# CVEs published 2002-02-02

110 CVEs were published on February 2, 2002: 0 critical, 0 high. Days are UTC.

- [CVE-2001-0892](https://cve.now/CVE-2001-0892.md): Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the document (no CVSS)
- [CVE-2001-0893](https://cve.now/CVE-2001-0893.md): Acme mini\_httpd before 1.16 allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request wi (no CVSS)
- [CVE-2001-0897](https://cve.now/CVE-2001-0897.md): Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) before 5.47e allows remote attackers to steal user cookies via a (no CVSS)
- [CVE-2001-0898](https://cve.now/CVE-2001-0898.md): Opera 6.0 and earlier allows remote attackers to access sensitive information such as cookies and links for other domains via Javascript tha (no CVSS)
- [CVE-2001-0903](https://cve.now/CVE-2001-0903.md): Linear key exchange process in High-bandwidth Digital Content Protection (HDCP) System allows remote attackers to access data as plaintext, (no CVSS)
- [CVE-2001-0904](https://cve.now/CVE-2001-0904.md): Internet Explorer 5.5 and 6 with the Q312461 (MS01-055) patch modifies the HTTP\_USER\_AGENT (UserAgent) information that indicates that the p (no CVSS)
- [CVE-2001-0908](https://cve.now/CVE-2001-0908.md): CITRIX Metaframe 1.8 logs the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, wh (no CVSS)
- [CVE-2001-0910](https://cve.now/CVE-2001-0910.md): Legato Networker before 6.1 allows remote attackers to bypass access restrictions and gain privileges on the Networker interface by spoofing (no CVSS)
- [CVE-2001-0911](https://cve.now/CVE-2001-0911.md): PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by s (no CVSS)
- [CVE-2001-0913](https://cve.now/CVE-2001-0913.md): Format string vulnerability in Network Solutions Rwhoisd 1.5.7.2 and earlier, when using syslog, allows remote attackers to corrupt memory a (no CVSS)
- [CVE-2001-0915](https://cve.now/CVE-2001-0915.md): Format string vulnerability in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via format spec (no CVSS)
- [CVE-2001-0916](https://cve.now/CVE-2001-0916.md): Buffer overflow in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via a long check argument o (no CVSS)
- [CVE-2001-0919](https://cve.now/CVE-2001-0919.md): Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when (no CVSS)
- [CVE-2001-0922](https://cve.now/CVE-2001-0922.md): ndcgi.exe in Netdynamics 4.x through 5.x, and possibly earlier versions, allows remote attackers to steal session IDs and hijack user sessio (no CVSS)
- [CVE-2001-0923](https://cve.now/CVE-2001-0923.md): RPM Package Manager 4.0.x through 4.0.2.x allows an attacker to execute arbitrary code via corrupted data in the RPM file when the file is q (no CVSS)
- [CVE-2001-0924](https://cve.now/CVE-2001-0924.md): Directory traversal vulnerability in ifx CGI program in Informix Web DataBlade allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2001-0925](https://cve.now/CVE-2001-0925.md): The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an (no CVSS)
- [CVE-2001-0926](https://cve.now/CVE-2001-0926.md): SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in t (no CVSS)
- [CVE-2001-0927](https://cve.now/CVE-2001-0927.md): Format string vulnerability in the permitted function of GNOME libgtop\_daemon in libgtop 1.0.12 and earlier allows remote attackers to execu (no CVSS)
- [CVE-2001-0928](https://cve.now/CVE-2001-0928.md): Buffer overflow in the permitted function of GNOME gtop daemon (libgtop\_daemon) in libgtop 1.0.13 and earlier may allow remote attackers to (no CVSS)
- [CVE-2001-0930](https://cve.now/CVE-2001-0930.md): Sendpage.pl allows remote attackers to execute arbitrary commands via a message containing shell metacharacters. (no CVSS)
- [CVE-2001-0931](https://cve.now/CVE-2001-0931.md): Directory traversal vulnerability in Cooolsoft PowerFTP Server 2.03 allows attackers to list or read arbitrary files and directories via a . (no CVSS)
