DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-0337
RealPlayer 8 allows remote attackers to cause a denial of service (CPU utilization) via malformed .mp3 files.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C
Affected Products: realplayer
References: http://marc.info/?l=bugtraq&m=101495354424868&w=2, http://www.iss.net/security_center/static/8320.php, http://www.securityfocus.com/bid/4200
CVE-2002-0483
index.php for PHP-Nuke 5.4 and earlier allows remote attackers to determine the physical pathname of the web server when the file parameter is set to index.php, which triggers an error message that leaks the pathname.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: php-nuke
References: http://online.securityfocus.com/archive/1/263337, http://www.iss.net/security_center/static/8618.php, http://www.securityfocus.com/bid/4333
CVE-2002-2255
Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the search_username parameter in searchuser mode.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpbb
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0053.html, http://www.securityfocus.com/bid/6311, https://exchange.xforce.ibmcloud.com/vulnerabilities/10773
CWE: CWE-79
CVE-2002-2193
Cross-site scripting (XSS) vulnerability in mojo.cgi for Mojo Mail 2.7 allows remote attackers to inject arbitrary web script via the email parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mojo_mail
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0352.html, http://www.iss.net/security_center/static/10477.php, http://www.securityfocus.com/bid/6040
CVE-2002-2297
PHP remote file inclusion vulnerability in artlist.php in Thatware 0.5.2 and 0.5.3 allows remote attackers to execute arbitrary PHP code via the root_path parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: thatware
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0000.html, http://securitytracker.com/id?1005733, https://exchange.xforce.ibmcloud.com/vulnerabilities/10758
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-0545
Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts with invalid usernames and passwords.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: aironet_ap350, aironet_ap340
References: http://www.cisco.com/warp/public/707/Aironet-Telnet.shtml, http://www.iss.net/security_center/static/8788.php, http://www.securityfocus.com/bid/4461
CVE-2002-0305
Zero One Tech (ZOT) P100s print server does not properly disable the SNMP service or change the default password, which could leave the server open to attack without the administrator's knowledge.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: p100s
References: http://marc.info/?l=bugtraq&m=101432416503293&w=2, http://www.securityfocus.com/bid/4155, https://exchange.xforce.ibmcloud.com/vulnerabilities/8270
CVE-2002-0063
Buffer overflow in ippRead function of CUPS before 1.1.14 may allow attackers to execute arbitrary code via long attribute names or language values.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cups
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-008.0.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000471, http://lists2.suse.com/archive/suse-security-announce/2001-Mar/0000.html
CVE-2002-1183
Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_nt, windows_98se, windows_98
References: http://www.securityfocus.com/bid/5410, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050, https://exchange.xforce.ibmcloud.com/vulnerabilities/9776
CVE-2002-1472
Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: x11r6
References: http://archives.neohapsis.com/archives/linux/suse/2002-q3/1116.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000529, http://www.iss.net/security_center/static/10137.php
CVE-2002-0145
chuid 1.2 and earlier does not properly verify the ownership of files that will be changed, which allows remote attackers to change files owned by other users, such as root.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: chuid
References: http://online.securityfocus.com/archive/1/251763, http://www.securityfocus.com/bid/3938, https://exchange.xforce.ibmcloud.com/vulnerabilities/7976
CVE-2002-0993
Unknown vulnerability in HP Instant Support Enterprise Edition (ISEE) product U2512A for HP-UX 11.00 and 11.11 may allow authenticated users to access restricted files.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: instant_support
References: http://archives.neohapsis.com/archives/hp/2002-q3/0023.html, http://www.iss.net/security_center/static/9620.php, http://www.securityfocus.com/bid/5267
CVE-2002-0827
Vulnerability in pppd on UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to gain root privileges via (1) ppptalk or (2) ppp, a different vulnerability than CVE-2002-0824.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: unixware, openunix
References: ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.27/CSSA-2002-SCO.27.txt, http://www.iss.net/security_center/static/9380.php, http://www.securityfocus.com/bid/5051
