not applicable | No public exploit | Vulnerability in iPlanet Web Server 4 included in Virtualvault Operating System (VVOS) 4.0 running HP-UX 11.04 could allow attackers to corrupt data. |
| CVE-2001-1263 | Medium | 2001-06-06 | Not applicable | Working exploit published | telnet95.exe in Pragma InterAccess 4.0 build 5 allows remote attackers to cause a denial of service (crash) via a large number of characters to port 23, possibly due to a buffer overflow. |
| CVE-2001-1345 | Medium | 2001-06-05 | Not applicable | No public exploit | bctool in Jetico BestCrypt 0.7 and earlier trusts the user-supplied PATH to find and execute an fsck utility program, which allows local users to gain privileges by modifying the PATH to point to a Trojan horse program. |
| CVE-2001-0323 | Medium | 2001-06-02 | Not applicable | No public exploit | The ICMP path MTU (PMTU) discovery feature in various UNIX systems allows remote attackers to cause a denial of service by spoofing "ICMP Fragmentation needed but Don't Fragment (DF) set" packets between two target hosts, which could cause one host to lower its MTU when transmitting to the other host. |
| CVE-2001-0322 | Medium | 2001-06-02 | Not applicable | Working exploit published | MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a script that creates and deletes an object that is associated with the browser window object. |
| CVE-2001-0313 | Medium | 2001-06-02 | Not applicable | No public exploit | Borderware Firewall Server 6.1.2 allows remote attackers to cause a denial of service via a ping to the broadcast address of the public network on which the server is placed, which causes the server to continuously send pings (echo requests) to the network. |
| CVE-2001-0312 | Medium | 2001-06-02 | Not applicable | No public exploit | IBM WebSphere plugin for Netscape Enterprise server allows remote attackers to read source code for JSP files via an HTTP request that contains a host header that references a host that is not in WebSphere's host aliases list, which will bypass WebSphere processing. |
| CVE-2001-0311 | Medium | 2001-06-02 | Not applicable | Working exploit published | Vulnerability in OmniBackII A.03.50 in HP 11.x and earlier allows attackers to gain unauthorized access to an OmniBack client. |
| CVE-2001-0309 | Medium | 2001-06-02 | Not applicable | No public exploit | inetd in Red Hat 6.2 does not properly close sockets for internal services such as chargen, daytime, echo, etc., which allows remote attackers to cause a denial of service via a series of connections to the internal services. |
| CVE-2001-0258 | Medium | 2001-06-02 | Not applicable | No public exploit | The Easycom/Safecom Print Server (firmware 404.590) PrintGuide server allows remote attackers to cause a denial of service via a large number of connections that send null characters. |
| CVE-2001-0255 | Medium | 2001-06-02 | Not applicable | Working exploit published | FaSTream FTP++ Server 2.0 allows remote attackers to list arbitrary directories by using the "ls" command and including the drive letter name (e.g. C:) in the requested pathname. |
| CVE-2001-0254 | Medium | 2001-06-02 | Not applicable | No public exploit | FaSTream FTP++ Server 2.0 allows remote attackers to obtain the real pathname of the server via the "pwd" command. |
| CVE-2001-0253 | Medium | 2001-06-02 | Not applicable | Working exploit published | Directory traversal vulnerability in hsx.cgi program in iWeb Hyperseek 2000 allows remote attackers to read arbitrary files and directories via a .. (dot dot) attack in the show parameter. |
| CVE-2001-0252 | Medium | 2001-06-02 | Not applicable | No public exploit | iPlanet (formerly Netscape) Enterprise Server 4.1 allows remote attackers to cause a denial of service via a long HTTP GET request that contains many "/../" (dot dot) sequences. |
| CVE-2001-0251 | Medium | 2001-06-02 | Not applicable | No public exploit | The Web Publishing feature in Netscape Enterprise Server 3.x allows remote attackers to cause a denial of service via the REVLOG command. |
| CVE-2001-0250 | Medium | 2001-06-02 | Not applicable | Working exploit published | The Web Publishing feature in Netscape Enterprise Server 4.x and earlier allows remote attackers to list arbitrary directories under the web server root via the INDEX command. |
| CVE-2001-0230 | Medium | 2001-06-02 | Not applicable | No public exploit | Buffer overflow in dc20ctrl before 0.4_1 in FreeBSD, and possibly other operating systems, allows local users to gain privileges. |
| CVE-2001-0224 | Medium | 2001-06-02 | Not applicable | Working exploit published | Muscat Empower CGI program allows remote attackers to obtain the absolute pathname of the server via an invalid request in the DB parameter. |
| CVE-2001-0217 | Medium | 2001-06-02 | Not applicable | Working exploit published | Directory traversal vulnerability in PALS Library System pals-cgi program allows remote attackers to read arbitrary files via a .. (dot dot) in the documentName parameter. |
| CVE-2001-0215 | Medium | 2001-06-02 | Not applicable | Working exploit published | ROADS search.pl program allows remote attackers to read arbitrary files by specifying the file name in the form parameter and terminating the filename with a null byte. |
| CVE-2001-0214 | Medium | 2001-06-02 | Not applicable | Working exploit published | Way-board CGI program allows remote attackers to read arbitrary files by specifying the filename in the db parameter and terminating the filename with a null byte. |
| CVE-2001-0211 | Medium | 2001-06-02 | Not applicable | Working exploit published | Directory traversal vulnerability in WebSPIRS 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the sp.nextform parameter. |
| CVE-2001-0210 | Medium | 2001-06-02 | Not applicable | Working exploit published | Directory traversal vulnerability in commerce.cgi CGI program allows remote attackers to read arbitrary files via a .. (dot dot) attack in the page parameter. |
| CVE-2001-0208 | Medium | 2001-06-02 | Not applicable | Working exploit published | MicroFocus Cobol 4.1, with the AppTrack feature enabled, installs the mfaslmf directory and the nolicense file with insecure permissions, which allows local users to gain privileges by modifying files. |
| CVE-2001-0206 | Medium | 2001-06-02 | Not applicable | Working exploit published | Directory traversal vulnerability in Soft Lite ServerWorx 3.00 allows remote attackers to read arbitrary files by inserting a .. (dot dot) or ... into the requested pathname of an HTTP GET request. |
| CVE-2001-0204 | Medium | 2001-06-02 | Not applicable | No public exploit | Watchguard Firebox II allows remote attackers to cause a denial of service by establishing multiple connections and sending malformed PPTP packets. |
| CVE-2001-0157 | Medium | 2001-06-02 | Not applicable | No public exploit | Debugging utility in the backdoor mode of Palm OS 3.5.2 and earlier allows attackers with physical access to a Palm device to bypass access restrictions and obtain passwords, even if the system lockout mechanism is enabled. |
| CVE-2001-0151 | Medium | 2001-06-02 | Not applicable | Working exploit published | IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests. |
| CVE-2001-0150 | Medium | 2001-06-02 | Not applicable | Working exploit published | Internet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are specified by the web site, which could allow remote attackers to execute arbitrary commands if the IE client is using the Telnet client provided in Services for Unix (SFU) 2.0, which creates session transcripts. |