DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-1407
TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tinyssl
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0096.html, http://marc.info/?l=bugtraq&m=102866120821995&w=2, http://www.securityfocus.com/bid/5410
CVE-2002-1398
Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input."
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: postgresql
References: http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php, http://marc.info/?l=bugtraq&m=102978152712430&w=2, http://marc.info/?l=bugtraq&m=102996089613404&w=2
CVE-2002-0258
Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: web_mail, mail_server
References: http://marc.info/?l=bugtraq&m=101328887821909&w=2, http://marc.info/?l=bugtraq&m=101328887821909&w=2
CVE-2002-1820
register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a."
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ultimate_php_board
Related CWEs: CWE-178
References: http://www.iss.net/security_center/static/9972.php, http://www.securityfocus.com/archive/1/289417, http://www.securityfocus.com/bid/5580
CWE: CWE-178
CVE-2002-0091
Multiple CGI scripts in CIDER SHADOW 1.5 and 1.6 allows remote attackers to execute arbitrary commands via certain form fields.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cider_shadow
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0400.html, http://www.esecurityonline.com/advisories/eSO2408.asp, http://www.iss.net/security_center/static/8953.php
CVE-2002-0746
Vulnerability in template.dhcpo in AIX 4.3.3 related to an insecure linker argument.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2002-q2/0005.html, http://archives.neohapsis.com/archives/aix/2002-q2/0005.html
CVE-2002-0835
Preboot eXecution Environment (PXE) server allows remote attackers to cause a denial of service (crash) via certain DHCP packets from Voice-Over-IP (VOIP) phones.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: secure_os, openlinux_workstation, openlinux_server, pre-execution_environment
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-044.0.txt, http://online.securityfocus.com/advisories/4449, http://www.iss.net/security_center/static/10003.php
CVE-2002-0359
xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, which allows remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems, to gain root privileges.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I, http://marc.info/?l=bugtraq&m=102459162909825&w=2, http://www.iss.net/security_center/static/9401.php
CVE-2002-0466
Hosting Controller 1.4.1 and earlier allows remote attackers to browse arbitrary directories via a full C: style pathname in the filepath arguments to (1) Statsbrowse.asp, (2) servubrowse.asp, (3) browsedisk.asp, (4) browsewebalizerexe.asp, or (5) sqlbrowse.asp.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: hosting_controller
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0039.html, http://www.hostingcontroller.com/english/patches/ForAll/download/foldersecurity.zip, http://www.securityfocus.com/bid/3808
CVE-2002-1922
Cross-site scripting (XSS) vulnerability in global.php in Jelsoft vBulletin 2.0.0 through 2.2.8 allows remote attackers to inject arbitrary web script or HTML via the (1) $scriptpath or (2) $url variables.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: vbulletin
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0272.html, http://www.iss.net/security_center/static/10407.php, http://www.securityfocus.com/bid/5997
CVE-2002-1464
Cross-site scripting (XSS) vulnerability in CafeLog b2 Weblog Tool allows remote attackers to insert arbitrary HTML or script via the GPC variable.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: b2
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html, http://online.securityfocus.com/archive/1/287228, http://www.iss.net/security_center/static/9835.php
CVE-2002-1915
tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netbsd, openbsd, freebsd
Related CWEs: CWE-667
Related CAPECs: CAPEC-25, CAPEC-27, CAPEC-26
MITRE ATT&CK Techniques: T1499.004
MITRE ATT&CK Tactics: T1499
References: http://online.securityfocus.com/archive/1/283033, http://www.iss.net/security_center/static/9633.php, http://www.securityfocus.com/bid/5265
CWE: CWE-667
MITRE ATT&CK techniques: T1499.004
MITRE ATT&CK tactics: T1499
CVE-2002-0436
sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://www.iss.net/security_center/static/8435.php, http://www.securityfocus.com/archive/1/261544, http://www.securityfocus.com/bid/4269
CVE-2002-0606
Buffer overflow in 3Cdaemon 2.0 FTP server allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long commands such as login.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: 3cdaemon
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0428.html, http://www.iss.net/security_center/static/8970.php, http://www.securityfocus.com/bid/4638
CVE-2002-0072
The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_information_server, internet_information_services
References: http://marc.info/?l=bugtraq&m=101853851025208&w=2, http://www.cert.org/advisories/CA-2002-09.html, http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml
CVE-2002-1355
Multiple integer signedness errors in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (infinite loop) via malformed messages.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ethereal
References: http://www.ethereal.com/appnotes/enpa-sa-00007.html, http://www.ethereal.com/cgi-bin/viewcvs.cgi/ethereal/packet-bgp.c.diff?r1=1.68&r2=1.69, http://www.redhat.com/support/errata/RHSA-2002-290.html
CVE-2002-0331
