DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-1477
graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cacti
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.html, http://www.debian.org/security/2002/dsa-164, http://www.iss.net/security_center/static/10048.php
CVE-2002-1110
Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to account_update.php.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mantis
References: http://mantisbt.sourceforge.net/advisories/2002/2002-01.txt, http://marc.info/?l=bugtraq&m=102978728718851&w=2, http://www.debian.org/security/2002/dsa-153
CVE-2002-1542
SolarWinds TFTP server 5.0.55 and earlier allows remote attackers to cause a denial of service (crash) via a large UDP datagram, possibly triggering a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tftp_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0344.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0040.html, http://www.iss.net/security_center/static/10462.php
CVE-2002-2142
An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: weblogic_server, weblogic_integration
References: http://dev2dev.bea.com/pub/advisory/3, http://www.iss.net/security_center/static/10392.php, http://www.securityfocus.com/bid/5971
CVE-2002-2115
Cross-site scripting (XSS) vulnerability in Hyper NIKKI System (HNS) Lite before 0.9 and HNS before 2.10-pl2 allows remote attackers to inject arbitrary web script or HTML.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: hns-lite, hns
References: http://www.h14m.org/SA/2002/hns-SA-2002-01.txt, http://www.iss.net/security_center/static/8204.php, http://www.securityfocus.com/bid/4102
CVE-2002-0054
SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000, exchange_server
Related CWEs: CWE-294
Related CAPECs: CAPEC-644, CAPEC-701, CAPEC-561
MITRE ATT&CK Techniques: T1550.003, T1550.004, T1021.002
MITRE ATT&CK Tactics: T1134, T1114, T1550
References: http://marc.info/?l=bugtraq&m=101501580409373&w=2, http://www.securityfocus.com/bid/4205, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-011
CWE: CWE-294
MITRE ATT&CK techniques: T1550.003, T1550.004, T1021.002, T1557, T1133, T1134.001, T1114.002, T1558.003, T1558, T1021, T1550.002
MITRE ATT&CK tactics: T1134, T1114, T1550, T1558, T1021
CVE-2002-1424
Buffer overflow in munpack in mpack 1.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mpack
References: http://www.debian.org/security/2002/dsa-141, http://www.iss.net/security_center/static/9747.php, http://www.securityfocus.com/bid/5385
CVE-2002-0486
Intellisol Xpede 4.1 uses weak encryption to store authentication information in cookies, which could allow local users with access to the cookies to gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: xpede
References: http://www.securityfocus.com/archive/1/263485, http://www.securityfocus.com/bid/4344, https://exchange.xforce.ibmcloud.com/vulnerabilities/8614
CVE-2002-0489
Linux Directory Penguin NsLookup CGI script (nslookup.pl) 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the (1) query or (2) type parameters.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: nslookup
References: http://marc.info/?l=bugtraq&m=101684215209558&w=2, http://www.iss.net/security_center/static/8601.php, http://www.securityfocus.com/bid/4353
CVE-2002-0137
CDRDAO 1.1.4 and 1.1.5 allows local users to overwrite arbitrary files via a symlink attack on the $HOME/.cdrdao configuration file.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: cdrdao
References: http://marc.info/?l=bugtraq&m=101102759631000&w=2, http://www.securityfocus.com/bid/3865, http://marc.info/?l=bugtraq&m=101102759631000&w=2
CVE-2002-0955
Cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier allows remote attackers to execute arbitrary script as other web site visitors via script in the num parameter, which is not filtered in the resulting error message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: yabb
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0261.html, http://www.iss.net/security_center/static/9408.php, http://www.securityfocus.com/bid/5078
CVE-2002-2318
Cross-site scripting (XSS) vulnerability in Falcon web server 2.0.0.1009 through 2.0.0.1021 allows remote attackers to inject arbitrary web script or HTML via the URI, which is inserted into 301 error messages and executed by 404 error messages.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: falcon_web_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-August/000934.html, http://seclists.org/lists/bugtraq/2002/Aug/0158.html, http://www.iss.net/security_center/static/9812.php
CWE: CWE-79
CVE-2002-1308
Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mozilla, navigator
References: http://bugzilla.mozilla.org/show_bug.cgi?id=157646, http://marc.info/?l=bugtraq&m=103730181813075&w=2, http://www.redhat.com/support/errata/RHSA-2003-162.html