- [CVE-2001-0932](https://cve.now/CVE-2001-0932.md): Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code v (no CVSS)
- [CVE-2001-0933](https://cve.now/CVE-2001-0933.md): Cooolsoft PowerFTP Server 2.03 allows remote attackers to list the contents of arbitrary drives via a ls (LIST) command that includes the dr (no CVSS)
- [CVE-2001-0934](https://cve.now/CVE-2001-0934.md): Cooolsoft PowerFTP Server 2.03 allows remote attackers to obtain the physical path of the server root via the pwd command, which lists the f (no CVSS)
- [CVE-2001-0935](https://cve.now/CVE-2001-0935.md): Vulnerability in wu-ftpd 2.6.0, and possibly earlier versions, which is unrelated to the ftpglob bug described in CVE-2001-0550. (no CVSS)
- [CVE-2001-0937](https://cve.now/CVE-2001-0937.md): PGPMail.pl 1.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) recipient or (2) pgpuserid paramet (no CVSS)
- [CVE-2001-0938](https://cve.now/CVE-2001-0938.md): Directory traversal vulnerability in AspUpload 2.1, in certain configurations, allows remote attackers to upload and read arbitrary files, a (no CVSS)
- [CVE-2001-0941](https://cve.now/CVE-2001-0941.md): Buffer overflow in dbsnmp in Oracle 8.0.6 through 9.0.1 allows local users to execute arbitrary code via a long ORACLE\_HOME environment vari (no CVSS)
- [CVE-2001-0942](https://cve.now/CVE-2001-0942.md): dbsnmp in Oracle 8.1.6 and 8.1.7 uses the ORACLE\_HOME environment variable to find and execute the dbsnmp program, which allows local users (no CVSS)
- [CVE-2001-0943](https://cve.now/CVE-2001-0943.md): dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) ch (no CVSS)
- [CVE-2001-0944](https://cve.now/CVE-2001-0944.md): DDE in mIRC allows local users to launch applications under another user's account via a DDE message that executes a command, which may be e (no CVSS)
- [CVE-2001-0945](https://cve.now/CVE-2001-0945.md): Buffer overflow in Outlook Express 5.0 through 5.02 for Macintosh allows remote attackers to cause a denial of service via an e-mail message (no CVSS)
- [CVE-2001-0947](https://cve.now/CVE-2001-0947.md): Forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) 3.3 through 4.2.1 allows remote attackers to determine the real path (no CVSS)
- [CVE-2001-0948](https://cve.now/CVE-2001-0948.md): Cross-site scripting (CSS) vulnerability in ValiCert Enterprise Validation Authority (EVA) 3.3 through 4.2.1 allows remote attackers to exec (no CVSS)
- [CVE-2001-0949](https://cve.now/CVE-2001-0949.md): Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 allows r (no CVSS)
- [CVE-2001-0950](https://cve.now/CVE-2001-0950.md): ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate sessi (no CVSS)
- [CVE-2001-0952](https://cve.now/CVE-2001-0952.md): THQ Volition Red Faction Game allows remote attackers to cause a denial of service (hang) of a client or server via packets to UDP port 7755 (no CVSS)
- [CVE-2001-0953](https://cve.now/CVE-2001-0953.md): Kebi WebMail allows remote attackers to access the administrator menu and gain privileges via the /a/ hidden directory, which is installed u (no CVSS)
- [CVE-2001-0955](https://cve.now/CVE-2001-0955.md): Buffer overflow in fbglyph.c in XFree86 before 4.2.0, related to glyph clipping for large origins, allows attackers to cause a denial of ser (no CVSS)
- [CVE-2001-0956](https://cve.now/CVE-2001-0956.md): speechd 0.54 and earlier, with the Festival or rsynth speech synthesis package, allows attackers to execute arbitrary commands via shell met (no CVSS)
- [CVE-2001-0958](https://cve.now/CVE-2001-0958.md): Buffer overflows in eManager plugin for Trend Micro InterScan VirusWall for NT 3.51 and 3.51J allow remote attackers to execute arbitrary co (no CVSS)
