Overview 512 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 117 public PoC · 6 EPSS ≥ 0.5
512matches
2in Waratek scope0.4%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
117public PoC22.9%
6EPSS ≥ 0.51.2%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
0.4%
Outside Waratek scope
2
0.4%
Not applicable
508
99.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
512
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
117
22.9%
Proof of concept only
0
0.0%
Forecast only
4
0.8%
No public exploit
391
76.4%
split by
peak 182 / year
19901
Not applicable1
Low1
not blocked1
No public exploit1
19910
19921
Not applicable1
Low1
not blocked1
No public exploit1
19932
Not applicable2
Low2
not blocked2
No public exploit2
19941
Not applicable1
Low1
not blocked1
Working exploit published1
19951
Not applicable1
Low1
not blocked1
No public exploit1
19969
Not applicable9
Low9
not blocked9
No public exploit9
199719
Not applicable19
Low19
not blocked19
Working exploit published4
Forecast only2
No public exploit13
199823
Not applicable23
Low23
not blocked23
Working exploit published5
No public exploit18
1999111
Not applicable111
Low111
not blocked111
Working exploit published28
No public exploit83
200096
Not applicable96
Low96
not blocked96
Working exploit published34
No public exploit62
2001182
Outside Waratek scope2
Not applicable180
Low182
not blocked182
Working exploit published38
No public exploit144
200266
No exploit published2
Not applicable64
Low66
not blocked66
Working exploit published7
Forecast only2
No public exploit57
1990199219941996199820002002
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2002-1313 | Low | 2002-11-29 | Not applicable | No public exploit | nullmailer 1.00RC5 and earlier allows local users to cause a denial of service via an email to a local user that does not exist, which generates an error that causes nullmailer to stop sending mail to all users. |
| CVE-2002-1233 | Low | 2002-11-04 | Not applicable | No public exploit | A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131. |
| CVE-2002-1231 | Low | 2002-11-04 | Not applicable | No public exploit | SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to cause a denial of service via an rcp call on /proc. |
| CVE-2002-1193 | Low | 2002-10-28 | Not applicable | No public exploit | tkmail before 4.0beta9-8.1 allows local users to create or overwrite files as users via a symlink attack on temporary files. |
| CVE-2002-1589 | Low | 2002-10-24 | Not applicable | No public exploit | Unknown vulnerability in Solaris 8, when the 0x02 bit (aka TEST, KMF_DEADBEEF, or deadbeef) is set in the kmem_flags kernel parameter, allows local users to cause a denial of service (system panic). |
| CVE-2002-1109 | Low | 2002-10-04 | Not applicable | No public exploit | securetar, as used in AMaViS shell script 0.2.1 and earlier, allows users to cause a denial of service (CPU consumption) via a malformed TAR file, possibly via an incorrect file size parameter. |
| CVE-2002-1030 | Low | 2002-10-04 | No exploit published | No public exploit | Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections. |
| CVE-2002-1017 | Low | 2002-10-04 | Not applicable | No public exploit | Adobe eBook Reader 2.1 and 2.2 allows a user to copy eBooks to other systems by using the backup feature, capturing the encryption Challenge, and using the appropriate hash function to generate the activation code. |
| CVE-2002-0992 | Low | 2002-10-04 | Not applicable | No public exploit | Unknown vulnerability in IPV6 functionality for DCE daemons (1) dced or (2) rpcd on HP-UX 11.11 allows attackers to cause a denial of service (crash) via an attack that modifies internal data. |
| CVE-2002-0915 | Low | 2002-10-04 | Not applicable | No public exploit | autorun in Xandros based Linux distributions allows local users to read the first line of arbitrary files via the -c parameter, which causes autorun to print the first line of the file. |
| CVE-2002-0887 | Low | 2002-10-04 | Not applicable | Working exploit published | scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files. |
| CVE-2002-0881 | Low | 2002-10-04 | Not applicable | No public exploit | Cisco IP Phone (VoIP) models 7910, 7940, and 7960 use a default administrative password, which allows attackers with physical access to the phone to modify the configuration settings. |
| CVE-2002-0662 | Low | 2002-10-04 | Not applicable | No public exploit | scrollkeeper-get-cl in ScrollKeeper 0.3 to 0.3.11 allows local users to create and overwrite files via a symlink attack on the scrollkeeper-tempfile.x temporary files. |
| CVE-2002-1126 | Low | 2002-09-24 | Not applicable | No public exploit | Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler. |
| CVE-2002-1125 | Low | 2002-09-24 | Not applicable | Working exploit published | FreeBSD port programs that use libkvm for FreeBSD 4.6.2-RELEASE and earlier, including (1) asmon, (2) ascpu, (3) bubblemon, (4) wmmon, and (5) wmnet2, leave open file descriptors for /dev/mem and /dev/kmem, which allows local users to read kernel memory. |
