DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-1178
Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\ (dot-dot backslash) sequences in an HTTP request to the cgi-bin directory.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jetty_http_server
References: http://groups.yahoo.com/group/jetty-announce/message/45, http://marc.info/?l=bugtraq&m=103358725813039&w=2, http://www.iss.net/security_center/static/10246.php
CVE-2002-0645
SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sql_server, data_engine
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-038, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-038
CVE-2002-1410
Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of admin.cgi, or (2) reconfigure Guestbook via direct access of config.cgi.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ben_chivers_guestbook, easy_guestbook
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0356.html, http://www.iss.net/security_center/static/9697.php, http://www.securityfocus.com/bid/5341
CVE-2002-2227
Buffer underflow in ssldump 0.9b2 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted SSLv2 challenge value.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ssldump
Related CWEs: CWE-787
References: http://www.rtfm.com/ssldump/, http://www.securityfocus.com/archive/1/291329, http://www.securityfocus.com/bid/5693
CWE: CWE-787
CVE-2002-1951
Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirectories.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: goahead_webserver
References: http://freecode.com/projects/embedthis-goahead-webserver/releases/343539, http://osvdb.org/81099, http://www.iss.net/security_center/static/9884.php
CVE-2002-0663
Buffer overflow in HTTP Proxy for Symantec Norton Personal Internet Firewall 3.0.4.91 and Norton Internet Security 2001 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large outgoing HTTP request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: norton_internet_security, norton_personal_firewall
References: http://securityresponse.symantec.com/avcenter/security/Content/2002.07.15.html, http://www.atstake.com/research/advisories/2002/a071502-1.txt, http://www.iss.net/security_center/static/9579.php
CVE-2002-0999
Multiple SQL injection vulnerabilities in CARE 2002 before beta 1.0.02 allow remote attackers to perform unauthorized database operations.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: care_2002
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0128.html, http://www.care2x.com/modul.php?thispage=headlines&m_titel=NEWS&m_item=Headlines&lang=en, http://www.iss.net/security_center/static/9553.php
CWE: CWE-89
CVE-2002-1929
Cross-site scripting (XSS) vulnerability in pafiledb.php in PHP Arena paFileDB 1.1.3 through 3.0 allows remote attackers to inject arbitrary web script or HTML via the query string in the (1) rate, (2) email, or (3) download actions.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: pafiledb
References: http://online.securityfocus.com/archive/1/296387, http://www.iss.net/security_center/static/10416.php, http://www.securiteam.com/unixfocus/6J00Q0A5PK.html
CVE-2002-2266
NetScreen ScreenOS 2.8 through 4.0, when forwarding H.323 or Netmeeting traffic, allows remote attackers to cause a denial of service (firewall session table consumption) by establishing multiple half-open H.323 sessions, which are not cleaned up on garbage removal and do not time out for 36 hours.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: screenos
References: http://marc.info/?l=bugtraq&m=103827647621729&w=2, http://www.securityfocus.com/bid/6250, https://exchange.xforce.ibmcloud.com/vulnerabilities/10700
CVE-2002-1533
Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (%0a).
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: jetty
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0337.html, http://www.iss.net/security_center/static/10219.php, http://www.securityfocus.com/bid/5821
CVE-2002-0778
The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connections to allowed IP addresses while hiding the actual source IP.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cache_engine_550, cache_engine_505, content_distribution_manager_4650, content_distribution_manager_4630, enterprise_content_delivery_network_software
References: http://www.cisco.com/warp/public/707/transparentcache-tcp-relay-vuln-pub.shtml, http://www.iss.net/security_center/static/9082.php, http://www.securityfocus.com/bid/4751
CVE-2002-1878
PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the inc_dir parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: w-agora
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0055.html, http://www.ifrance.com/kitetoua/tuto/W-Agora.txt, http://www.iss.net/security_center/static/9317.php
CVE-2002-1853
Cross-site scripting (XSS) vulnerability in MyNewsGroups 0.4 and 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the subject of a newsgroup post, which is not properly handled by (1) myarticles.php, (2) search.php, (3) stats.php, or (4) standard.lib.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mynewsgroups
References: http://secunia.com/advisories/7177, http://www.iss.net/security_center/static/10238.php, http://www.securityfocus.com/archive/1/293564
CVE-2002-1255
Microsoft Outlook 2002 allows remote attackers to cause a denial of service (repeated failure) via an email message with a certain invalid header field that is accessed using POP3, IMAP, or WebDAV, aka "E-mail Header Processing Flaw Could Cause Outlook 2002 to Fail."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: outlook
References: http://www.securityfocus.com/bid/6319, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-067, https://exchange.xforce.ibmcloud.com/vulnerabilities/10763
CVE-2002-1235
The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: debian_linux, kerberos_5, kth_kerberos_4, kth_kerberos_5