- [CVE-2001-0964](https://cve.now/CVE-2001-0964.md): Buffer overflow in client for Half-Life 1.1.0.8 and earlier allows malicious remote servers to execute arbitrary code via a long console com (no CVSS)
- [CVE-2001-0966](https://cve.now/CVE-2001-0966.md): Directory traversal vulnerability in Nudester 1.10 and earlier allows remote attackers to read or write arbitrary files via a .. (no CVSS)
- [CVE-2001-0967](https://cve.now/CVE-2001-0967.md): Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes (no CVSS)
- [CVE-2001-0968](https://cve.now/CVE-2001-0968.md): Knox Arkeia server 4.2, and possibly other versions, installs its root user with a null password by default, which allows local and remote u (no CVSS)
- [CVE-2001-0970](https://cve.now/CVE-2001-0970.md): Cross-site scripting vulnerability in TDForum 1.2 CGI script (tdforum12.cgi) allows remote attackers to execute arbitrary script on other cl (no CVSS)
- [CVE-2001-0971](https://cve.now/CVE-2001-0971.md): Directory traversal vulnerability in ACI 4d webserver allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2001-0972](https://cve.now/CVE-2001-0972.md): Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privi (no CVSS)
- [CVE-2001-0974](https://cve.now/CVE-2001-0974.md): Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, (no CVSS)
- [CVE-2001-0975](https://cve.now/CVE-2001-0975.md): Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2001-0976](https://cve.now/CVE-2001-0976.md): Vulnerability in HP Process Resource Manager (PRM) C.01.08.2 and earlier, as used by HP-UX Workload Manager (WLM), allows local users to gai (no CVSS)
- [CVE-2001-0979](https://cve.now/CVE-2001-0979.md): Buffer overflow in swverify in HP-UX 11.0, and possibly other programs, allows local users to gain privileges via a long command line argume (no CVSS)
- [CVE-2001-0983](https://cve.now/CVE-2001-0983.md): UltraEdit uses weak encryption to record FTP passwords in the uedit32.ini file, which allows local users who can read the file to decrypt th (no CVSS)
- [CVE-2001-0984](https://cve.now/CVE-2001-0984.md): Password Safe 1.7(1) leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with (no CVSS)
- [CVE-2001-0985](https://cve.now/CVE-2001-0985.md): shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" (no CVSS)
- [CVE-2001-0986](https://cve.now/CVE-2001-0986.md): SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, fil (no CVSS)
- [CVE-2001-0988](https://cve.now/CVE-2001-0988.md): Arkeia backup server 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwr (no CVSS)
- [CVE-2001-0989](https://cve.now/CVE-2001-0989.md): Buffer overflows in Pileup before 1.2 allows local users to gain root privileges via (1) long command line arguments, or (2) a long callsign (no CVSS)
- [CVE-2001-0990](https://cve.now/CVE-2001-0990.md): Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a li (no CVSS)
- [CVE-2001-0991](https://cve.now/CVE-2001-0991.md): Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other (no CVSS)
- [CVE-2001-0992](https://cve.now/CVE-2001-0992.md): shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" paramete (no CVSS)
- [CVE-2001-0994](https://cve.now/CVE-2001-0994.md): Marconi ForeThought 7.1 allows remote attackers to cause a denial of service by causing both telnet sessions to be locked via unusual input (no CVSS)
- [CVE-2001-0996](https://cve.now/CVE-2001-0996.md): POP3Lite before 0.2.4 does not properly quote a . (no CVSS)
- [CVE-2001-0997](https://cve.now/CVE-2001-0997.md): Textor Webmasters Ltd listrec.pl CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the TEMPLATE (no CVSS)
- [CVE-2001-0999](https://cve.now/CVE-2001-0999.md): Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is te (no CVSS)
- [CVE-2001-1000](https://cve.now/CVE-2001-1000.md): rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to read arbitrary files v (no CVSS)