| CVE-2002-0875 | Low | 2002-09-05 | Not applicable | Working exploit published | Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to the root group. |
| CVE-2002-0871 | Low | 2002-09-05 | Not applicable | No public exploit | xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe. |
| CVE-2002-1610 | Low | 2002-08-30 | Not applicable | No public exploit | Unknown vulnerability in ping in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to cause a denial of service. |
| CVE-2002-1444 | Low | 2002-08-15 | Not applicable | Working exploit published | The Google toolbar 1.1.60, when running on Internet Explorer 5.5 and 6.0, allows remote attackers to cause a denial of service (crash with an exception in oleaut32.dll) via malicious HTML, possibly related to small width and height parameters or an incorrect call to the Google.Search() function. |
| CVE-2002-0831 | Low | 2002-08-12 | Not applicable | No public exploit | The kqueue mechanism in FreeBSD 4.3 through 4.6 STABLE allows local users to cause a denial of service (kernel panic) via a pipe call in which one end is terminated and an EVFILT_WRITE filter is registered for the other end. |
| CVE-2002-0806 | Low | 2002-08-12 | Not applicable | No public exploit | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with the "del" option. |
| CVE-2002-0798 | Low | 2002-08-12 | Not applicable | No public exploit | Vulnerability in swinstall for HP-UX 11.00 and 11.11 allows local users to view obtain data views for files that cannot be directly read by the user, which reportedly can be used to cause a denial of service. |
| CVE-2002-0795 | Low | 2002-08-12 | Not applicable | No public exploit | The rc system startup script for FreeBSD 4 through 4.5 allows local users to delete arbitrary files via a symlink attack on X Windows lock files. |
| CVE-2002-0790 | Low | 2002-08-12 | Not applicable | No public exploit | clchkspuser and clpasswdremote in AIX expose an encrypted password in the cspoc.log file, which could allow local users to gain privileges. |
| CVE-2002-0761 | Low | 2002-08-12 | Not applicable | No public exploit | bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended. |
| CVE-2002-0760 | Low | 2002-08-12 | Not applicable | No public exploit | Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive, which could allow local users to read the files as they are being decompressed. |
| CVE-2002-0507 | Low | 2002-08-12 | Not applicable | No public exploit | An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a previous user via several submissions of an OWA Authentication request with the proper OWA password for the previous user, which is eventually accepted by OWA. |
| CVE-2002-0499 | Low | 2002-08-12 | Not applicable | Working exploit published | The d_path function in Linux kernel 2.2.20 and earlier, and 2.4.18 and earlier, truncates long pathnames without generating an error, which could allow local users to force programs to perform inappropriate operations on the wrong directories. |
| CVE-2002-0497 | Low | 2002-08-12 | Not applicable | No public exploit | Buffer overflow in mtr 0.46 and earlier, when installed setuid root, allows local users to access a raw socket via a long MTR_OPTIONS environment variable. |
| CVE-2002-0430 | Low | 2002-08-12 | Not applicable | Working exploit published | MultiFileUploadHandler.php in the Sun Cobalt RaQ XTR administration interface allows local users to bypass authentication and overwrite arbitrary files via a symlink attack on a temporary file, followed by a request to MultiFileUpload.php. |
| CVE-2002-0429 | Low | 2002-08-12 | Not applicable | No public exploit | The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary processes via a a binary compatibility interface (lcall). |
| CVE-2002-0422 | Low | 2002-08-12 | Not applicable | Forecast only | IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header. |
| CVE-2002-0415 | Low | 2002-08-12 | Not applicable | No public exploit | Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read files that are accessible to RealPlayer via a .. (dot dot) in an HTTP GET request to port 1275. |
| CVE-2002-0435 | Low | 2002-07-26 | Not applicable | No public exploit | Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local users to delete directories as the user running fileutils by moving a low-level directory to a higher level as it is being deleted, which causes fileutils to chdir to a ".." directory that is higher than expected, possibly up to the root file system. |
| CVE-2002-0701 | Low | 2002-07-23 | Not applicable | No public exploit | ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges. |
| CVE-2002-0570 | Low | 2002-07-03 | Not applicable | No public exploit | The encrypted loop device in Linux kernel 2.4.10 and earlier does not authenticate the entity that is encrypting data, which allows local users to modify encrypted data without knowing the key. |
