Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 79

Export CSV
CVE-2001-0889

security flaw

Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow remote attackers to execute arbitrary commands via shell metacharacters.

CVSS 2.0 · 7.5 High EPSS 6.4% KEV · Not listed
Vendors
Redhat University Of Cambridge
Products
Linux Powertools Exim
CVE-2001-0890

security flaw

Certain backend drivers in the SANE library 1.0.3 and earlier, as used in frontend software such as XSane, allows local users to modify files via a symlink attack on temporary files.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Sane
Products
Linux Powertools Sane
CVE-2001-0894

security flaw

Vulnerability in Postfix SMTP server before 20010228-pl07, when configured to email the postmaster when SMTP errors cause the session to terminate, allows remote attackers to cause a denial of service (memory exhaustion) by generating a large number of SMTP errors, which forces the SMTP session log to grow too large.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Wietse Venema
Products
Powertools Postfix
CVE-2001-1083

security flaw

Icecast 1.3.7, and other versions before 1.3.11 with HTTP server file streaming support enabled allows remote attackers to cause a denial of service (crash) via a URL that ends in . (dot), / (forward slash), or \ (backward slash).

CVSS 2.0 · 5.0 Medium EPSS 9.6% KEV · Not listed
Vendors
Icecast Redhat
Products
Icecast Powertools
CVE-2001-1227

security flaw

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags.

CVSS 2.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat Zope
Products
Linux Powertools Zope
CVE-2001-1230

security flaw

Buffer overflows in Icecast before 1.3.10 allow remote attackers to cause a denial of service (crash) and execute arbitrary code.

CVSS 2.0 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Icecast Redhat
Products
Icecast Powertools
CVE-2001-1333

security flaw

Linux CUPS before 1.1.6 does not securely handle temporary files, possibly due to a symlink vulnerability that could allow local users to overwrite files.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Easy Software Products Redhat
Products
Cups Powertools
CVE-2001-1376

security flaw

Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.

CVSS 2.0 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Ascend Freeradius Gnu and 10 more
Products
Radius Freeradius Radius and 10 more
CVE-2001-1377

security flaw

Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.

CVSS 2.0 · 5.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Freeradius Gnu Icradius and 9 more
Products
Freeradius Radius Icradius and 9 more
CVE-2001-1401

security flaw

Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1) process_bug.cgi, (2) show_activity.cgi, (3) showvotes.cgi, (4) showdependencytree.cgi, (5) showdependencygraph.cgi, (6) showattachment.cgi, or (7) describecomponents.cgi.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2001-1402

security flaw

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi, (2) the voteon, bug_id, and user variables for showvotes.cgi, (3) an invalid email address in createaccount.cgi, (4) an invalid ID in showdependencytree.cgi, (5) invalid usernames and other fields in process_bug.cgi, and (6) error messages in buglist.cgi.

CVSS 2.0 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2001-1403

security flaw

Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by "shoulder-surfing" and observing the web browser's location bar.

CVSS 2.0 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2001-1404

security flaw

Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain privileges.

CVSS 2.0 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2001-1405

security flaw

Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) via a flood of requests to sanitycheck.cgi.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2001-1406

security flaw

process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2001-1407

security flaw

Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds the user to the CC list of the restricted bug and allows the user to view the bug.

CVSS 2.0 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2002-0007

security flaw

CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which causes a null password to be sent to the LDAP server.

CVSS 2.0 · 10.0 Critical EPSS 2.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools
CVE-2002-0008

security flaw

Bugzilla before 2.14.1 allows remote attackers to (1) spoof a user comment via an HTTP request to process_bug.cgi using the "who" parameter, instead of the Bugzilla_login cookie, or (2) post a bug as another user by modifying the reporter parameter to enter_bug.cgi, which is passed to post_bug.cgi.

CVSS 2.0 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Mozilla Redhat
Products
Bugzilla Powertools