DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-2122
Pointsec before 1.2 for PalmOS stores a user's PIN number in memory in plaintext, which allows a local attacker who steals an unlocked Palm to retrieve the PIN by dumping memory.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: pointsec
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0035.html, http://www.iss.net/security_center/static/9021.php, http://www.securityfocus.com/bid/4681
CVE-2002-0008
Bugzilla before 2.14.1 allows remote attackers to (1) spoof a user comment via an HTTP request to process_bug.cgi using the "who" parameter, instead of the Bugzilla_login cookie, or (2) post a bug as another user by modifying the reporter parameter to enter_bug.cgi, which is passed to post_bug.cgi.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bugzilla
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html, http://bugzilla.mozilla.org/show_bug.cgi?id=108385, http://bugzilla.mozilla.org/show_bug.cgi?id=108516
CVE-2002-1546
BRS WebWeaver Web Server 1.01 allows remote attackers to bypass password protections for files and directories via an HTTP request containing a "/./" sequence.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webweaver
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0043.html, http://www.iss.net/security_center/static/10467.php, http://www.securityfocus.com/bid/6041
CVE-2002-2013
Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: navigator, mozilla, communicator
References: http://alive.znep.com/~marcs/security/mozillacookie/demo.html, http://archives.neohapsis.com/archives/bugtraq/2002-01/0270.html, http://www.iss.net/security_center/static/7973.php
CVE-2002-0627
The Web server for Polycom ViewStation before 7.2.4 allows remote attackers to bypass authentication and read files via Unicode encoded requests.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: viewstation_sp_384, viewstation_mp, viewstation_v.35, viewstation_dcp, viewstation_fx_vs4000
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21089, http://www.ciac.org/ciac/bulletins/m-123.shtml, http://www.iss.net/security_center/static/9348.php
CVE-2002-0311
Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell metacharacters in the -c argument for (1) in scoadminreg.cgi or (2) service_action.cgi.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: unixware, openunix
References: ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.6/CSSA-2002-SCO.6.txt, http://online.securityfocus.com/archive/1/251747, http://www.iss.net/security_center/static/7977.php
CVE-2002-1661
The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a denial of service (infinite loop) when leafnode requests a cross-posted article to one group whose name is a prefix of another group.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: leafnode
References: http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt, http://marc.info/?l=bugtraq&m=104127108823436&w=2, http://marc.info/?l=bugtraq&m=104152295210075&w=2
CVE-2002-2362
Cross-site scripting (XSS) vulnerability in form_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML via the noticemsg parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mymarket
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.iss.net/security_center/static/10470.php, http://www.securityfocus.com/archive/1/296861, http://www.securityfocus.com/bid/6035
CWE: CWE-79
CVE-2002-2321
Cross-site scripting (XSS) vulnerability in (1) showcat.php and (2) addyoursite.php in phpLinkat 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the catid parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phplinkat
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0065.html, http://www.iss.net/security_center/static/10269.php, http://www.securityfocus.com/bid/5890
CWE: CWE-79
CVE-2002-2381
Multiple buffer overflows in (1) tetrinet_inmessage, (2) speclist_add and (3) config-getthemeinfo of GTetrinet 0.4.3 and earlier allow remote attackers to casue a denial of service and possibly execute arbitrary code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gtetrinet
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://gtetrinet.sourceforge.net/, http://securitytracker.com/id?1005497, http://www.debian.org/security/2002/dsa-205
CWE: CWE-119
CVE-2002-0026
Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://www.securityfocus.com/bid/4082, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-005, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12
CVE-2002-0761
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: bzip2
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc, http://www.iss.net/security_center/static/9128.php
CVE-2002-1888
CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allows those organizations to obtain internal server names.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: commonname_toolbar
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0043.html, http://www.iss.net/security_center/static/10293.php, http://www.securityfocus.com/bid/5878
CVE-2002-2156
Buffer overflow in Trillian 0.73 allows remote IRC servers to execute arbitrary code via a long PING response.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: trillian