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-026.txt.asc, http://archives.neohapsis.com/archives/bugtraq/2002-10/0399.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000534
CVE-2002-0943
MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: metacart2.sql
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0200.html, http://www.iss.net/security_center/static/9393.php, http://www.securityfocus.com/bid/5042
CVE-2002-0401
SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, ethereal
Related CWEs: CWE-476
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt, http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505, http://marc.info/?l=bugtraq&m=102268626526119&w=2
CWE: CWE-476
CVE-2002-2074
SQL injection vulnerability in Mailidx before 20020105 allows remote attackers to execute arbitrary SQL commands via the search web page.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mailidx
References: http://dl.droso.net/mailidx-20020105.tar.gz, http://securitytracker.com/id?1003269, http://www.iss.net/security_center/static/7965.php
CVE-2002-0471
PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the a_query variable.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: phpnettoolpack
References: http://seclists.org/bugtraq/2002/Mar/0263.html, http://www.iss.net/security_center/static/8482.php, http://www.securityfocus.com/bid/4303
CVE-2002-1720
SQL injection vulnerability in Spooky Login 2.0 through 2.5 allows remote attackers to bypass authentication and gain privileges via the password field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: spooky_login
References: http://www.securiteam.com/windowsntfocus/5VP030K75G.html, http://www.securityfocus.com/bid/4661, https://exchange.xforce.ibmcloud.com/vulnerabilities/8991
CVE-2002-0463
home.php in ARSC (Really Simple Chat) 1.0.1 and earlier allows remote attackers to determine the full pathname of the web server via an invalid language in the arsc_language parameter, which leaks the pathname in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: arsc_really_simple_chat
References: http://www.iss.net/security_center/static/8472.php, http://www.securityfocus.com/archive/1/262652, http://www.securityfocus.com/archive/1/262802
CVE-2002-1082
The Image Upload capability for ezContents 1.40 and earlier allows remote attackers to cause ezContents to perform operations on local files as if they were uploaded.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: ezcontents
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0040.html, http://online.securityfocus.com/archive/1/284229, http://www.iss.net/security_center/static/9698.php
CVE-2002-1366
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x, cups
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html, http://marc.info/?l=bugtraq&m=104032149026670&w=2, http://www.debian.org/security/2003/dsa-232
CVE-2002-0583
WorkforceROI Xpede 4.1 uses a small random namespace (5 alphanumeric characters) for temporary expense claim reports in the /reports/temp directory, which allows remote attackers to read the reports via a brute force attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: xpede
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html, http://www.iss.net/security_center/static/8905.php, http://www.securityfocus.com/bid/4554
CVE-2002-2398
The new thread posting page in APBoard 2.02 and 2.03 allows remote attackers to post messages to protected forums by modifying the insertinto parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: apboard
References: http://online.securityfocus.com/archive/1/299536, http://securityreason.com/securityalert/3332, http://www.iss.net/security_center/static/10611.php
CVE-2002-2256
Directory traversal vulnerability in pWins Webserver 0.2.5 and earlier allows remote attackers to read arbitrary files via Unicode characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: pwins
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0347.html, http://www.securityfocus.com/bid/6271, https://exchange.xforce.ibmcloud.com/vulnerabilities/10724
CWE: CWE-22
CVE-2002-1911
ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of SYN packets (SYN flood).  NOTE: the vendor was not able to reproduce the issue.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: zonealarm
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0238.html, http://www.iss.net/security_center/static/10379.php, http://www.securityfocus.com/archive/1/295434
CVE-2002-0048
Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: rsync
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:10.rsync.asc, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000458, http://lists.suse.com/archives/suse-security-announce/2002-Jan/0003.html
CVE-2002-0919
CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privileges via newlines in the title field of the edit page.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cspassword
References: http://online.securityfocus.com/archive/1/274727, http://www.iss.net/security_center/static/9222.php, http://www.securityfocus.com/bid/4888
CVE-2002-1715
SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ssh, ssh2
References: http://online.securityfocus.com/archive/1/268446, http://www.securityfocus.com/bid/4547, https://exchange.xforce.ibmcloud.com/vulnerabilities/8908
CVE-2002-1078
Abyss Web Server 1.0.3 allows remote attackers to list directory contents via an HTTP GET request that ends in a large number of / (slash) characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: abyss_web_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0043.html, http://online.securityfocus.com/archive/1/284904, http://www.iss.net/security_center/static/9721.php
CVE-2002-1742
SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: soap_lite
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A02.asc, http://online.securityfocus.com/archive/1/267051, http://use.perl.org/articles/02/04/09/000212.shtml?tid=5
CVE-2002-0829