CVE-2002-0905
Buffer overflow in sqlexec for Informix SE-7.25 allows local users to gain root privileges via a long INFORMIXDIR environment variable.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: informix
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0270.html, http://www.iss.net/security_center/static/9219.php, http://www.securityfocus.com/bid/4891
CVE-2002-2272
Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: tomcat, http_server
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0045.html, http://www.securityfocus.com/bid/6320, https://exchange.xforce.ibmcloud.com/vulnerabilities/10771
CWE: CWE-119
CVE-2002-1100
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to cause a denial of service (crash) via a long (1) username or (2) password to the HTML login interface.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vpn_3002_hardware_client, vpn_3000_concentrator_series_software
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10025.php, http://www.securityfocus.com/bid/5617
CVE-2002-1667
The virtual memory management system in FreeBSD 4.5-RELEASE and earlier does not properly check the existence of a VM object during page invalidation, which allows local users to cause a denial of service (crash) by calling msync on an unaccessed memory map created with MAP_ANON and MAP_NOSYNC flags.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: freebsd
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:22.mmap.asc, https://exchange.xforce.ibmcloud.com/vulnerabilities/8921, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:22.mmap.asc
CVE-2002-1120
Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: savant_web_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0112.html, http://www.iss.net/security_center/static/10076.php, http://www.securityfocus.com/bid/5686
CVE-2002-1064
Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, generates different responses for valid and invalid usernames, which allows remote attackers to identify valid users on the server.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jana_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0329.html, http://www.iss.net/security_center/static/9688.php, http://www.securityfocus.com/bid/5326
CVE-2002-0069
Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P
Affected Products: squid, linux
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc, http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464
CVE-2002-0164
Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openlinux_workstation, openlinux_server
References: ftp://patches.sgi.com/support/free/security/advisories/20021001-01-P, ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.14/CSSA-2002-SCO.14.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000529
CVE-2002-0781
RTSP proxy for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service via a GET request to port 9090 followed by a series of carriage returns, which causes proxy.nlm to ABEND.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: bordermanager
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0060.html, http://online.securityfocus.com/archive/1/271475, http://www.iss.net/security_center/static/9033.php
CVE-2002-0810
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: bugzilla
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc, http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html, http://bugzilla.mozilla.org/show_bug.cgi?id=92263
CVE-2002-1367
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need authorization" page, as demonstrated by new-coke.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x, cups
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702, http://marc.info/?l=bugtraq&m=104032149026670&w=2
CVE-2002-2288
Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request to index.php with a parameter that does not exist, which causes the path to be leaked in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: site_server
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0111.html, http://www.securityfocus.com/bid/6387, https://exchange.xforce.ibmcloud.com/vulnerabilities/10856
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-1471
The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate, which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: evolution
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0045.html, http://www.iss.net/security_center/static/10292.php, http://www.securityfocus.com/bid/5875
CVE-2002-2413
WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: windows_nt, windows_9x, website_pro
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0178.html, http://www.iss.net/security_center/static/9147.php, http://www.securityfocus.com/bid/4783
CVE-2002-2414
Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority (CA) certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service (crash).