| CVE-2002-0568 | Low | 2002-07-03 | No exploit published | Forecast only | Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory. |
| CVE-2002-0334 | Low | 2002-06-25 | Not applicable | No public exploit | xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file. |
| CVE-2002-0577 | Low | 2002-06-18 | Not applicable | No public exploit | Vulnerability in passwd for HP-UX 11.00 and 11.11 allows local users to corrupt the password file and cause a denial of service. |
| CVE-2002-0389 | Low | 2002-06-18 | Not applicable | No public exploit | Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives. |
| CVE-2002-0042 | Low | 2002-06-18 | Not applicable | No public exploit | Vulnerability in the XFS file system for SGI IRIX before 6.5.12 allows local users to cause a denial of service (hang) by creating a file that is not properly processed by XFS. |
| CVE-2002-0296 | Low | 2002-05-31 | Not applicable | Working exploit published | The installation of Tarantella Enterprise 3 allows local users to overwrite arbitrary files via a symlink attack on the "spinning" temporary file. |
| CVE-2002-0294 | Low | 2002-05-31 | Not applicable | No public exploit | Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system. |
| CVE-2002-0292 | Low | 2002-05-31 | Not applicable | No public exploit | Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field. |
| CVE-2002-0284 | Low | 2002-05-31 | Not applicable | No public exploit | Winamp 2.78 and 2.77, when opening a wma file that requires a license, sends the full path of the Temporary Internet Files directory to the web page that is processing the license, which could allow malicious web servers to obtain the pathname. |
| CVE-2002-0377 | Low | 2002-05-29 | Not applicable | No public exploit | Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files. |
| CVE-2002-0355 | Low | 2002-05-29 | Not applicable | No public exploit | netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions. |
| CVE-2002-0271 | Low | 2002-05-29 | Not applicable | No public exploit | Runtime library in GNU Ada compiler (GNAT) 3.12p through 3.14p allows local users to modify files of other users via a symlink attack on temporary files. |
| CVE-2002-0234 | Low | 2002-05-29 | Not applicable | No public exploit | NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trusted network to cause a denial of service (resource exhaustion) via a port scan to an external network, which consumes all available connections. |
| CVE-2002-0214 | Low | 2002-05-16 | Not applicable | No public exploit | Compaq Intel PRO/Wireless 2011B LAN USB Device Driver 1.5.16.0 through 1.5.18.0 stores the 128-bit WEP (Wired Equivalent Privacy) key in plaintext in a registry key with weak permissions, which allows local users to decrypt network traffic by reading the WEP key from the registry key. |
| CVE-2002-0213 | Low | 2002-05-16 | Not applicable | No public exploit | xkas in Xinet K-AShare 0.011.01 for IRIX allows local users to read arbitrary files via a symlink attack on the VOLICON file, which is copied to the .HSicon file in a shared directory. |
| CVE-2002-0202 | Low | 2002-05-16 | Not applicable | No public exploit | PaintBBS 1.2 installs certain files and directories with insecure permissions, which allows local users to (1) obtain the encrypted server password via the world-readable oekakibbs.conf file, or (2) modify the server configuration via the world-writeable /oekaki/ folder. |
| CVE-2002-0172 | Low | 2002-05-16 | Not applicable | No public exploit | /dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions (644), which could allow a local user to cause a denial of service (traffic disruption). |
| CVE-2002-0040 | Low | 2002-03-28 | Not applicable | No public exploit | Vulnerability in SGI IRIX 6.5.11 through 6.5.15f allows local users to cause privileged applications to dump core via the HOSTALIASES environment variable, which might allow the users to gain privileges. |
| CVE-2002-0141 | Low | 2002-03-25 | Not applicable | No public exploit | Maelstrom GPL 3.0.1 allows local users to overwrite arbitrary files of other Maelstrom users via a symlink attack on the /tmp/f file. |
| CVE-2002-0138 | Low | 2002-03-25 | Not applicable | No public exploit | CDRDAO 1.1.4 and 1.1.5 allows local users to read arbitrary files via the show-data command. |
| CVE-2002-0129 | Low | 2002-03-25 | Not applicable | No public exploit | efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message. |
| CVE-2002-0121 | Low | 2002-03-25 | Not applicable | No public exploit | PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections. |
| CVE-2002-0120 | Low | 2002-03-25 | Not applicable | No public exploit | Apple Palm Desktop 4.0b76 and 4.0b77 creates world-readable backup files and folders when a hotsync is performed, which could allow a local user to obtain sensitive information. |
| CVE-2002-0110 | Low | 2002-03-25 | Not applicable | No public exploit | Nevrona Designs MiraMail 1.04 and earlier stores authentication information such as POP usernames and passwords in plaintext in a .ini file, which allows an attacker to gain privileges by reading the passwords from the file. |