Integer overflow in the Berkeley Fast File System (FFS) in FreeBSD 4.6.1 RELEASE-p4 and earlier allows local users to access arbitrary file contents within FFS to gain privileges by creating a file that is larger than allowed by the virtual memory system.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freebsd
References: http://marc.info/?l=bugtraq&m=102865404413458&w=2, http://www.iss.net/security_center/static/9771.php, http://www.osvdb.org/5073
CVE-2002-0504
Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other clients via the NFuse_Application parameter to (1) launch.jsp or (2) launch.asp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: nfuse
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0334.html, http://www.iss.net/security_center/static/8659.php, http://www.securityfocus.com/bid/4372
CVE-2002-1219
Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bind, openbsd, freebsd
References: ftp://patches.sgi.com/support/free/security/advisories/20021201-01-P, http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21469, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000546
CVE-2002-0618
The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code in the Local Computer zone by embedding HTML scripts within an Excel workbook that contains an XSL stylesheet, aka "Excel XSL Stylesheet Script Execution".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: excel, office
References: http://marc.info/?l=ntbugtraq&m=102256054320377&w=2, http://www.guninski.com/ex%24el2.html, http://www.iss.net/security_center/static/9399.php
CVE-2002-0100
AOL AOLserver 3.4.2 Win32 allows remote attackers to bypass authentication and read password-protected files via a URL that directly references the file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aol_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0005.html, http://marc.info/?l=bugtraq&m=101038936305397&w=2, http://marc.info/?l=ntbugtraq&m=101062823205474&w=2
CVE-2002-0411
Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aeromail
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0004.html, http://the.cushman.net/projects/aeromail/download/aeromail-1.45.tar.gz, http://www.iss.net/security_center/static/8346.php
CVE-2002-0226
retrieve_password.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to request a new password on behalf of another user and use the sessionID to calculate the new password for that user.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dcforum
References: http://marc.info/?l=bugtraq&m=101258311519504&w=2, http://www.dcscripts.com/bugtrac/DCForumID7/3.html, http://www.iss.net/security_center/static/8044.php
CVE-2002-2286
The parse-get function in utils.c for apt-www-proxy 0.1 allows remote attackers to cause a denial of service (crash) via an empty HTTP request, which causes a null dereference.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: apt-www-proxy
Related CWEs: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0081.html, http://www.securityfocus.com/bid/6339, https://exchange.xforce.ibmcloud.com/vulnerabilities/10816
CWE: CWE-189
CVE-2002-0752
CGIscript.net csMailto.cgi program exports feedback to a file that is accessible from the web document root, which could allow remote attackers to obtain sensitive information by directly accessing the file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: csmailto
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0326.html, http://archives.neohapsis.com/archives/bugtraq/2002-04/0326.html
CVE-2002-2012
Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: http_server
References: http://www.iss.net/security_center/static/7810.php, http://www.securityfocus.com/advisories/3761, http://www.securityfocus.com/bid/3796
CVE-2002-2066
BestCrypt BCWipe 1.0.7 and 2.0 through 2.35.1 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: bcwipe
Related CWEs: CWE-459
References: http://www.bcwipe.com/, http://www.ciac.org/ciac/bulletins/m-034.shtml, http://www.iss.net/security_center/static/7953.php
CWE: CWE-459
CVE-2002-2010
Cross-site scripting (XSS) vulnerability in htsearch.cgi in htdig (ht://Dig) 3.1.5, 3.1.6, and 3.2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: htdig
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0321.html, http://www.iss.net/security_center/static/9433.php, http://www.securityfocus.com/bid/5091
CVE-2002-1380
Linux kernel 2.2.x allows local users to cause a denial of service (crash) by using the mmap() function with a PROT_READ parameter to access non-readable memory pages through the /proc/pid/mem interface.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel
References: http://www.debian.org/security/2003/dsa-336, http://www.linuxsecurity.com/advisories/engarde_advisory-2976.html, http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:039
CVE-2002-0075
Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_information_server, internet_information_services
References: http://marc.info/?l=bugtraq&m=101854677802990&w=2, http://www.cert.org/advisories/CA-2002-09.html, http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml
CVE-2002-0555
IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQL code in a web form even when the developer has attempted to escape it.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: informix_web_datablade
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0137.html, http://www.iss.net/security_center/static/8827.php, http://www.securityfocus.com/bid/4498
CVE-2002-1581
Directory traversal vulnerability in nph-mr.cgi in Mailreader.com 2.3.20 through 2.3.31 allows remote attackers to view arbitrary files via .. (dot dot) sequences and a null byte (%00) in the configLanguage parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: debian_linux, mailreader.com
References: http://mailreader.com/download/ChangeLog, http://mailreader.com/download/ChangeLog, http://www.debian.org/security/2004/dsa-534
CVE-2002-0981
Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: unixware, openunix
References: ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.36/CSSA-2002-SCO.36.txt, http://www.iss.net/security_center/static/9945.php, http://www.securityfocus.com/bid/5551
CVE-2002-2192
Cross-site scripting (XSS) vulnerability in Perception LiteServe 2.0.1 allows remote attackers to execute arbitrary web script via (1) a Host: header when DNS wildcards are supported or (2) the query string in a "dir" request to indexed folders.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: liteserve
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0063.html, http://online.securityfocus.com/archive/1/298987, http://www.iss.net/security_center/static/10561.php
CVE-2002-0920
CGIScript.net csPassword.cgi stores usernames and unencrypted passwords in the password.cgi.tmp temporary file while modifying data, which could allow local users (and possibly remote attackers) to gain privileges by stealing the file before it has been processed.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: cspassword
References: http://online.securityfocus.com/archive/1/274727, http://www.iss.net/security_center/static/9223.php, http://www.securityfocus.com/bid/4889
CVE-2002-1636
Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web script or HTML via the cbuf parameter to htp.print.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: application_server
References: http://www.nextgenss.com/papers/hpoas.pdf, https://exchange.xforce.ibmcloud.com/vulnerabilities/10687, http://www.nextgenss.com/papers/hpoas.pdf
CVE-2002-1811
Belkin F5D6130 Wireless Network Access Point running firmware AP14G8 allows remote attackers to cause a denial of service (connection loss) by sending several SNMP GetNextRequest requests.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: f5d6130_wnap
References: http://online.securityfocus.com/archive/1/289112, http://www.iss.net/security_center/static/9960.php, http://www.securityfocus.com/bid/5571
CVE-2002-1292
The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security Manager (SSM) class (com.ms.security.StandardSecurityManager) and bypass intended StandardSecurityManager restrictions by modifying the (1) deniedDefinitionPackages or (2) deniedAccessPackages settings, causing a denial of service by adding Java applets to the list of applets that are prevented from running.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: java_virtual_machine
References: http://marc.info/?l=bugtraq&m=103682630823080&w=2, http://marc.info/?l=ntbugtraq&m=103684360031565&w=2, http://www.kb.cert.org/vuls/id/237777
CVE-2002-1291
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares via an applet tag with a codebase set to a "file://%00" (null character) URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: java_virtual_machine
References: http://marc.info/?l=bugtraq&m=103682630823080&w=2, http://marc.info/?l=ntbugtraq&m=103684360031565&w=2, http://www.iss.net/security_center/static/10584.php
CVE-2002-1156
Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: http_server
References: http://online.securityfocus.com/advisories/4617, http://www.apache.org/dist/httpd/CHANGES_2.0, http://www.apacheweek.com/issues/02-10-04
CVE-2002-0969
Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows, mysql
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0004.html, http://marc.info/?l=bugtraq&m=103358628011935&w=2, http://www.iss.net/security_center/static/10243.php
CWE: CWE-120
CVE-2002-1604
Multiple buffer overflows in HP Tru64 UNIX allow local and possibly remote attackers to execute arbitrary code via a long NLSPATH environment variable to (1) csh, (2) dtsession, (3) dxsysinfo, (4) imapd, (5) inc, (6) uucp, (7) uux, (8) rdist, or (9) deliver.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hp-ux, tru64
References: http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html, http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html, http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11
CVE-2002-1371
filters/image-gif.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which allows remote attackers to execute arbitrary code via modified chunk headers, as demonstrated by nogif.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x, cups
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702, http://marc.info/?l=bugtraq&m=104032149026670&w=2
CVE-2002-20002
The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number generator, for cryptographic keys.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Related CWEs: CWE-338
References: https://github.com/briandfoy/cpan-security-advisory/issues/184, https://metacpan.org/release/MNAGUIB/EasyTCP-0.15/view/EasyTCP.pm, https://metacpan.org/release/MNAGUIB/EasyTCP-0.26/changes
CWE: CWE-338
CVE-2002-2032
sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug parameter to (1) index.php and (2) modules.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: php-nuke
References: http://www.securityfaq.com/unixfocus/5OP041P6BE.html, http://www.securityfocus.com/bid/3906, http://www.securityfaq.com/unixfocus/5OP041P6BE.html
CVE-2002-1947
Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: webmin
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc, http://www.iss.net/security_center/static/10381.php, http://www.securityfocus.com/bid/5936
CVE-2002-1186
Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ie, internet_explorer
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0018.html, http://archives.neohapsis.com/archives/bugtraq/2002-09/0030.html, http://www.iss.net/security_center/static/10039.php
CVE-2002-0334
xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: xtell
References: http://marc.info/?l=bugtraq&m=101494896516467&w=2, http://www.debian.org/security/2002/dsa-121, http://www.iss.net/security_center/static/8314.php
CVE-2002-2232
Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command.