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: squid, opera
References: http://marc.info/?l=full-disclosure&m=103783186608438&w=2, http://www.iss.net/security_center/static/10673.php, http://www.securityfocus.com/bid/6218
CVE-2002-0707
The Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to cause a denial of service (CPU consumption) via large GET requests, possibly due to a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: web_filter, superscout_web_filter
References: http://marc.info/?l=bugtraq&m=103359690824103&w=2, http://www.iss.net/security_center/static/10242.php, http://www.securityfocus.com/bid/5854
CVE-2002-2284
Netscape Communicator 4.0 through 4.79 allows remote attackers to bypass JVM security and execute arbitrary Java code via an applet that loads user-supplied Java classes.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: communicator
References: http://marc.info/?l=bugtraq&m=103798147613151&w=2, http://www.lsd-pl.net/documents/javasecurity-1.0.0.pdf, http://www.securityfocus.com/bid/6223
CVE-2002-1958
Cross-site scripting (XSS) vulnerability in kmMail 1.0, 1.0a, and 1.0b allows remote attackers to inject arbitrary web script or HTML via (1) javascript in onmouseover or other attributes in "safe" HTML tags such as the "b" tag, or (2) the Subject field.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: kmmail
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html, http://sourceforge.net/forum/forum.php?forum_id=191501, http://www.iss.net/security_center/static/9507.php
CWE: CWE-79
CVE-2002-0669
The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause a denial of service by modifying the SIP_AUTHENTICATE_SCHEME value to force authentication of incoming calls, which does not notify the user when an authentication failure occurs.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: xpressa
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt, http://www.iss.net/security_center/static/9564.php, http://www.atstake.com/research/advisories/2002/a071202-1.txt
CVE-2002-1795
Cross-site scripting (XSS) vulnerability in connect.asp in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: tsac_activex_control
References: http://online.securityfocus.com/archive/1/294938, http://www.iss.net/security_center/static/10342.php, http://www.lac.co.jp/security/english/snsadv_e/56_e.html
CVE-2002-0602
Snapgear Lite+ firewall 1.5.4 and 1.5.3 allows remote attackers to cause a denial of service (crash) via a large number of connections to (1) the HTTP web management port, or (2) the PPTP port.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: snapgear_lite\+_firewall
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0050.html, http://marc.info/?l=bugtraq&m=102035583114759&w=2, http://www.securityfocus.com/bid/4657
CVE-2002-0066
Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control, which allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: netrc, funk_software_proxy
References: http://razor.bindview.com/publish/advisories/adv_FunkProxy.html, http://www.iss.net/security_center/static/8793.php, http://www.securityfocus.com/bid/4460
CVE-2002-1910
Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), which allows attackers to obtain passwords.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ingenium_learning_management_system
Related CWEs: CWE-326
Related CAPECs: CAPEC-112, CAPEC-192, CAPEC-20
MITRE ATT&CK Techniques: T1110
References: http://online.securityfocus.com/archive/1/295309, http://www.iss.net/security_center/static/10389.php, http://www.securityfocus.com/bid/5970
CWE: CWE-326
MITRE ATT&CK techniques: T1110
CVE-2002-0297
Buffer overflow in ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: scriptease_webserver
References: http://marc.info/?l=bugtraq&m=101415883727615&w=2, http://www.securityfocus.com/bid/4128, http://marc.info/?l=bugtraq&m=101415883727615&w=2
CVE-2002-1749
Windows 2000 Terminal Services, when using the disconnect feature of the client, does not properly lock itself if it is left idle until the screen saver activates and the user disconnects, which could allow attackers to gain administrator privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000
References: http://www.ntbugtraq.com/default.aspx?pid=36&sid=1&A2=ind0202&L=ntbugtraq&T=0&O=D&F=N&P=5224, http://www.securityfocus.com/bid/4095, https://exchange.xforce.ibmcloud.com/vulnerabilities/8199
CVE-2002-2317
Memory leak in the (1) httpd, (2) nntpd, and (3) vpn driver in VelociRaptor 1.0 allows remote attackers to cause a denial of service (memory consumption) via an unknown method.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: velociraptor
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://www.iss.net/security_center/static/10317.php, http://www.securityfocus.com/bid/5909, http://www.symantec.com/techsupp/enterprise/products/sym_velociraptor/sym_velociraptor_1/files.html
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-0345
Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, which could allow an attacker to gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: norton_ghost
References: http://marc.info/?l=bugtraq&m=101529792821615&w=2, http://online.securityfocus.com/archive/1/258293, http://www.iss.net/security_center/static/8305.php
CVE-2002-0923
CGIScript.net csNews.cgi allows remote authenticated users to read arbitrary files, and possibly gain privileges, via the (1) pheader or (2) pfooter parameters in the "Advanced Settings" capability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: csnews