References: http://www.securityfocus.com/archive/1/285639, http://www.securityfocus.com/archive/1/285695, http://www.securityfocus.com/archive/1/285639
CVE-2002-2357
MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mailenable
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0236.html, http://www.iss.net/security_center/static/10652.php, http://www.securityfocus.com/bid/6197
CWE: CWE-119
CVE-2002-0716
Format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 allows local users to gain privileges via format string specifiers in the file name argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: openserver
References: http://marc.info/?l=bugtraq&m=102323070305101&w=2, http://marc.info/?l=vuln-dev&m=102323386107641&w=2, http://www.iss.net/security_center/static/9271.php
CVE-2002-0730
Cross-site scripting vulnerability in guestbook.pl for Philip Chinery's Guestbook 1.1 allows remote attackers to execute Javascript or HTML via fields such as (1) Name, (2) EMail, or (3) Homepage.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: philip_chinerys_guestbook
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0309.html, http://www.iss.net/security_center/static/8916.php, http://www.securityfocus.com/bid/4566
CVE-2002-0313
Buffer overflow in Essentia Web Server 2.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: essentia_web_server
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/006231.html, http://marc.info/?l=bugtraq&m=101440530023617&w=2, http://online.securityfocus.com/archive/1/258365
CVE-2002-1181
Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: internet_information_server, internet_information_services
References: http://marc.info/?l=bugtraq&m=103651224215736&w=2, http://www.ciac.org/ciac/bulletins/n-011.shtml, http://www.iss.net/security_center/static/10501.php
CVE-2002-0338
The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service (crash) via an attachment whose name includes an MS-DOS device name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: the_bat
References: http://marc.info/?l=bugtraq&m=101483832026841&w=2, http://www.iss.net/security_center/static/8303.php, http://www.securityfocus.com/bid/4187
CVE-2002-2397
Sygate personal firewall 5.0 could allow remote attackers to bypass firewall filters via spoofed (1) source IP address of 127.0.0.1 or (2) network address of 127.0.0.0.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sygate_personal_firewall
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.derkeiler.com/Mailing-Lists/VulnWatch/2002-09/0015.html, http://www.iss.net/security_center/static/10108.php, http://www.securiteam.com/windowsntfocus/5WP0I2A8AI.html
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2002-2268
Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.
CVSS v2.0 Score: 9.4 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:N
Affected Products: webster_http_server
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://seclists.org/lists/bugtraq/2002/Dec/0013.html, http://www.securiteam.com/windowsntfocus/6R0030A6AY.html, http://www.securityfocus.com/bid/6289
CWE: CWE-119
CVE-2002-0111
Directory traversal vulnerability in Funsoft Dino's Webserver 1.2 and earlier allows remote attackers to read files or execute arbitrary commands via a .. (dot dot) in the URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dinos_webserver
References: http://marc.info/?l=bugtraq&m=101062213627501&w=2, http://online.securityfocus.com/cgi-bin/vulns-item.pl?section=info&id=3861, http://www.iss.net/security_center/static/7853.php
CVE-2002-0897
LocalWEB2000 2.1.0 web server allows remote attackers to bypass access restrictions for restricted files via a URL that contains the "/./" directory.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: localweb2000
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0079.html, http://online.securityfocus.com/archive/1/274020, http://www.iss.net/security_center/static/9165.php
CVE-2002-2260
Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: bugzilla
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://bugzilla.mozilla.org/show_bug.cgi?id=179329, http://marc.info/?l=bugtraq&m=103837886416560&w=2, http://www.debian.org/security/2002/dsa-218
CWE: CWE-79
CVE-2002-1264
Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: oracle9i
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0060.html, http://marc.info/?l=bugtraq&m=103643298712284&w=2, http://technet.oracle.com/deploy/security/pdf/2002alert46rev1.pdf
CVE-2002-0461
Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service (application crash) via Javascript in a web page that calls location.replace on itself, causing a loop.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_explorer
References: http://online.securityfocus.com/archive/1/262994, http://www.iss.net/security_center/static/8488.php, http://www.securityfocus.com/bid/4322
CVE-2002-2001
jmcce 1.3.8 in Mandrake 8.1 creates log files in /tmp with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: jmcce, mandrake_linux
References: http://www.iss.net/security_center/static/7980.php, http://www.mandriva.com/security/advisories?name=MDKSA-2002:008, http://www.securityfocus.com/bid/3940