CVSS v2.0 Score: 8.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C
Affected Products: enceladus_server_suite
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0074.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0097.html, http://www.iss.net/security_center/static/10802.php
CWE: CWE-119
CVE-2002-0242
Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://marc.info/?l=bugtraq&m=101309907709138&w=2, http://marc.info/?l=bugtraq&m=101309907709138&w=2
CVE-2002-0212
The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hosting_controller
References: http://hostingcontroller.com/English/patches/ForAll/index.html, http://marc.info/?l=bugtraq&m=101224151705897&w=2, http://www.iss.net/security_center/static/8006.php
CVE-2002-2127
Integrity Protection Driver (IPD) 1.2 and earlier blocks access to \Device\PhysicalMemory by its name, which could allow local privileged processes to overwrite kernel memory by accessing the device through a symlink.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: integrity_protection_driver
References: http://archives.neohapsis.com/archives/ntbugtraq/2002-q4/0087.html, http://www.phrack.org/show.php?p=59&a=16, https://exchange.xforce.ibmcloud.com/vulnerabilities/10747
CVE-2002-2316
Cisco Catalyst 4000 series switches running CatOS 5.5.5, 6.3.5, and 7.1.2 do not always learn MAC addresses from a single initial packet, which causes unicast traffic to be broadcast across the switch and allows remote attackers to obtain sensitive network information by sniffing.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: catos
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0190.html, http://archives.neohapsis.com/archives/bugtraq/2002-06/0209.html, http://www.iss.net/security_center/static/9148.php
CVE-2002-1434
Multiple cross-site scripting (XSS) vulnerabilities in the Web mail module of Kerio MailServer 5.0 allow remote attackers to execute HTML script as other users via certain URLs.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: kerio_mailserver
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0183.html, http://www.iss.net/security_center/static/9905.php, http://www.securityfocus.com/bid/5507
CVE-2002-0632
Vulnerability in SGI BDS (Bulk Data Service) BDSPro 2.4 and earlier allows clients to read arbitrary files on a BDS server.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020804-01-P, http://www.iss.net/security_center/static/9825.php, http://www.osvdb.org/11081
CVE-2002-0852
Buffer overflows in Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service via (1) an Internet Key Exchange (IKE) with a large Security Parameter Index (SPI) payload, or (2) an IKE packet with a large number of valid payloads.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vpn_client
References: http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml, http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml
CVE-2002-1699
SQL injection vulnerability in ASP Client Check (ASPCC) 1.3 and 1.5 allows remote attackers to bypass authentication and gain unauthorized access via the password field.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: asp_client_check
References: http://www.osvdb.org/21558, http://www.securiteam.com/windowsntfocus/5BP031P75C.html, http://www.securityfocus.com/bid/4676
CVE-2002-0507
An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a previous user via several submissions of an OWA Authentication request with the proper OWA password for the previous user, which is eventually accepted by OWA.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: securid, exchange_server
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://online.securityfocus.com/archive/1/264705, http://www.iss.net/security_center/static/8681.php, http://www.securityfocus.com/bid/4390
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2002-1908
Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_services
References: http://www.iss.net/security_center/static/10370.php, http://www.securiteam.com/windowsntfocus/6C00C1F5QA.html, http://www.securityfocus.com/bid/5907
CVE-2002-0909
Multiple buffer overflows in mnews 1.22 and earlier allow (1) a remote NNTP server to execute arbitrary code via long responses, or local users can gain privileges via long command line arguments (2) -f, (3) -n, (4) -D, (5) -M, or (6) -P, or via long environment variables (7) JNAMES or (8) MAILSERVER.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mnews
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0287.html, http://marc.info/?l=bugtraq&m=102306166201275&w=2, http://marc.info/?l=vuln-dev&m=102297259123103&w=2
CVE-2002-1270
Mac OS X 10.2.2 allows local users to read files that only allow write access via the map_fd() Mach system call.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mac_os_x
References: http://www.info.apple.com/usen/security/security_updates.html, http://www.osvdb.org/7060, https://exchange.xforce.ibmcloud.com/vulnerabilities/10829