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0091.html, http://www.iss.net/security_center/static/9333.php, http://www.securityfocus.com/bid/4994
CVE-2002-2303
3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by using the Javascript to decrypt the cookie that contains the data.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Affected Products: shopfactory
Related CWEs: CWE-310
References: http://cert.uni-stuttgart.de/archive/bugtraq/2003/03/msg00081.html, http://securityreason.com/securityalert/3263, http://www.securityfocus.com/archive/1/301863
CWE: CWE-310
CVE-2002-1765
Evolution 1.0.3 and 1.0.4 allows remote attackers to cause a denial of service (memory consumption and crash) via an email with a malformed MIME header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: evolution
References: http://mail.gnome.org/archives/gnome-announce-list/2002-May/msg00020.html, http://online.securityfocus.com/advisories/4117, http://rhn.redhat.com/errata/RHBA-2002-080.html
CVE-2002-2332
Buffer overflow in Opera 6.01 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: opera_web_browser
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-09/0167.html, http://www.iss.net/security_center/static/10126.php, http://www.securityfocus.com/bid/5717
CWE: CWE-119
CVE-2002-1552
Novell eDirectory (eDir) 8.6.2 and Netware 5.1 eDir 85.x allows users with expired passwords to gain inappropriate permissions when logging in from Remote Manager.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: edirectory
References: http://marc.info/?l=bugtraq&m=103712498905027&w=2, http://marc.info/?l=bugtraq&m=103712790808781&w=2, http://www.securityfocus.com/bid/6163
CVE-2002-1252
The Application Messaging Gateway for PeopleTools 8.1x before 8.19, as used in various PeopleSoft products, allows remote attackers to read arbitrary files via certain XML External Entities (XXE) fields in an HTTP POST request that is processed by the SimpleFileHandler handler.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: peopletools
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21811, http://www.iss.net/security_center/static/10520.php, http://www.securityfocus.com/bid/6647
CVE-2002-0174
nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020501-01-I, http://www.iss.net/security_center/static/8981.php, http://www.securityfocus.com/bid/4655
CVE-2002-2331
W3Mail 1.0.2 through 1.0.5 with server side scripting (SSI) enabled in the attachments directory does not properly restrict the types of files that can be uploaded as attachments, which allows remote attackers to execute arbitrary code by sending code in MIME attachments, then requesting the attachments.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: w3mail
Related CWEs: CWE-16
References: http://online.securityfocus.com/archive/1/284232, http://www.iss.net/security_center/static/9680.php, http://www.securityfocus.com/bid/5314
CWE: CWE-16
CVE-2002-1448
An undocumented SNMP read/write community string ('NoGaH$@!') in Avaya P330, P130, and M770-ATM Cajun products allows remote attackers to gain administrative privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cajun_m770-atm, cajun_p130, cajun_p330
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0519.html, http://support.avaya.com/security/Unauthorized_SNMP/index.jhtml, http://www.iss.net/security_center/static/9769.php
CVE-2002-0668
The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to modify the Call Forwarding settings and hijack calls.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xpressa
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt, http://www.osvdb.org/5144, http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE-2002-1671
Microsoft Internet Explorer 5.0, 5.01, and 5.5 allows remote attackers to monitor the contents of the clipboard via the getData method of the clipboardData object.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: internet_explorer
References: http://online.securityfocus.com/archive/1/250387/2002-10-11/2002-10-17/2, http://www.securityfocus.com/archive/1/250248, http://www.securityfocus.com/bid/3862
CVE-2002-1554
Cisco ONS15454 and ONS15327 running ONS before 3.4 stores usernames and passwords in cleartext in the image database for the TCC, TCC+ or XTC, which could allow attackers to gain privileges by obtaining the passwords from the image database or a backup.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: optical_networking_systems_software
References: http://www.cisco.com/warp/public/707/ons-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10506.php, http://www.securityfocus.com/bid/6078
CVE-2002-1093
HTML interface for Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.0.3(B) allows remote attackers to cause a denial of service (CPU consumption) via a long URL request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vpn_3000_concentrator_series_software
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10018.php, http://www.securityfocus.com/bid/5615
CVE-2002-0173
Buffer overflow in cpr for the eoe.sw.cpr SGI Checkpoint-Restart Software package on SGI IRIX 6.5.10 and earlier may allow local users to gain root privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020409-01-I, http://www.iss.net/security_center/static/8959.php, http://www.osvdb.org/5359
CVE-2002-1147
The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration enabled, does not authenticate requests to reset the device, which allows remote attackers to cause a denial of service via a direct request to the device_reset CGI program.