CVE-2002-1672
Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webmin
References: http://online.securityfocus.com/archive/1/263181, http://www.securityfocus.com/bid/4328, http://www.webmin.com/changes.html
CVE-2002-2230
Cross-site scripting (XSS) vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via a private message with a javascript: URL in the IMG tag, in which the URL ends in a ".gif" or ".jpg" string, a variant of CVE-2002-0328.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ikonboard
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0069.html, http://www.iss.net/security_center/static/10268.php, http://archives.neohapsis.com/archives/bugtraq/2002-10/0069.html
CWE: CWE-79
CVE-2002-1766
Buffer overflow in Composer in Netscape 4.77 allows local users to overwrite process memory and execute arbitrary code via a font tag with a long face attribute.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: communicator
References: http://online.securityfocus.com/archive/1/276876, http://www.securityfocus.com/bid/5010, https://exchange.xforce.ibmcloud.com/vulnerabilities/9355
CVE-2002-0657
Buffer overflow in OpenSSL 0.9.7 before 0.9.7-beta3, with Kerberos enabled, allows attackers to execute arbitrary code via a long master key.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openssl
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-033.0.txt, ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-033.1.txt, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:33.openssl.asc
CVE-2002-2244
Akfingerd 0.5 and earlier versions allow local users to cause a denial of service (crash) via a .plan with a symlink to /dev/urandom or other device, then disconnecting while data is being transferred, which causes a SIGPIPE error that Akfingerd cannot handle.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: akfingerd
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0049.html, http://synflood.at/akfingerd/, http://www.securityfocus.com/bid/6324
CWE: CWE-362
CVE-2002-0197
psyBNC 2.3 beta and earlier allows remote attackers to spoof encrypted, trusted messages by sending lines that begin with the "[B]" sequence, which makes the message appear legitimate.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: psybnc
References: http://marc.info/?l=bugtraq&m=101173478806580&w=2, http://online.securityfocus.com/archive/1/251832, http://www.iss.net/security_center/static/7985.php
CVE-2002-2046
x_news.php in X-News (x_news) 1.1 and earlier allows remote attackers to gain administrative privileges by stealing and replaying the md5_password cookie.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: x-news
References: http://seclists.org/lists/vuln-dev/2002/Mar/0156.html, http://www.ifrance.com/kitetoua/tuto/x_holes.txt, http://seclists.org/lists/vuln-dev/2002/Mar/0156.html
CVE-2002-1105
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, allows local users to use a utility program to obtain the group password.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vpn_client
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml, http://www.securityfocus.com/bid/5650, https://exchange.xforce.ibmcloud.com/vulnerabilities/10044
CVE-2002-0902
Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote (") in the [IMG] tag, which bypasses phpBB's security check, terminates the src parameter of the resulting HTML IMG tag, and injects the script.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpbb
References: http://online.securityfocus.com/archive/1/274273, http://www.iss.net/security_center/static/9178.php, http://www.securityfocus.com/bid/4858
CVE-2002-1689
Unknown vulnerability in the login program on AIX before 4.0 could allow remote users to specify 100 or more environment variables when logging on, which exceeds the length of a certain string, possibly triggering a buffer overflow.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2002-q1/0005.html, http://archives.neohapsis.com/archives/aix/2002-q1/0005.html
CVE-2002-0080
rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: rsync, linux
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt, http://www.iss.net/security_center/static/8463.php, http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-024.php3
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2002-1953
Heap-based buffer overflow in the goim handler of AOL Instant Messenger (AIM) 4.4 through 4.8.2616 allows remote attackers to cause a denial of service (crash) via escaping of the screen name parameter, which triggers the overflow when the user selects "Get Info" on the buddy.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: instant_messenger
References: http://online.securityfocus.com/archive/1/288980, http://www.iss.net/security_center/static/9950.php, http://www.securityfocus.com/bid/5492
CVE-2002-0687
The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: zope
References: http://www.iss.net/security_center/static/9621.php, http://www.osvdb.org/5166, http://www.redhat.com/support/errata/RHSA-2002-060.html
CVE-2002-0957