CVE-2002-0933
Datalex PLC BookIt! Consumer before 2.2 stores usernames and passwords in plaintext in a cookie, which could allow remote attackers to gain privileges via Cross-site scripting or sniffing attacks.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bookit_consumer
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0063.html, http://www.iss.net/security_center/static/9316.php, http://www.securityfocus.com/bid/4972
CVE-2002-1799
Cross-site scripting (XSS) vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML via the (1) email parameter to add.php or (2) banurl parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phprank
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0148.html, http://www.iss.net/security_center/static/10336.php, http://www.securityfocus.com/bid/5945
CVE-2002-1976
ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKET_MR_PROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: linux_kernel
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0279.html, http://online.securityfocus.com/archive/1/284142, http://online.securityfocus.com/archive/1/284257
CVE-2002-1369
jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the options string, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x, cups
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702, http://marc.info/?l=bugtraq&m=104032149026670&w=2
CVE-2002-1760
Multiple SQL injection vulnerabilities in PHProjekt 2.0 through 3.1 allow remote attackers to execute arbitrary SQL commands via the unknown attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phprojekt
References: http://archive.cert.uni-stuttgart.de/archive/bugtraq/2002/04/msg00361.html, http://www.securityfocus.com/bid/4598, https://exchange.xforce.ibmcloud.com/vulnerabilities/8945
CVE-2002-2309
php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: php
Related CWEs: CWE-399
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000605.html, http://online.securityfocus.com/archive/1/283586, http://www.iss.net/security_center/static/9646.php
CWE: CWE-399
CVE-2002-1792
Buffer overflow in Fake Identd 0.9 through 1.4 allows remote attackers to execute arbitrary code as root via a long request that is split into multiple packets.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: fake_identd
References: http://online.securityfocus.com/archive/1/284953, http://www.iss.net/security_center/static/9731.php, http://www.securityfocus.com/bid/5351
CVE-2002-1750
csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: csguestbook
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/04/msg00106.html, http://www.securityfocus.com/bid/4448, https://exchange.xforce.ibmcloud.com/vulnerabilities/8636
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-0702
Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: dhcpd
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-028.0.txt, http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0063.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000483
CVE-2002-1269
Unknown vulnerability in NetInfo Manager application in Mac OS X 10.2.2 allows local users to access restricted parts of a filesystem.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x
References: http://www.info.apple.com/usen/security/security_updates.html, http://www.info.apple.com/usen/security/security_updates.html
CVE-2002-2190
ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cutecast_forum
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0058.html, http://www.iss.net/security_center/static/10556.php, http://www.securityfocus.com/bid/6127
CVE-2002-2173
Buffer overflow in the IRC module of Trillian 0.725 and 0.73 allowing remote attackers to execute arbitrary code via a long DCC Chat message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: trillian
References: http://www.iss.net/security_center/static/9764.php, http://www.securityfocus.com/archive/1/285695, http://www.securityfocus.com/bid/5389
CVE-2002-2436
The Cascading Style Sheets (CSS) implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: thunderbird, seamonkey, firefox
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/, http://bugzilla.mozilla.org/show_bug.cgi?id=147777, http://w2spconf.com/2010/papers/p26.pdf
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-0823
Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000, windows_help
References: http://marc.info/?l=bugtraq&m=102822806329440&w=2, http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3Bq293338, http://www.iss.net/security_center/static/9746.php
CVE-2002-1126
Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Affected Products: galeon_browser, mozilla
References: http://bugzilla.mozilla.org/show_bug.cgi?id=145579, http://marc.info/?l=bugtraq&m=103176760004720&w=2, http://www.iss.net/security_center/static/10084.php