CVE-2002-0332
Buffer overflows in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to execute arbitrary code via (1) a long DNS hostname that is determined using reverse DNS lookups, (2) a long AUTH string, or (3) certain data in the xtell request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xtell
References: http://marc.info/?l=bugtraq&m=101494896516467&w=2, http://www.debian.org/security/2002/dsa-121, http://www.iss.net/security_center/static/8312.php
CVE-2002-2076
Directory traversal vulnerability in Lil' HTTP server 2.1 and 2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: lil_http
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0316.html, http://www.iss.net/security_center/static/8913.php, http://www.securityfocus.com/bid/4576
CVE-2002-1337
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: netbsd, linux, hp-ux, alphaserver_sc, solaris
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-002.txt.asc, ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.6, ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.5
CWE: CWE-120
CVE-2002-0189
Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-023, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-023
CVE-2002-0830
Network File System (NFS) in FreeBSD 4.6.1 RELEASE-p7 and earlier, NetBSD 1.5.3 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service (hang) via an RPC message with a zero length payload, which causes NFS to reference a previous payload and enter an infinite loop.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: freebsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-013.txt.asc, http://marc.info/?l=bugtraq&m=102865517214722&w=2, http://www.info.apple.com/usen/security/security_updates.html
CVE-2002-1988
Resin 2.1.1 allows remote attackers to cause a denial of service (memory consumption and hang) via a URL with long variables for non-existent resources.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: resin
References: http://online.securityfocus.com/archive/1/277232, http://www.iss.net/security_center/static/9352.php, http://www.securityfocus.com/bid/5032
CVE-2002-2444
Snoopy before 2.0.0 has a security hole in exec cURL
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: snoopy
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.openwall.com/lists/oss-security/2014/07/18/2, https://security-tracker.debian.org/tracker/CVE-2002-2444, https://sourceforge.net/p/snoopy/bugs/13/
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-0418
Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the param_name parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: sake_mail
References: http://online.securityfocus.com/archive/1/259730, http://www.iss.net/security_center/static/8358.php, http://www.securityfocus.com/bid/4223
CVE-2002-1107
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.2B, does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vpn_client
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml, http://www.securityfocus.com/bid/5653, https://exchange.xforce.ibmcloud.com/vulnerabilities/10046
CVE-2002-2343
Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email messages.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: nocc
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0107.html, http://sourceforge.net/tracker/index.php?func=detail&aid=555897&group_id=12177&atid=112177, http://www.iss.net/security_center/static/9071.php
CWE: CWE-79
CVE-2002-0076
Java Runtime Environment (JRE) Bytecode Verifier allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, as seen in (1) Microsoft VM build 3802 and earlier as used in Internet Explorer 4.x and 5.x, (2) Netscape 6.2.1 and earlier, and possibly other implementations that use vulnerable versions of SDK or JDK, aka a variant of the "Virtual Machine Verifier" vulnerability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: virtual_machine, java_jre-jdk, jdk, sdk, jre
References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/218, http://www.iss.net/security_center/static/8480.php, http://www.securityfocus.com/bid/4313
CVE-2002-1402
Buffer overflows in the (1) TZ and (2) SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: postgresql
References: http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000524, http://marc.info/?l=bugtraq&m=103021186622725&w=2
CVE-2002-0210
setlicense for TOLIS Group Backup and Restore Utility (BRU) 17.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/brutest.$$ temporary file.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: bru
References: http://online.securityfocus.com/archive/1/252614, http://www.iss.net/security_center/static/8003.php, http://www.securityfocus.com/bid/3970
CVE-2002-0064
Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: netrc, funk_software_proxy