The default configuration of BlackICE Agent 3.1.eal and 3.1.ebh has a high tcp.maxconnections setting, which could allow remote attackers to cause a denial of service (memory consumption) via a large number of connections to the BlackICE system that consumes more resources than intended by the user.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: blackice_agent
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0114.html, http://www.iss.net/security_center/static/9405.php, http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0114.html
CVE-2002-0236
Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vitalanalysis, vitalsuite, vitalevent, vitalhelp, vitalnet
References: http://marc.info/?l=bugtraq&m=101294507827698&w=2, http://www.iss.net/security_center/static/7936.php, http://www.securityfocus.com/bid/3784
CVE-2002-0581
WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xpede
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html, http://www.iss.net/security_center/static/8903.php, http://www.securityfocus.com/bid/4555
CVE-2002-0951
SQL injection vulnerability in Ruslan <Body>Builder allows remote attackers to gain administrative privileges via a "'--" sequence in the username and password.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: body_builder
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0120.html, http://www.iss.net/security_center/static/9359.php, http://www.securityfocus.com/bid/5008
CVE-2002-1115
Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter to (1) bug_update_advanced_page.php, (2) bug_update_page.php, (3) view_bug_advanced_page.php, or (4) view_bug_page.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mantis
References: http://mantisbt.sourceforge.net/advisories/2002/2002-06.txt, http://marc.info/?l=bugtraq&m=103013249211164&w=2, http://www.debian.org/security/2002/dsa-161
CVE-2002-1774
NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus 2002 allows remote attackers to send viruses that bypass the e-mail scanning via a NULL character in the MIME header before the virus.  NOTE: the vendor has disputed this issue, acknowledging that the initial scan is bypassed, but the AutoProtect feature would detect the virus before it is executed
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: norton_antivirus
References: http://online.securityfocus.com/archive/1/260271, http://online.securityfocus.com/archive/1/260678, http://www.securityfocus.com/bid/4242
CVE-2002-0882
The web server for Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allows remote attackers to cause a denial of service (reset) and possibly read sensitive memory via a large integer value in (1) the stream ID of the StreamingStatistics script, or (2) the port ID of the PortInformation script.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Affected Products: voip_phone_cp-7940, skinny_client_control_protocol_software
References: http://online.securityfocus.com/archive/1/273673, http://www.cisco.com/warp/public/707/multiple-ip-phone-vulnerabilities-pub.shtml, http://www.iss.net/security_center/static/9142.php
CVE-2002-1773
Buffer overflow in ICQ 2.6x for MacOS X 10.0 through 10.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: icq_for_macos_x
References: http://online.securityfocus.com/archive/1/254133, http://online.securityfocus.com/archive/1/254141, http://www.securityfocus.com/bid/4031
CVE-2002-1561
The RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_nt, windows_2000, windows_2000_terminal_services, windows_xp
References: http://www.kb.cert.org/vuls/id/261537, http://www.securityfocus.com/archive/1/296114/2002-10-14/2002-10-20/0, http://www.securityfocus.com/bid/6005
CVE-2002-0476
Standalone Macromedia Flash Player 5.0 allows remote attackers to save arbitrary files and programs via a .SWF file containing the undocumented "save" FSCommand.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: flash_player
References: http://www.iss.net/security_center/static/8584.php, http://www.macromedia.com/support/flash/ts/documents/fs_save.htm, http://www.securityfocus.com/archive/1/262990
CVE-2002-0492
dcshop.cgi in DCShop 1.002 Beta allows remote attackers to delete arbitrary setup files via a null character in the database parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: dcshop
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0302.html, http://archives.neohapsis.com/archives/bugtraq/2002-03/0302.html
CVE-2002-0987
X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which could allow local users to gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: unixware, openunix
References: ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.38, http://www.iss.net/security_center/static/9976.php, http://www.osvdb.org/5044
CVE-2002-1202
Unknown vulnerability in routed for HP Tru64 UNIX V4.0F through V5.1A allows local and remote attackers to read arbitrary files.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tru64
References: http://archives.neohapsis.com/archives/tru64/2002-q4/0002.html, http://www.iss.net/security_center/static/10316.php, http://www.securityfocus.com/bid/5913
CVE-2002-1505
SQL injection vulnerability in board.php for WoltLab Burning Board (wBB) 2.0 RC 1 and earlier allows remote attackers to modify the database and possibly gain privileges via the boardid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: burning_board