| CVE-2002-0087 | Low | 2002-03-15 | Not applicable | No public exploit | bindsock in Lotus Domino 5.07 on Solaris allows local users to create arbitrary files via a symlink attack on temporary files. |
| CVE-2002-0080 | Low | 2002-03-15 | Not applicable | No public exploit | rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed. |
| CVE-2002-0069 | Low | 2002-03-08 | Not applicable | No public exploit | Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service. |
| CVE-2001-1079 | Low | 2002-02-13 | Not applicable | No public exploit | create_keyfiles in PSSP 3.2 with DCE 3.1 authentication on AIX creates keyfile directories with world-writable permissions, which could allow a local user to delete key files and cause a denial of service. |
| CVE-2002-0044 | Low | 2002-01-31 | Not applicable | No public exploit | GNU Enscript 1.6.1 and earlier allows local users to overwrite arbitrary files of the Enscript user via a symlink attack on temporary files. |
| CVE-2001-0887 | Low | 2002-01-15 | Not applicable | No public exploit | xSANE 0.81 and earlier allows local users to modify files of other xSANE users via a symlink attack on temporary files. |
| CVE-2001-1578 | Low | 2001-12-31 | Not applicable | No public exploit | Unknown vulnerability in SCO OpenServer 5.0.6 and earlier allows local users to modify critical information such as certain CPU registers and segment descriptors. |
| CVE-2001-1570 | Low | 2001-12-31 | Not applicable | No public exploit | Windows XP with fast user switching and account lockout enabled allows local users to deny user account access by setting the fast user switch to the same user (self) multiple times, which causes other accounts to be locked out. |
| CVE-2001-1565 | Low | 2001-12-31 | Not applicable | No public exploit | Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which allows local users to obtain authentication information via the ps command. |
| CVE-2001-1564 | Low | 2001-12-31 | Not applicable | No public exploit | setrlimit in HP-UX 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11 does not properly enforce core file size on processes after setuid or setgid privileges are dropped, which could allow local users to cause a denial of service by exhausting available disk space. |
| CVE-2001-1560 | Low | 2001-12-31 | Not applicable | Working exploit published | Win32k.sys (aka Graphics Device Interface (GDI)) in Windows 2000 and XP allows local users to cause a denial of service (system crash) by calling the ShowWindow function after receiving a WM_NCCREATE message. |
| CVE-2001-1551 | Low | 2001-12-31 | Not applicable | No public exploit | Linux kernel 2.2.19 enables CAP_SYS_RESOURCE for setuid processes, which allows local users to exceed disk quota restrictions during execution of setuid programs. |
| CVE-2001-1550 | Low | 2001-12-31 | Not applicable | No public exploit | CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to obtain cleartext passwords from decoded log files and impersonate users. |
| CVE-2001-1549 | Low | 2001-12-31 | Not applicable | Working exploit published | Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters. |
| CVE-2001-1548 | Low | 2001-12-31 | Not applicable | No public exploit | ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters. |
| CVE-2001-1534 | Low | 2001-12-31 | Not applicable | No public exploit | mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication. |
| CVE-2001-1527 | Low | 2001-12-31 | Not applicable | No public exploit | easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and gain access. |
| CVE-2001-1521 | Low | 2001-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 allows remote attackers to inject arbitrary web script or HTML via the uname parameter. |
| CVE-2001-1520 | Low | 2001-12-31 | Not applicable | No public exploit | Xircom REX 6000 allows local users to obtain the 10 digit PIN by starting a serial monitor, connecting to the personal digital assistant (PDA) via Rextools, and capturing the cleartext PIN. |
| CVE-2001-1519 | Low | 2001-12-31 | Not applicable | Working exploit published | RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it |
| CVE-2001-1518 | Low | 2001-12-31 | Not applicable | Working exploit published | RunAs (runas.exe) in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service (RunAs hang) by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the vendor also presents a scenario in which other users could be affected if running on a Terminal Server. Therefore this is a vulnerability. |
| CVE-2001-1517 | Low | 2001-12-31 | Not applicable | No public exploit | RunAs (runas.exe) in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it, and the original researcher did not respond to requests for additional information |