References: http://razor.bindview.com/publish/advisories/adv_FunkProxy.html, http://www.iss.net/security_center/static/8791.php, http://www.securityfocus.com/bid/4458
CVE-2002-1062
Signedness error in Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, allows remote attackers to execute arbitrary code via long (1) Username, (2) Password, or (3) Hostname entries.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jana_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0329.html, http://www.iss.net/security_center/static/9684.php, http://www.securityfocus.com/bid/5321
CVE-2002-0159
Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN  module only (denial of service of administration function) or execute arbitrary code via format strings in the URL to port 2002.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: secure_access_control_server
Related CWEs: CWE-134
Related CAPECs: CAPEC-135, CAPEC-67
References: http://marc.info/?l=bugtraq&m=101787248913611&w=2, http://www.cisco.com/warp/public/707/ACS-Win-Web.shtml, http://www.iss.net/security_center/static/8742.php
CWE: CWE-134
CVE-2002-2306
Sharman Networks KaZaA Media Desktop 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large messages.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: kazaa_media_desktop
Related CWEs: CWE-399
References: http://online.securityfocus.com/archive/1/284315, http://www.securityfocus.com/bid/5317, https://exchange.xforce.ibmcloud.com/vulnerabilities/9672
CWE: CWE-399
CVE-2002-0538
FTP proxy in Symantec Raptor Firewall 6.5.3 and Enterprise 7.0 rewrites an FTP server's "FTP PORT" responses in a way that allows remote attackers to redirect FTP data connections to arbitrary ports, a variant of the "FTP bounce" vulnerability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gateway_security, raptor_firewall, velociraptor, enterprise_firewall
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0166.html, http://archives.neohapsis.com/archives/bugtraq/2002-04/0224.html, http://securityresponse.symantec.com/avcenter/security/Content/2002.04.17.html
CVE-2002-2292
Directory traversal vulnerability in Remote Console Applet in Halycon Software iASP 1.0.9 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request to port 9095.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: iasp
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0126.html, http://www.securityfocus.com/bid/6394, https://exchange.xforce.ibmcloud.com/vulnerabilities/10860
CWE: CWE-22
CVE-2002-2158
zenTrack 2.0.3 and earlier allows remote attackers to obtain the full path to the web root via an invalid ticket ID, which leaks the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: zentrack
References: http://online.securityfocus.com/archive/1/276121, http://www.iss.net/security_center/static/9312.php, http://www.securityfocus.com/bid/4973
CVE-2002-0769
The web-based configuration interface for the Cisco ATA 186 Analog Telephone Adaptor allows remote attackers to bypass authentication via an HTTP POST request with a single byte, which allows the attackers to (1) obtain the password from the login screen, or (2) reconfigure the adaptor by modifying certain request parameters.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: ata-186
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0083.html, http://www.cisco.com/warp/public/707/ata186-password-disclosure.shtml, http://www.iss.net/security_center/static/9056.php
CVE-2002-2185
The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Ethernet address instead of the Multicast group address, which causes the target to stop sending reports to the router and effectively disconnect the group from the network.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Affected Products: enterprise_linux, debian_linux, suse_linux, mandrake_linux, linux
References: ftp://patches.sgi.com/support/free/security/advisories/20020901-01-A, http://online.securityfocus.com/archive/1/276968, http://secunia.com/advisories/18510
CVE-2002-2213
The DNS resolver in unspecified versions of Infoblox DNS One, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: bind, dns_one
References: http://www.imconf.net/imw-2002/imw2002-papers/198.pdf, http://www.kb.cert.org/vuls/id/457875, http://www.kb.cert.org/vuls/id/IAFY-5FDPYJ
CVE-2002-1041
Unknown vulnerability in DCE (1) SMIT panels and (2) configuration commands, possibly related to relative pathnames.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2002-q3/0000.html, http://archives.neohapsis.com/archives/aix/2002-q3/0000.html
CVE-2002-1089
rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in additional attacks.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: reports, application_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0203.html, http://www.iss.net/security_center/static/9628.php, http://www.securityfocus.com/bid/5262