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0083.html, http://www.iss.net/security_center/static/10069.php, http://www.securityfocus.com/bid/5675
CVE-2002-1970
SnortCenter 0.9.5, when configured to push Snort rules, stores the rules in a temporary file with world-readable and world-writable permissions, which allows local users to obtain usernames and passwords for the alert database servers.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: snortcenter
References: http://online.securityfocus.com/archive/1/298587, http://www.iss.net/security_center/static/10540.php, http://www.securityfocus.com/bid/6109
CVE-2002-0355
netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020503-01-I, http://www.iss.net/security_center/static/9023.php, http://www.securityfocus.com/bid/4682
CVE-2002-1691
Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attackers to gain unauthorized access.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: omnipcx
References: http://marc.info/?l=bugtraq&m=101413767925869&w=2, http://www.securityfocus.com/bid/4127, https://exchange.xforce.ibmcloud.com/vulnerabilities/8224
CVE-2002-1090
Buffer overflow in read_smtp_response of protocol.c in libesmtp before 0.8.11 allows a remote SMTP server to (1) execute arbitrary code via a certain response or (2) cause a denial of service via long server responses.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: libesmtp
References: http://www.stafford.uklinux.net/libesmtp/ChangeLog.txt, http://www.stafford.uklinux.net/libesmtp/ChangeLog.txt
CVE-2002-0275
Falcon web server 2.0.0.1020 and earlier allows remote attackers to bypass authentication and read restricted files via an extra / (slash) in the requested URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: falcon_web_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0082.html, http://marc.info/?l=bugtraq&m=101363946626951&w=2, http://marc.info/?l=bugtraq&m=102253858809370&w=2
CVE-2002-1945
Buffer overflow in SmartMail Server 1.0 Beta 10 allows remote attackers to cause a denial of service (crash) via a long request to (1) TCP port 25 (SMTP) or (2) TCP port 110 (POP3).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: smartmail_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0418.html, http://www.iss.net/security_center/static/10512.php, http://www.securityfocus.com/bid/6075
CVE-2002-0119
Alcatel Speed Touch Home ADSL Modem allows remote attackers to cause a denial of service (reboot) via a network scan with unusual packets, such as nmap with OS detection.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: speed_touch_home
References: http://online.securityfocus.com/archive/1/249746, http://www.iss.net/security_center/static/7893.php, http://www.securityfocus.com/bid/3851
CVE-2002-1713
The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read other user's files.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mandrake_linux
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: http://online.securityfocus.com/archive/1/277515, http://www.kb.cert.org/vuls/id/455323, http://www.securityfocus.com/bid/5050
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574
CVE-2002-0241
NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: secure_access_control_server
References: http://www.cisco.com/warp/public/707/ciscosecure-acs-nds-authentication-vuln-pub.shtml, http://www.iss.net/security_center/static/8106.php, http://www.securityfocus.com/bid/4048
CVE-2002-1556
Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service (reset) via an HTTP request to the TCC, TCC+ or XTC, in which the request contains an invalid CORBA Interoperable Object Reference (IOR).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: optical_networking_systems_software
References: http://www.cisco.com/warp/public/707/ons-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10508.php, http://www.securityfocus.com/bid/6084
CVE-2002-0924
CGIScript.net csNews.cgi allows remote authenticated users to execute arbitrary Perl code via terminating quotes and metacharacters in text fields of the "Advanced Settings" capability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: csnews
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0091.html, http://www.securityfocus.com/bid/4451, http://archives.neohapsis.com/archives/bugtraq/2002-06/0091.html
CVE-2002-2247
The administrator/phpinfo.php script in Mambo Site Server 4.0.11 allows remote attackers to obtain sensitive information such as the full web root path via phpinfo.php, which calls the phpinfo function.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mambo_site_server
Related CWEs: CWE-16
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0111.html, http://www.securityfocus.com/bid/6376, https://exchange.xforce.ibmcloud.com/vulnerabilities/10853
CWE: CWE-16
CVE-2002-1639
Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter set to "version" or "host".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: configurator
References: http://securitytracker.com/id?1003967, http://www.kb.cert.org/vuls/id/158323, http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.html
CVE-2002-2386