CVSS v2.0 Score: 7.1 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Affected Products: procurve_switch_4000m
References: http://marc.info/?l=bugtraq&m=103287951910420&w=2, http://online.securityfocus.com/advisories/4501, http://www.iss.net/security_center/static/10172.php
CVE-2002-1295
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions (such as private constructors) by providing the class name in the code parameter, aka "Incomplete Java Object Instantiation Vulnerability."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: java_virtual_machine
References: http://marc.info/?l=bugtraq&m=103682630823080&w=2, http://marc.info/?l=ntbugtraq&m=103684360031565&w=2, http://www.iss.net/security_center/static/10588.php
CVE-2002-0988
Buffer overflow in X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1, possibly related to XBM/xkbcomp capabilities.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: unixware, openunix
References: ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.38, http://www.iss.net/security_center/static/9977.php, http://www.securityfocus.com/bid/5577
CVE-2002-0177
Buffer overflows in icecast 1.3.11 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: icecast
References: http://marc.info/?l=bugtraq&m=101780890326179&w=2, http://marc.info/?l=bugtraq&m=101786838300906&w=2, http://marc.info/?l=bugtraq&m=101793704306035&w=2
CVE-2002-1895
The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tomcat
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0020.html, http://tomcat.apache.org/security-4.html, http://www.iss.net/security_center/static/10348.php
CVE-2002-0014
URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pine
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000460, http://marc.info/?l=bugtraq&m=101027841605918&w=2, http://rhn.redhat.com/errata/RHSA-2002-009.html
CVE-2002-1475
Unknown vulnerability in the ARP component for HP Tru64 UNIX 4.0f, 4.0g, and 5.0a allows remote attackers to "take over packets destined for another host" and cause a denial of service.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tru64
References: http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html, http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html
CVE-2002-2123
PHP remote file inclusion vulnerability in publish_xp_docs.php for Gallery 1.3.2 allows remote attackers to inject arbitrary PHP code by specifying a URL to an init.php file in the GALLERY_BASEDIR parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gallery
References: http://www.securityfocus.com/archive/1/304611, http://www.securityfocus.com/bid/6489, https://exchange.xforce.ibmcloud.com/vulnerabilities/10943
CVE-2002-1287
Stack-based buffer overflow in the Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service via a long class name through (1) Class.forName or (2) ClassLoader.loadClass.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: java_virtual_machine
References: http://marc.info/?l=bugtraq&m=103682630823080&w=2, http://marc.info/?l=ntbugtraq&m=103684360031565&w=2, http://www.iss.net/security_center/static/10580.php
CVE-2002-1067
Administrative web interface for IC9 Pocket Print Server Firmware 7.1.30 and 7.1.36f allows remote attackers to cause a denial of service (reboot and reset) via a long password, possibly due to a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ic9_pocket_print_server_firmware
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0336.html, http://www.iss.net/security_center/static/9702.php, http://www.securityfocus.com/bid/5329
CVE-2002-0301
Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: nfuse
References: http://marc.info/?l=bugtraq&m=101424947801895&w=2, http://www.securityfocus.com/bid/4142, http://marc.info/?l=bugtraq&m=101424947801895&w=2
CVE-2002-2236
Format string vulnerability in the awp_log function in apt-www-proxy 0.1 allows remote attackers to execute arbitrary code.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: apt-www-proxy
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0081.html, http://www.iss.net/security_center/static/10815.php, http://www.securityfocus.com/bid/6340
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-1059
Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: securecrt