CVE-2002-0708
Directory traversal vulnerability in the Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to read arbitrary files via an HTTP request containing ... (triple dot) sequences.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: web_filter, superscout_web_filter
References: http://marc.info/?l=bugtraq&m=103359690824103&w=2, http://www.iss.net/security_center/static/10244.php, http://www.securityfocus.com/bid/5857
CVE-2002-0658
OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: mm
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-032.0.txt, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc, http://online.securityfocus.com/advisories/4392
CVE-2002-1610
Unknown vulnerability in ping in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to cause a denial of service.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: hp-ux, tru64
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/08/msg00430.html, http://www.kb.cert.org/vuls/id/612833, http://www.securityfocus.com/bid/5599
CVE-2002-2054
TeeKai Forum 1.2 allows remote attackers to authenticate as the administrator and and gain privileged web forum access by setting the valid_level cookie to admin.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: teekai_forum
References: http://marc.info/?l=vuln-dev&m=102313697923798&w=2, http://www.ifrance.com/kitetoua/tuto/Teekai.txt, http://www.iss.net/security_center/static/9285.php
CVE-2002-0011
Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: bugzilla
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html, http://bugzilla.mozilla.org/show_bug.cgi?id=98146, http://rhn.redhat.com/errata/RHSA-2002-001.html
CVE-2002-0085
cachefsd in Solaris 2.6, 7, and 8 allows remote attackers to cause a denial of service (crash) via an invalid procedure call in an RPC request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sunos, solaris
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0047.html, http://online.securityfocus.com/archive/1/270122, http://www.esecurityonline.com/advisories/eSO4197.asp
CVE-2002-0579
WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xpede
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html, http://www.iss.net/security_center/static/8900.php, http://www.securityfocus.com/bid/4552
CVE-2002-1182
IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_services
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0048.html, http://www.ciac.org/ciac/bulletins/n-011.shtml, http://www.nextgenss.com/advisories/ms-iisdos.txt
CVE-2002-1020
The library feature for Adobe Content Server 3.0 allows a remote attacker to check out an eBook even when the maximum number of loans is exceeded by accessing the "Add to bookbag" feature when the server reports that no more copies are available.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: adobe_content_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0020.html, http://marc.info/?l=vuln-dev&m=102649215618643&w=2, http://marc.info/?l=vuln-dev&m=102650064028760&w=2
CVE-2002-1883
Trolltech Qt Assistant 1.0 in Trolltech Qt 3.0.3, when loaded from the Designer, opens port 7358 for interprocess communication, which allows remote attackers to open arbitrary HTML pages and cause a denial of service.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Affected Products: qt_assistant
References: http://lists.trolltech.com/qt-interest/2002-09/thread00549-0.html, http://online.securityfocus.com/archive/1/293556, http://www.iss.net/security_center/static/10227.php
CVE-2002-1388
Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mhonarc
References: http://www.debian.org/security/2002/dsa-221, http://www.mhonarc.org/archive/cgi-bin/mesg.cgi?a=mhonarc-users&i=200212220120.gBM1K8502180%40mcguire.earlhood.com, http://www.securityfocus.com/bid/6479
CVE-2002-0883
Vulnerability in Compaq ProLiant BL e-Class Integrated Administrator 1.0 and 1.10, allows authenticated users with Telnet, SSH, or console access to conduct unauthorized activities.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: proliant_bl_e-class_integrated_administrator_firmware
References: http://ftp.support.compaq.com/patches/.new/html/SSRT2179.shtml, http://www.iss.net/security_center/static/9202.php, http://www.securityfocus.com/bid/4802
CVE-2002-2223
Buffer overflow in NetScreen-Remote 8.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted Internet Key Exchange (IKE) response packets, possibly including (1) a large Security Parameter Index (SPI) field, (2) large number of payloads, or (3) a long payload.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: netscreen_remote_security_client, netscreen_remote_vpn_client
References: http://www.kb.cert.org/vuls/id/287771, http://www.netscreen.com/support/alerts/9_6_02.htm, http://www.securityfocus.com/bid/5668