Cross-site scripting (XSS) vulnerability in the Quizz module for XOOPS 1.0, when allowing on-line question development, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the SRC attribute of an IMG tag.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: xoops
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0131.html, http://www.blocus-zone.com/modules/news/article.php?storyid=180, http://www.iss.net/security_center/static/10594.php
CWE: CWE-79
CVE-2002-1049
Format string vulnerability in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service (crash) via the TSI data element.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: hylafax
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0358.html, http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=300, http://www.debian.org/security/2002/dsa-148
CVE-2002-2337
Kaspersky Anti-Hacker 1.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: kaspersky_anti-hacker
References: http://online.securityfocus.com/archive/1/294411, http://www.securityfocus.com/archive/1/315631, http://www.securityfocus.com/bid/5917
CVE-2002-1351
Buffer overflow in Melange Chat System 1.10 allows remote attackers to cause a denial of service (chat server crash) and possibly execute arbitrary code via the msgText buffer in the chat_InterpretData function, as demonstrated via a long Nick (nickname) request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: melange_chat_system
References: http://securitytracker.com/id?1005831, http://www.idefense.com/application/poi/display?id=33&type=vulnerabilities&flashstatus=false, http://www.securityfocus.com/bid/6477
CVE-2002-0557
Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes (1) rexec or (2) rsh to run another user's shell, or (3) atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to auth_approval().
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openbsd
References: http://www.iss.net/security_center/static/8625.php, http://www.openbsd.org/errata30.html#approval, http://www.securityfocus.com/bid/4338
CVE-2002-1454
MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does not exist, which leaks the pathname in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mywebserver
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0077.html, http://marc.info/?l=bugtraq&m=102935720109934&w=2, http://www.iss.net/security_center/static/9862.php
CVE-2002-2365
Simple WAIS (SWAIS) 1.11 allows remote attackers to execute arbitrary commands via the shell metacharacters in the search field, as demonstrated using the "|" (pipe) character.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: simple_wais
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0390.html, http://www.iss.net/security_center/static/9453.php, http://www.securityfocus.com/bid/5127
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-1565
Buffer overflow in url_filename function for wget 1.8.1 allows attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: immunix
References: ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-003.0.txt, ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000716
CVE-2002-1195
Cross-site scripting vulnerability (XSS) in the PHP interface for ht://Check 1.1 allows remote web servers to insert arbitrary HTML, including script, via a web page.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ht_check
References: http://marc.info/?l=bugtraq&m=103184269605160&w=2, http://www.debian.org/security/2002/dsa-169, http://www.iss.net/security_center/static/10089.php
CVE-2002-0756
Cross-site scripting vulnerability in the authentication page for (1) Webmin 0.96 and (2) Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: usermin, webmin
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0040.html, http://www.iss.net/security_center/static/9036.php, http://www.securityfocus.com/bid/4694
CVE-2002-1586
Solaris 2.5.1 through 9 allows local users to cause a denial of service (kernel panic) by setting the sd_struiowrq variable in the struioget function to null, which triggers a null dereference.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sunos, solaris
References: http://securitytracker.com/id?1005742, http://sunsolve.sun.com/search/document.do?assetkey=1-26-48267-1, http://www.securityfocus.com/bid/6309
CVE-2002-0932
SQL injection vulnerability in index.php for MyHelpDesk 20020509, and possibly other versions, allows remote attackers to conduct unauthorized activities via SQL code in the "id" parameter for the operations (1) detailticket, (2) editticket, or (3) updateticketlog.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: myhelpdesk
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0057.html, http://www.iss.net/security_center/static/9321.php, http://www.securityfocus.com/bid/4971
CVE-2002-0107
Web administration interface in CacheFlow CacheOS 4.0.13 and earlier allows remote attackers to obtain sensitive information via a series of GET requests that do not end in with HTTP/1.0 or another version string, which causes the information to be leaked in the error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: cacheos
References: http://marc.info/?l=bugtraq&m=101052887431488&w=2, http://online.securityfocus.com/archive/1/254167, http://www.iss.net/security_center/static/7835.php