References: http://marc.info/?l=bugtraq&m=102744150718462&w=2, http://marc.info/?l=bugtraq&m=102746007908689&w=2, http://www.iss.net/security_center/static/9650.php
CVE-2002-0061
Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: http_server
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://marc.info/?l=bugtraq&m=101674082427358&w=2, http://online.securityfocus.com/archive/1/263927, http://www.apacheweek.com/issues/02-03-29#apache1324
CWE: CWE-78
CVE-2002-1257
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_nt, windows_98se, windows_98, windows_me
References: http://www.securityfocus.com/bid/6371, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-069, http://www.securityfocus.com/bid/6371
CVE-2002-0797
Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://marc.info/?l=bugtraq&m=102321107714554&w=2, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/219, http://www.iss.net/security_center/static/9242.php
CVE-2002-0414
KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: netbsd, openbsd, freebsd
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0057.html, http://orange.kame.net/dev/cvsweb.cgi/kame/CHANGELOG, http://www.iss.net/security_center/static/8416.php
CVE-2002-0249
PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: http_server
References: http://marc.info/?l=bugtraq&m=101311698909691&w=2, http://www.iss.net/security_center/static/8121.php, http://www.securityfocus.com/bid/4056
CVE-2002-0939
The Install Wizard for nCipher MSCAPI CSP 5.50 does not use Operator Card Set protected keys when the user requests them but does not generate the Operator Card Set, which results in a lower protection level than specified by the user (module protection only).
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mscapi_csp
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0103.html, http://www.iss.net/security_center/static/9076.php, http://www.securityfocus.com/bid/4729
CVE-2002-0502
Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: nfuse
References: http://www.securityfocus.com/archive/1/251737, http://www.securityfocus.com/archive/1/251923, http://www.securityfocus.com/bid/3926
CVE-2002-1412
Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gallery
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0471.html, http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=50&mode=thread&order=0&thold=0, http://www.debian.org/security/2002/dsa-138
CVE-2002-1029
Res Manager in Worldspan for Windows Gateway 4.1 allows remote attackers to cause a denial of service (crash) via a malformed request to TCP port 17990.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: res_manager
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0048.html, http://www.iss.net/security_center/static/9490.php, http://www.osvdb.org/14478
CVE-2002-2108
Unknown vulnerability in the "VAIO Manual" software in certain Sony VAIO personal computers sold from November 2001 to January 2002, allows remote attackers to modify data via a web page or HTML e-mail.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: vaio_manual_cybersupport
References: http://vaio-online.sony.com/announcement/announcement_content.html, http://vaio-online.sony.com/announcement/technical_explain.html, http://www.iss.net/security_center/static/8009.php
CVE-2002-2125
Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM) attack.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: ie, internet_explorer
References: http://www.iss.net/security_center/static/10180.php, http://www.securityfocus.com/archive/1/292842, http://www.securityfocus.com/bid/5778
CVE-2002-0387
Buffer overflow in gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before 6.5 allows remote attackers to execute arbitrary code via a long HTTP request URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: one_application_server
References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/52022, http://www.atstake.com/research/advisories/2003/a031303-1.txt, http://www.ciac.org/ciac/bulletins/n-064.shtml
CVE-2002-0816
Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: tru64
References: http://archives.neohapsis.com/archives/tru64/2002-q3/0019.html, http://marc.info/?l=bugtraq&m=102709593117171&w=2, http://www.iss.net/security_center/static/9640.php
CVE-2002-2249
PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to (1) backend.php, (2) screen.php, or (3) admin/modules/comment.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: news_evolution