CVE-2002-1836
The default configuration of Xerox DocuTech 6110 and DocuTech 6115 exports certain NFS shares to the world with world writable permissions, which may allow remote attackers to modify sensitive files.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: docutech_6115, docutech_6110
References: http://online.securityfocus.com/archive/1/273029, http://online.securityfocus.com/archive/1/273089, http://totally.righteous.net/jedgar/overview_of_security.pdf
CVE-2002-1174
Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: fetchmail
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000531, http://marc.info/?l=bugtraq&m=103340148625187&w=2, http://rhn.redhat.com/errata/RHSA-2002-215.html
CWE: CWE-119
CVE-2002-0240
PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: http_server
References: http://marc.info/?l=bugtraq&m=101311746611160&w=2, http://www.iss.net/security_center/static/8119.php, http://www.securityfocus.com/bid/4057
CVE-2002-1490
NetBSD 1.4 through 1.6 beta allows local users to cause a denial of service (kernel panic) via a series of calls to the TIOCSCTTY ioctl, which causes an integer overflow in a structure counter and sets the counter to zero, which frees memory that is still in use by other processes.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netbsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-007.txt.asc, http://www.iss.net/security_center/static/10115.php, http://www.osvdb.org/7566
CVE-2002-1496
Heap-based buffer overflow in Null HTTP Server 0.5.0 and earlier allows remote attackers to execute arbitrary code via a negative value in the Content-Length HTTP header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: null_httpd
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0284.html, http://freshmeat.net/releases/97910/, http://www.iss.net/security_center/static/10160.php
CVE-2002-0362
Buffer overflow in AOL Instant Messenger (AIM) 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: instant_messenger
References: http://marc.info/?l=bugtraq&m=102071080509955&w=2, http://www.iss.net/security_center/static/9017.php, http://www.securityfocus.com/bid/4677
CVE-2002-0299
CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such as .BAT), which is executed during a scan.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: catchup
References: http://marc.info/?l=bugtraq&m=101438631921749&w=2, http://www.iss.net/security_center/static/8035.php, http://www.securityfocus.com/bid/3975
CVE-2002-2116
Netgear RM-356 and RT-338 series SOHO routers allow remote attackers to cause a denial of service (crash) via a UDP port scan, as demonstrated using nmap.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: rt338, rm356
References: http://archives.neohapsis.com/archives/bugtraq/2002-02/0162.html, http://archives.neohapsis.com/archives/bugtraq/2002-02/0183.html, http://www.iss.net/security_center/static/8206.php
CVE-2002-1596
Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (router crash) via an HTTP request with large headers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sn_5420_storage_router_firmware
References: http://www.cisco.com/warp/public/707/SN-multiple-pub.shtml, http://www.kb.cert.org/vuls/id/968187, http://www.securityfocus.com/bid/3834
CVE-2002-0440
Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web servers to bypass content scanning via a Content-length header set to 0, which is often ignored by HTTP clients.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: interscan_viruswall
References: http://seclists.org/lists/bugtraq/2002/Mar/0162.html, http://www.inside-security.de/vwall_cl0.html, http://www.iss.net/security_center/static/8425.php
CVE-2002-1143
Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: excel, word
References: http://marc.info/?l=bugtraq&m=103040003014999&w=2, http://marc.info/?l=bugtraq&m=103252858816401&w=2, http://www.iss.net/security_center/static/10008.php
CVE-2002-0160
The administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to read HTML, Java class, and image files outside the web root via a ..\.. (modified ..) in the URL to port 2002.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: secure_access_control_server
References: http://marc.info/?l=bugtraq&m=101786689128667&w=2, http://www.cisco.com/warp/public/707/ACS-Win-Web.shtml, http://www.osvdb.org/5352
CVE-2002-0314
fasttrack p2p, as used in (1) KaZaA before 1.5, (2) grokster, and (3) morpheus allows remote attackers to cause a denial of service (memory exhaustion) via a series of client-to-client messages, which pops up new windows per message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: morpheus, kazaa, grokster
References: http://marc.info/?l=bugtraq&m=101441689224760&w=2, http://www.iss.net/security_center/static/8273.php, http://www.securityfocus.com/bid/4122