CVE-2002-2105
Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_xp
References: http://securitytracker.com/id?1003308, http://www.securityfocus.com/bid/3942, http://www.supernature-forum.de/vbb/printthread.php?threadid=6458
CVE-2002-1039
Directory traversal vulnerability in Double Choco Latte (DCL) before 20020706 allows remote attackers to read arbitrary files via .. (dot dot) sequences when downloading files from the Projects: Attachments feature.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: double_choco_latte
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0022.html, http://dcl.sourceforge.net/index.php, http://marc.info/?l=bugtraq&m=102668783632589&w=2
CVE-2002-0946
Directory traversal vulnerability in SeaNox Devwex before 1.2002.0601 allows remote attackers to read arbitrary files via ..\ (dot dot) sequences in an HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: devwex
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0056.html, http://www.iss.net/security_center/static/9299.php, http://www.osvdb.org/5048
CVE-2002-1213
Directory traversal vulnerability in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to read arbitrary files via an HTTP request with ".." (dot-dot) sequences containing URL-encoded forward slash ("%2F") characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webserver_4_all
References: http://www.idefense.com/application/poi/display?id=49&type=vulnerabilities&flashstatus=true, http://www.iss.net/security_center/static/10373.php, http://www.securityfocus.com/bid/5968
CVE-2002-0023
Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: internet_explorer
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0000.html, http://www.osvdb.org/3030, http://www.securityfocus.com/bid/3767
CVE-2002-0925
Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or (3) the USER command to mmftpd 0.0.7 and earlier.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mmftpd, mmmail
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0095.html, http://mmondor.gobot.ca/software/linux/mmftpd-changelog.txt, http://mmondor.gobot.ca/software/linux/mmmail-changelog.txt
CVE-2002-0147
Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_information_server, internet_information_services
References: http://www.cert.org/advisories/CA-2002-09.html, http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml, http://www.iss.net/security_center/static/8796.php
CVE-2002-0964
Half-Life Server 1.1.1.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via multiple responses to the initial challenge with different cd_key values, which reaches the player limit and prevents other players from connecting until the original responses have timed out.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: half-life_dedicated_server, half-life
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0248.html, http://www.iss.net/security_center/static/9412.php, http://www.securityfocus.com/bid/5076
CVE-2002-1170
The handle_var_requests function in snmp_agent.c for the SNMP daemon in the Net-SNMP (formerly ucd-snmp) package 5.0.1 through 5.0.5 allows remote attackers to cause a denial of service (crash) via a NULL dereference.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: net-snmp
References: http://marc.info/?l=bugtraq&m=103359362020365&w=2, http://sourceforge.net/forum/forum.php?forum_id=216532, http://www.idefense.com/advisory/10.02.02.txt
CVE-2002-1804
Cross-site scripting (XSS) vulnerability in NPDS 4.8 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: npds
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0307.html, http://www.iss.net/security_center/static/10173.php, http://www.securityfocus.com/bid/5797
CVE-2002-0531
Directory traversal vulnerability in emumail.cgi in EMU Webmail 4.5.x and 5.1.0 allows remote attackers to read arbitrary files or list arbitrary directories via a .. (dot dot) in the type parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: emumail_unix, emumail_red_hat_linux, emumail
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0066.html, http://www.emumail.com/downloads/download_unix.html/, http://www.iss.net/security_center/static/8766.php
CVE-2002-1682
NewsReactor 1.0 uses a weak encryption scheme, which could allow local users to decrypt the passwords and gain access to other users' newsgroup accounts.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: newsreactor
Related CWEs: CWE-326
Related CAPECs: CAPEC-112, CAPEC-192, CAPEC-20
MITRE ATT&CK Techniques: T1110
References: http://www.securiteam.com/windowsntfocus/5SP0P0K60C.html, http://www.securityfocus.com/bid/3927, https://exchange.xforce.ibmcloud.com/vulnerabilities/7968
CWE: CWE-326
MITRE ATT&CK techniques: T1110
CVE-2002-2259
Buffer overflow in the French documentation patch for Gnuplot 3.7 in SuSE Linux before 8.0 allows local users to execute arbitrary code as root via unknown attack vectors.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: suse_linux, gnuplot
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.securityfocus.com/bid/6329, http://www.suse.com/de/security/2002_047_openldap2.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/10801
CWE: CWE-119