Directory traversal vulnerability in the HTTP server for BPM Studio Pro 4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: bpm_studio_pro
References: http://marc.info/?l=bugtraq&m=101486044323352&w=2, http://www.iss.net/security_center/static/8300.php, http://www.securityfocus.com/bid/4198
CVE-2002-1148
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tomcat
References: http://marc.info/?l=bugtraq&m=103288242014253&w=2, http://online.securityfocus.com/advisories/4758, http://www.debian.org/security/2002/dsa-170
CVE-2002-1339
The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10 follows redirections, which allows remote attackers to determine the existence of local files based on exceptions, or to read WorkSheet XML files.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: office_web_components
References: http://marc.info/?l=bugtraq&m=101830175621193&w=2, http://security.greymagic.com/adv/gm008-ie/, http://marc.info/?l=bugtraq&m=101830175621193&w=2
CVE-2002-1633
Multiple buffer overflows in QNX 4.25 may allow local users to execute arbitrary code via long command line arguments to (1) sample, (2) ex, (3) du, (4) find, (5) lex, (6) mkdir, (7) rm, (8) serserv, (9) tcpserv, (10) termdef, (11) time, (12) unzip, (13) use, (14) wcc, (15) wcc386, (16) wd, (17) wdisasm, (18) which, (19) wlib, (20) wlink, (21) wpp, (22) wpp386, (23) wprof, (24) write, or (25) wstrip.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: qnx_rtos
References: http://www.kb.cert.org/vuls/id/879386, http://www.securityfocus.com/archive/1/276553, http://www.securityfocus.com/bid/5000
CVE-2002-0229
Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php
References: http://marc.info/?l=bugtraq&m=101286577109716&w=2, http://marc.info/?l=bugtraq&m=101304702002321&w=2, http://marc.info/?l=ntbugtraq&m=101285016125377&w=2
CVE-2002-0534
PostBoard 2.0.1 and earlier with BBcode allows remote attackers to cause a denial of service (CPU consumption) and corrupt the database via null \0 characters within [code] tags.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: postboard
References: http://online.securityfocus.com/archive/1/267936, http://www.iss.net/security_center/static/8883.php, http://www.securityfocus.com/bid/4562
CVE-2002-0734
b2edit.showposts.php in B2 2.0.6pre2 and earlier does not properly load the b2config.php file in some configurations, which allows remote attackers to execute arbitrary PHP code via a URL that sets the $b2inc variable to point to a malicious program stored on a remote server.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: b2
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0027.html, http://cafelog.com/, http://www.iss.net/security_center/static/9013.php
CVE-2002-2203
Unknown vulnerability in the System Serial Console terminal in Solaris 2.5.1, 2.6, and 7 allows local users to monitor keystrokes and possibly steal sensitive information.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N
Affected Products: sunos, solaris
References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F45502, http://www.iss.net/security_center/static/9492.php, http://www.securityfocus.com/bid/5161
CVE-2002-0844
Off-by-one overflow in the CVS PreservePermissions of rcs.c for CVSD before 1.11.2 allows local users to execute arbitrary code.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cvs
Related CWEs: CWE-193
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-035.0.txt, ftp://patches.sgi.com/support/free/security/advisories/20040103-01-U.asc, http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0081.html
CWE: CWE-193
CVE-2002-0686
Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a long argument to the NS-rel-doc-name parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: iplanet_web_server
References: http://marc.info/?l=bugtraq&m=102622220416889&w=2, http://www.iss.net/security_center/static/9506.php, http://www.kb.cert.org/vuls/id/612843
CVE-2002-2333
Buffer overflow in konqueror in KDE 2.1 through 3.0 and 3.0.2 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: kde
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-09/0167.html, http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-09/0177.html, http://www.iss.net/security_center/static/10126.php
CWE: CWE-119
CVE-2002-1843
Perlbot 1.9.2 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the $text variable in SpelCheck.pm or (2) the $filename variable in HTMLPlog.pm.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: perlbot
References: http://online.securityfocus.com/archive/1/296134, http://www.iss.net/security_center/static/10403.php, http://www.iss.net/security_center/static/10404.php
CVE-2002-0814
Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gsx_server
References: http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0057.html, http://marc.info/?l=bugtraq&m=102752511030425&w=2, http://marc.info/?l=bugtraq&m=102765223418716&w=2
CVE-2002-1242
SQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php-nuke
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0051.html, http://marc.info/?l=bugtraq&m=103616324103171&w=2, http://www.idefense.com/advisory/10.31.02c.txt
CVE-2002-1494
Cross-site scripting (XSS) vulnerabilities in Aestiva HTML/OS allows remote attackers to insert arbitrary HTML or script by inserting the script after a trailing / character, which inserts the script into the resulting error message.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: html_os
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0026.html, http://www.iss.net/security_center/static/10029.php, http://www.securityfocus.com/bid/5618
CVE-2002-1036