| CVE-2001-1503 | Low | 2001-12-31 | Not applicable | No public exploit | The finger daemon (in.fingerd) in Sun Solaris 2.5 through 8 and SunOS 5.5 through 5.8 allows remote attackers to list all accounts on a host by typing finger 'a b c d e f g h'@host. |
| CVE-2001-1497 | Low | 2001-12-31 | Not applicable | No public exploit | Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack. |
| CVE-2001-1479 | Low | 2001-12-31 | Not applicable | No public exploit | smcboot in Sun SMC (Sun Management Center) 2.0 in Solaris 8 allows local users to delete arbitrary files via a symlink attack on /tmp/smc$SMC_PORT. |
| CVE-2001-1225 | Low | 2001-12-26 | Not applicable | No public exploit | Hughes Technology Mini SQL 2.0.10 through 2.0.12 allows local users to cause a denial of service by creating a very large array in a table, which causes miniSQL to crash when the table is queried. |
| CVE-2001-1218 | Low | 2001-12-20 | Not applicable | No public exploit | Microsoft Internet Explorer for Unix 5.0SP1 allows local users to possibly cause a denial of service (crash) in CDE or the X server on Solaris 2.6 by rapidly scrolling Chinese characters or maximizing the window. |
| CVE-2001-0890 | Low | 2001-12-11 | Not applicable | No public exploit | Certain backend drivers in the SANE library 1.0.3 and earlier, as used in frontend software such as XSane, allows local users to modify files via a symlink attack on temporary files. |
| CVE-2001-0837 | Low | 2001-12-06 | Not applicable | No public exploit | DeltaThree Pc-To-Phone 3.0.3 places sensitive data in world-readable locations in the installation directory, which allows local users to read the information in (1) temp.html, (2) the log folder, and (3) the PhoneBook folder. |
| CVE-2001-0832 | Low | 2001-12-06 | Outside Waratek scope | No public exploit | Vulnerability in Oracle 8.0.x through 9.0.1 on Unix allows local users to overwrite arbitrary files, possibly via a symlink attack or incorrect file permissions in (1) the ORACLE_HOME/rdbms/log directory or (2) an alternate directory as specified in the ORACLE_HOME environmental variable, aka the "Oracle File Overwrite Security Vulnerability." |
| CVE-2001-0809 | Low | 2001-12-06 | Not applicable | No public exploit | Vulnerability in CIFS/9000 Server (SAMBA) A.01.06 and earlier in HP-UX 11.0 and 11.11, when configured as a print server, allows local users to overwrite arbitrary files by modifying certain resources. |
| CVE-2001-0807 | Low | 2001-12-06 | Not applicable | No public exploit | Internet Explorer 5.0, and possibly other versions, may allow remote attackers (malicious web pages) to read known text files from a client's hard drive via a SCRIPT tag with a SRC value that points to the text file. |
| CVE-2001-0806 | Low | 2001-12-06 | Not applicable | No public exploit | Apple MacOS X 10.0 and 10.1 allow a local user to read and write to a user's desktop folder via insecure default permissions for the Desktop when it is created in some languages. |
| CVE-2001-0946 | Low | 2001-12-04 | Not applicable | No public exploit | apmscript in Apmd in Red Hat 7.2 "Enigma" allows local users to create or change the modification dates of arbitrary files via a symlink attack on the LOW_POWER temporary file, which could be used to cause a denial of service, e.g. by creating /etc/nologin and disabling logins. |
| CVE-2001-0921 | Low | 2001-11-21 | Not applicable | No public exploit | Netscape 4.79 and earlier for MacOS allows an attacker with access to the browser to obtain passwords from form fields by printing the document into which the password has been typed, which is printed in cleartext. |
| CVE-2001-0914 | Low | 2001-11-21 | Not applicable | No public exploit | Linux kernel before 2.4.11pre3 in multiple Linux distributions allows local users to cause a denial of service (crash) by starting the core vmlinux kernel, possibly related to poor error checking during ELF loading. |
| CVE-2001-1387 | Low | 2001-11-05 | Not applicable | No public exploit | iptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "--reject-with tcp-reset," which causes iptables to generate different responses than specified by the administrator, possibly leading to an information leak. |
| CVE-2001-0715 | Low | 2001-10-30 | Not applicable | No public exploit | Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to obtain potentially sensitive information about the mail queue by setting debugging flags to enable debug mode. |
| CVE-2001-0714 | Low | 2001-10-30 | Not applicable | No public exploit | Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to cause a denial of service (data loss) by (1) setting a high initial message hop count option (-h), which causes Sendmail to drop queue entries, (2) via the -qR option, or (3) via the -qS option. |
| CVE-2001-0666 | Low | 2001-10-30 | Not applicable | No public exploit | Outlook Web Access (OWA) in Microsoft Exchange 2000 allows an authenticated user to cause a denial of service (CPU consumption) via a malformed OWA request for a deeply nested folder within the user's mailbox. |