CVE-2002-1615
Multiple buffer overflows in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allow local users to execute arbitrary code via (1) msgchk or (2) .upd..loader.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: hp-ux, tru64
References: http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11, http://www.kb.cert.org/vuls/id/506441, https://exchange.xforce.ibmcloud.com/vulnerabilities/10016
CVE-2002-2435
The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: ie, internet_explorer
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://bugzilla.mozilla.org/show_bug.cgi?id=147777, http://w2spconf.com/2010/papers/p26.pdf, https://exchange.xforce.ibmcloud.com/vulnerabilities/71817
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-2329
ICQ client 2001b, 2002a and 2002b allows remote attackers to cause a denial of service (CPU consumption or crash) via a message with a large number of emoticons.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: icq
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://online.securityfocus.com/archive/1/284036, http://www.iss.net/security_center/static/9677.php, http://www.securityfocus.com/bid/5295
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-0142
CGI handler in John Roy Pi3Web for Windows 2.0 beta 1 and 2 allows remote attackers to cause a denial of service (crash) via a series of requests whose physical path is exactly 260 characters long and ends in a series of . (dot) characters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pi3web
References: http://marc.info/?l=bugtraq&m=101164598828093&w=2, http://marc.info/?l=ntbugtraq&m=101102275316307&w=2, http://online.securityfocus.com/archive/1/250126
CVE-2002-2209
Unspecified "security vulnerability" in Baby FTP Server versions before November 7, 2002 has unknown impact and attack vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: baby_ftp_server
References: http://www.pablosoftwaresolutions.com/html/baby_ftp_server.html, http://www.pablosoftwaresolutions.com/html/baby_ftp_server.html
CVE-2002-0562
The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: application_server_web_cache, application_server, oracle9i
References: http://marc.info/?l=bugtraq&m=101301440005580&w=2, http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf, http://www.cert.org/advisories/CA-2002-08.html
CVE-2002-1401
Buffer overflows in (1) circle_poly, (2) path_encode and (3) path_add (also incorrectly identified as path_addr) for PostgreSQL 7.2.3 and earlier allow attackers to cause a denial of service and possibly execute arbitrary code, possibly as a result of an integer overflow.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: postgresql
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.postgresql.org/pgsql-hackers/2002-08/msg02047.php, http://archives.postgresql.org/pgsql-hackers/2002-08/msg02081.php, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000524
CWE: CWE-119
CVE-2002-2050
Directory traversal vulnerability in processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a .. (dot dot) in the hostname of a log entry.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: modlogan
References: http://jan.kneschke.de/projects/modlogan/download/ChangeLog, http://www.iss.net/security_center/static/7848.php, http://www.securityfocus.com/bid/3821
CVE-2002-0028
Buffer overflow in ICQ before 2001B Beta v5.18 Build #3659 allows remote attackers to execute arbitrary code via a Voice Video & Games request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: icq
References: http://marc.info/?l=bugtraq&m=101043894627851&w=2, http://marc.info/?l=vuln-dev&m=101043076806401&w=2, http://www.cert.org/advisories/CA-2002-02.html
CVE-2002-2379
Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: as5350
Related CWEs: CWE-310
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/10/msg00397.html, http://cert.uni-stuttgart.de/archive/bugtraq/2002/10/msg00411.html, http://cert.uni-stuttgart.de/archive/bugtraq/2002/10/msg00413.html
CWE: CWE-310
CVE-2002-0302
The Notify daemon for Symantec Enterprise Firewall (SEF) 6.5.x drops large alerts when SNMP is used as the transport, which could prevent some alerts from being sent in the event of an attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: enterprise_firewall
References: http://marc.info/?l=bugtraq&m=101424225814604&w=2, http://securityresponse.symantec.com/avcenter/security/Content/2002.02.20a.html, http://www.securityfocus.com/bid/4139
CVE-2002-0539
Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the s_key cookie.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: puresecure
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0168.html, http://online.securityfocus.com/archive/1/267941, http://www.iss.net/security_center/static/8854.php