- [CVE-2001-1003](https://cve.now/CVE-2001-1003.md): Respondus 1.1.2 for WebCT uses weak encryption to remember usernames and passwords, which allows local users who can read the WEBCT.SVR file (no CVSS)
- [CVE-2001-1004](https://cve.now/CVE-2001-1004.md): Cross-site scripting (CSS) vulnerability in gnut Gnutella client before 0.4.27 allows remote attackers to execute arbitrary script on other (no CVSS)
- [CVE-2001-1005](https://cve.now/CVE-2001-1005.md): Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows a (no CVSS)
- [CVE-2001-1006](https://cve.now/CVE-2001-1006.md): Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA does not encrypt sensitive files and relies solely on its password feature to res (no CVSS)
- [CVE-2001-1007](https://cve.now/CVE-2001-1007.md): Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorre (no CVSS)
- [CVE-2001-1009](https://cve.now/CVE-2001-1009.md): Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory a (no CVSS)
- [CVE-2001-1012](https://cve.now/CVE-2001-1012.md): Vulnerability in screen before 3.9.10, related to a multi-attach error, allows local users to gain root privileges when there is a subdirect (no CVSS)
- [CVE-2001-1013](https://cve.now/CVE-2001-1013.md): Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no publi (no CVSS)
- [CVE-2001-1014](https://cve.now/CVE-2001-1014.md): eshop.pl in WebDiscount(e)shop allows remote attackers to execute arbitrary commands via shell metacharacters in the seite parameter. (no CVSS)
- [CVE-2001-1015](https://cve.now/CVE-2001-1015.md): Buffer overflow in Snes9x 1.37, when installed setuid root, allows local users to gain root privileges via a long command line argument. (no CVSS)
- [CVE-2001-1018](https://cve.now/CVE-2001-1018.md): Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address of the server when NAT is enabled via a GET reques (no CVSS)
- [CVE-2001-1019](https://cve.now/CVE-2001-1019.md): Directory traversal vulnerability in view\_item CGI program in sglMerchant 1.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2001-1021](https://cve.now/CVE-2001-1021.md): Buffer overflows in WS\_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to (1) DELE, (2) MDTM, (3) MLST, (4) MKD (no CVSS)
- [CVE-2001-1023](https://cve.now/CVE-2001-1023.md): Xcache 2.1 allows remote attackers to determine the absolute path of web server documents by requesting a URL that is not cached by Xcache, (no CVSS)
- [CVE-2001-1024](https://cve.now/CVE-2001-1024.md): login.gas.bat and other CGI scripts in Entrust getAccess allow remote attackers to execute Java programs, and possibly arbitrary commands, b (no CVSS)
- [CVE-2001-1025](https://cve.now/CVE-2001-1025.md): PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" variable when calling any scripts that do (no CVSS)
- [CVE-2001-1026](https://cve.now/CVE-2001-1026.md): Trend Micro InterScan AppletTrap 2.0 does not properly filter URLs when they are modified in certain ways such as (1) using a double slash ( (no CVSS)
- [CVE-2001-1031](https://cve.now/CVE-2001-1031.md): Directory traversal vulnerability in Meteor FTP 1.0 allows remote attackers to read arbitrary files via (1) a .. (no CVSS)
- [CVE-2001-1033](https://cve.now/CVE-2001-1033.md): Compaq TruCluster 1.5 allows remote attackers to cause a denial of service via a port scan from a system that does not have a DNS PTR record (no CVSS)
- [CVE-2001-1034](https://cve.now/CVE-2001-1034.md): Format string vulnerability in Hylafax on FreeBSD allows local users to execute arbitrary code via format specifiers in the -h hostname argu (no CVSS)
- [CVE-2001-1039](https://cve.now/CVE-2001-1039.md): The JetAdmin web interface for HP JetDirect does not set a password for the telnet interface when the admin password is changed, which allow (no CVSS)