Cross-site scripting vulnerability in search.pl for Fluid Dynamics Search Engine (FDSE) before 2.0.0.0055 allows remote attackers to execute web script via the (1) Rank or (2) Match parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: fluid_dynamics_search_engine
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0094.html, http://archives.neohapsis.com/archives/bugtraq/2002-07/0096.html, http://www.iss.net/security_center/static/9533.php
CVE-2002-0030
The digital signature mechanism for the Adobe Acrobat PDF viewer only verifies the PE header of executable code for a plug-in, which can allow attackers to execute arbitrary code in certified mode by making the plug-in appear to be signed by Adobe.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: acrobat, acrobat_reader
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0148.html, http://lists.grok.org.uk/pipermail/full-disclosure/2003-March/004230.html, http://www.kb.cert.org/vuls/id/549913
CVE-2002-0833
Buffer overflow in Eudora 5.1.1 and 5.0-J for Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a multi-part message with a long boundary string.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eudora
References: http://marc.info/?l=bugtraq&m=102858453720304&w=2, http://marc.info/?l=bugtraq&m=102883538924494&w=2, http://www.iss.net/security_center/static/9765.php
CVE-2002-0022
Buffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://marc.info/?l=bugtraq&m=101362984930597&w=2, http://online.securityfocus.com/archive/1/258614, http://www.cert.org/advisories/CA-2002-04.html
CVE-2002-1488
The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with (1) a missing channel or (2) a channel that the Trillian user is not in.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: trillian
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0268.html, http://www.iss.net/security_center/static/10162.php, http://www.securityfocus.com/bid/5776
CVE-2002-2351
Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a trailing "." (dot).
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: eudora
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/08/msg00142.html, http://www.eudora.com/download/eudora/windows/5.2/RelNotes.txt, http://www.securityfocus.com/bid/5432
CWE: CWE-22
CVE-2002-2261
Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sendmail
Related CWEs: CWE-264
References: ftp://patches.sgi.com/support/free/security/advisories/20030101-01-P, http://secunia.com/advisories/7826, http://securitytracker.com/id?1005748
CWE: CWE-264
CVE-2002-0312
Directory traversal vulnerability in Essentia Web Server 2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: essentia_web_server
References: http://marc.info/?l=bugtraq&m=101439734827908&w=2, http://online.securityfocus.com/archive/1/258365, http://www.iss.net/security_center/static/8248.php
CVE-2002-1955
Iomega NAS A300U uses cleartext LANMAN authentication when mounting CIFS/SMB drives, which allows remote attackers to perform a man-in-the-middle attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: nas
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0440.html, http://www.iss.net/security_center/static/10523.php, http://www.securityfocus.com/bid/6093
CVE-2002-1937
Symantec Firewall/VPN Appliance 100 through 200R hardcodes the administrator's MAC address inside the firewall's configuration, which allows remote attackers to spoof the administrator's MAC address and perform an ARP poisoning man-in-the-middle attack to obtain the administrator's password.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: firewall_vpn_appliance_200, firewall_vpn_appliance_100, firewall_vpn_appliance_200r
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0314.html, http://archives.neohapsis.com/archives/bugtraq/2002-10/0329.html, http://www.iss.net/security_center/static/10442.php
CVE-2002-2235
member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: vbulletin
Related CWEs: CWE-189
References: http://online.securityfocus.com/archive/1/301076, http://securityreason.com/securityalert/3229, http://www.iss.net/security_center/static/10701.php
CWE: CWE-189
CVE-2002-1649
Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: squirrelmail
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0310.html, http://www.kb.cert.org/vuls/id/153043, http://www.securityfocus.com/bid/3956
CVE-2002-2287
PHP remote file inclusion vulnerability in quick_reply.php for phpBB Advanced Quick Reply Hack 1.0.0 and 1.1.0 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: advanced_quick_reply_hack
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0188.html, http://www.securityfocus.com/bid/6173, https://exchange.xforce.ibmcloud.com/vulnerabilities/10617
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-0515
IPFilter 3.4.25 and earlier sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attackers to identify filtered ports by comparing TTLs.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ipfilter
Related CWEs: CWE-203
Related CAPECs: CAPEC-189
References: http://www.iss.net/security_center/static/8738.php, http://www.securityfocus.com/archive/1/265188, http://www.securityfocus.com/bid/4403
CWE: CWE-203
CVE-2002-1277
Buffer overflow in Window Maker (wmaker) 0.80.0 and earlier may allow remote attackers to execute arbitrary code via a certain image file that is not properly handled when Window Maker uses width and height information to allocate a buffer.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windowmaker
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000548, http://www.debian.org/security/2002/dsa-190, http://www.iss.net/security_center/static/10560.php