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://marc.info/?l=bugtraq&m=103835200230127&w=2, http://www.securityfocus.com/bid/6260, https://exchange.xforce.ibmcloud.com/vulnerabilities/10709
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-1893
Cross-site scripting (XSS) vulnerability in ArGoSoft Mail Server Pro 1.8.1.9 allows remote attackers to inject arbitrary web script or HTML via the e-mail message.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: argosoft_mail_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0085.html, http://www.iss.net/security_center/static/10301.php, http://www.securityfocus.com/bid/5906
CVE-2002-0853
Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vpn_client
References: http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/9821.php, http://www.kb.cert.org/vuls/id/287771
CVE-2002-2265
Unspecified vulnerability in LDAP Module in System Authentication of Open Source Internet Solutions (OSIS) 5.4 running on Tru64 UNIX 4.0G and 4.0F allows remote attackers to gain access to arbitrary files or gain privileges via unknown attack vectors.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: tru64, open_source_internet_solutions
Related CWEs: CWE-264
References: http://archives.neohapsis.com/archives/compaq/2002-q4/0014.html, http://www.securityfocus.com/bid/6174, https://exchange.xforce.ibmcloud.com/vulnerabilities/10703
CWE: CWE-264
CVE-2002-0190
Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://www.iss.net/security_center/static/9084.php, http://www.kb.cert.org/vuls/id/242891, http://www.securityfocus.com/bid/4753
CVE-2002-1669
pkg_add in FreeBSD 4.2 through 4.4 creates a temporary directory with world-searchable permissions, which may allow local users to modify world-writable parts of the package during installation.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: freebsd
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:01.pkg_add.asc, http://www.securityfocus.com/bid/3819, https://exchange.xforce.ibmcloud.com/vulnerabilities/7852
CVE-2002-1621
Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY26503&apar=only, http://www-1.ibm.com/support/search.wss?rs=0&q=IY28698&apar=only, http://www.kb.cert.org/vuls/id/209363
CVE-2002-0067
Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcp_port 0" is specified in squid.conf, which could allow remote attackers to bypass intended access restrictions.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: squid, linux
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc, http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464
CVE-2002-1465
SQL injection vulnerability in CafeLog b2 Weblog Tool allows remote attackers to execute arbitrary SQL code via the tablehosts variable.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: b2
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html, http://online.securityfocus.com/archive/1/287228, http://www.iss.net/security_center/static/9836.php
CVE-2002-0348
service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long service argument.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cobalt_raq_3i, cobalt_raq_4, cobalt_raq_2
References: http://marc.info/?l=bugtraq&m=101495944202452&w=2, http://www.iss.net/security_center/static/8323.php, http://www.securityfocus.com/bid/4209
CVE-2002-0671
Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xpressa_firmware, xpressa
Related CWEs: CWE-494
Related CAPECs: CAPEC-695, CAPEC-662, CAPEC-657
MITRE ATT&CK Techniques: T1195.001, T1185, T1195.002
MITRE ATT&CK Tactics: T1195
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt, http://www.iss.net/security_center/static/9566.php, http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CWE: CWE-494
MITRE ATT&CK techniques: T1195.001, T1185, T1195.002, T1072
MITRE ATT&CK tactics: T1195
CVE-2002-2305
SQL injection vulnerability in agentadmin.php in Immobilier allows remote attackers to execute arbitrary SQL commands via the (1) agentname or (2) agentpassword parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: immobilier
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0307.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/10705, http://archives.neohapsis.com/archives/bugtraq/2002-11/0307.html
CWE: CWE-89