CVE-2002-1923
The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows, does not have logging enabled, which could allow remote attackers to conduct activities without detection.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mysql
References: http://online.securityfocus.com/archive/1/288105, http://www.iss.net/security_center/static/9909.php, http://www.securityfocus.com/bid/5513
CVE-2002-1364
Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: tracesroute
References: http://marc.info/?l=bugtraq&m=103858895600963&w=2, http://www.debian.org/security/2003/dsa-254, http://www.novell.com/linux/security/advisories/2002_043_traceroute_nanog_nkitb.html
CVE-2002-2387
Directory traversal vulnerability in Hyperion FTP server 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the LS command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: hyperion_ftp_server
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0069.html, http://www.iss.net/security_center/static/10599.php, http://www.mollensoft.com/news.htm
CWE: CWE-22
CVE-2002-2405
Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N
Affected Products: firewall-1
Related CWEs: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0219.html, http://www.iss.net/security_center/static/10139.php, http://www.securityfocus.com/bid/5744
CWE: CWE-264
CVE-2002-0535
Cross-site scripting vulnerabilities in PostBoard 2.0.1 and earlier allows remote attackers to execute script as other users via (1) an [IMG] tag when BBCode is enabled, or (2) in a topic title.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: postboard, postnuke
References: http://online.securityfocus.com/archive/1/267936, http://www.iss.net/security_center/static/8881.php, http://www.securityfocus.com/bid/4559
CVE-2002-1868
Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: dispair
References: http://www.contactor.se/~dast/dispair/dispair.cgi?file=dispair-0.3.tar.gz&dir=&view=CHANGES, http://www.iss.net/security_center/static/9787.php, http://www.securityfocus.com/bid/5392
CVE-2002-1887
PHP remote file inclusion vulnerability in customize.php for phpMyNewsletter 0.6.10 allows remote attackers to execute arbitrary PHP code via the l parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpmynewsletter
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0060.html, http://secunia.com/advisories/7220, http://www.iss.net/security_center/static/10288.php
CVE-2002-1175
The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: fetchmail
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000531, http://marc.info/?l=bugtraq&m=103340148625187&w=2, http://rhn.redhat.com/errata/RHSA-2002-215.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-2040
The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: rtos
References: http://online.securityfocus.com/archive/1/275218, http://www.iss.net/security_center/static/9257.php, http://www.securityfocus.com/bid/4915
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: suse_linux, secure_linux, linux, mandrake_linux, mandrake_linux_corporate_server
Related CWEs: CWE-193
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:13.openssh.asc, ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-004.txt.asc, ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.10/CSSA-2002-SCO.10.txt
CWE: CWE-193
CVE-2002-0788
An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext temporary files that cannot be wiped or deleted due to strong permissions, which could allow certain local users or attackers with physical access to obtain cleartext information.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: personal_security, freeware, corporate_desktop
Related CWEs: CWE-459
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0052.html, http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1/hotfix/ReadMe.txt, http://www.iss.net/security_center/static/9044.php
CWE: CWE-459
CVE-2002-1026
Macromedia Sitespring 1.2.0 (277.1) using Sybase runtime engine 7.0.2.1480 allows remote attackers to cause a denial of service (crash) via a long malformed request to TCP port 2500, possibly triggering a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sitespring
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0140.html, http://online.securityfocus.com/archive/1/280079, http://www.iss.net/security_center/static/9458.php
CVE-2002-2423
Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address from being logged via a long IDENT response.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: sendmail
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archive.cert.uni-stuttgart.de/bugtraq/2002/09/msg00267.html, http://www.iss.net/security_center/static/10153.php, http://www.securityfocus.com/bid/5770
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036