- [CVE-2001-1040](https://cve.now/CVE-2001-1040.md): HP LaserJet, and possibly other JetDirect devices, resets the admin password when the device is turned off, which could allow remote attacke (no CVSS)
- [CVE-2001-1041](https://cve.now/CVE-2001-1041.md): oracle program in Oracle 8.0.x, 8.1.x and 9.0.1 allows local users to overwrite arbitrary files via a symlink attack on an Oracle log trace (no CVSS)
- [CVE-2001-1042](https://cve.now/CVE-2001-1042.md): Transsoft Broker 5.9.5.0 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the (no CVSS)
- [CVE-2001-1044](https://cve.now/CVE-2001-1044.md): Basilix Webmail 0.9.7beta, and possibly other versions, stores \*.class and \*.inc files under the document root and does not restrict access, (no CVSS)
- [CVE-2001-1045](https://cve.now/CVE-2001-1045.md): Directory traversal vulnerability in basilix.php3 in Basilix Webmail 1.0.3beta and earlier allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2001-1047](https://cve.now/CVE-2001-1047.md): Race condition in OpenBSD VFS allows local users to cause a denial of service (kernel panic) by (1) creating a pipe in one thread and causin (no CVSS)
- [CVE-2001-1050](https://cve.now/CVE-2001-1050.md): CCCSoftware CCC PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includ (no CVSS)
- [CVE-2001-1051](https://cve.now/CVE-2001-1051.md): Dark Hart Portal (darkportal) PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that s (no CVSS)
- [CVE-2001-1052](https://cve.now/CVE-2001-1052.md): Empris PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir vari (no CVSS)
- [CVE-2001-1057](https://cve.now/CVE-2001-1057.md): The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by conne (no CVSS)
- [CVE-2001-1058](https://cve.now/CVE-2001-1058.md): The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to bypass access control (specified by the -restrict argume (no CVSS)
- [CVE-2001-1060](https://cve.now/CVE-2001-1060.md): phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument (no CVSS)
- [CVE-2001-1061](https://cve.now/CVE-2001-1061.md): Vulnerability in lsmcode in unknown versions of AIX, possibly related to a usage error. (no CVSS)
- [CVE-2001-1064](https://cve.now/CVE-2001-1064.md): Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap allows remote attackers to cause a denial of service via multiple connections to (no CVSS)
- [CVE-2001-1065](https://cve.now/CVE-2001-1065.md): Web-based configuration utility in Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap binds itself to port 80 even when web-based c (no CVSS)
- [CVE-2001-1068](https://cve.now/CVE-2001-1068.md): qpopper 4.01 with PAM based authentication on Red Hat systems generates different error messages when an invalid username is provided instea (no CVSS)
- [CVE-2001-1070](https://cve.now/CVE-2001-1070.md): Sage Software MAS 200 allows remote attackers to cause a denial of service by connecting to port 10000 and entering a series of control char (no CVSS)
- [CVE-2001-1073](https://cve.now/CVE-2001-1073.md): Webridge PX Application Suite allows remote attackers to obtain sensitive information via a malformed request that generates a server error (no CVSS)
- [CVE-2001-1076](https://cve.now/CVE-2001-1076.md): Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME env (no CVSS)
- [CVE-2001-1077](https://cve.now/CVE-2001-1077.md): Buffer overflow in tt\_printf function of rxvt 2.6.2 allows local users to gain privileges via a long (1) -T or (2) -name argument. (no CVSS)
- [CVE-2001-1078](https://cve.now/CVE-2001-1078.md): Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format speci (no CVSS)
- [CVE-2001-1082](https://cve.now/CVE-2001-1082.md): Directory traversal vulnerability in Livingston/Lucent RADIUS before 2.1.va.1 may allow attackers to read arbitrary files via a .. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2002-02-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.