DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-1842
Perlbot 1.0 beta allows remote attackers to execute arbitrary commands via shell metacharacters in (1) a word that is being spell checked or (2) an e-mail address.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: perlbot
References: http://online.securityfocus.com/archive/1/296073, http://www.iss.net/security_center/static/10401.php, http://www.iss.net/security_center/static/10402.php
CVE-2002-2063
AtGuard 3.2 allows remote attackers to bypass firwall filters and execute prohibited programs by changing the filenames to permitted filenames.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: atguard_personal_firewall
References: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-04/0412.html, http://www.iss.net/security_center/static/8962.php, http://www.securityfocus.com/bid/4620
CVE-2002-0429
The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary processes via a a binary compatibility interface (lcall).
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:P
Affected Products: linux_kernel
References: http://marc.info/?l=bugtraq&m=101561298818888&w=2, http://www.debian.org/security/2003/dsa-311, http://www.debian.org/security/2003/dsa-312
CVE-2002-1974
The FTP service in Zaurus PDAs SL-5000D and SL-5500 does not require authentication, which allows remote attackers to access the file system as root.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: zaurus
References: http://online.securityfocus.com/archive/1/281437, http://www.iss.net/security_center/static/9534.php, http://www.securityfocus.com/archive/1/281549
CVE-2002-0261
Directory traversal vulnerability in InstantServers MiniPortal 1.1.5 and earlier allows remote authenticated users to read arbitrary files via a ... (modified dot dot) in the GET command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: miniportal
References: http://marc.info/?l=bugtraq&m=101329397901071&w=2, http://www.instantservers.com/releases.html, http://www.iss.net/security_center/static/8171.php
CVE-2002-1748
Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: slashcode
References: http://www.securityfocus.com/archive/1/249355, http://www.securityfocus.com/bid/3839, https://exchange.xforce.ibmcloud.com/vulnerabilities/7863
CVE-2002-1892
NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: fvs318
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0133.html, http://cert.uni-stuttgart.de/archive/bugtraq/2002/10/msg00004.html, http://www.iss.net/security_center/static/10216.php
CVE-2002-0785
AOL Instant Messenger (AIM) allows remote attackers to cause a denial of service (crash) via an "AddBuddy" link with the ScreenName parameter set to a large number of comma-separated values, possibly triggering a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: instant_messenger
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0086.html, http://www.iss.net/security_center/static/9058.php, http://www.kb.cert.org/vuls/id/259435
CVE-2002-1999
HP Praesidium Webproxy 1.0 running on HP-UX 11.04 VVOS could allow remote attackers to cause Webproxy to forward requests to the internal network via crafted HTTP requests.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: praesidium_webproxy
References: http://archives.neohapsis.com/archives/hp/2002-q1/0092.html, http://www.ciac.org/ciac/bulletins/m-061.shtml, http://www.iss.net/security_center/static/8606.php
CVE-2002-0101
Microsoft Internet Explorer 6.0 and earlier allows local users to cause a denial of service via an infinite loop for modeless dialogs showModelessDialog, which causes CPU usage while the focus for the dialog is not released.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_explorer
References: http://marc.info/?l=bugtraq&m=101039104608083&w=2, http://www.iss.net/security_center/static/7826.php, http://www.securityfocus.com/bid/3789
CVE-2002-0589
PVote before 1.9 allows remote attackers to change the administrative password and gain privileges by directly calling ch_info.php with the newpass and confirm parameters both set to the new password.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pvote
References: http://online.securityfocus.com/archive/1/268231, http://orbit-net.net:8001/php/pvote/, http://www.iss.net/security_center/static/8878.php
CVE-2002-2394
InterScan VirusWall 3.6 for Linux and 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 chunked transfer encoding.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: interscan_viruswall
Related CWEs: CWE-264
References: http://www.iss.net/security_center/static/10106.php, http://www.securityfocus.com/archive/1/291538, http://www.securityfocus.com/bid/5697
CWE: CWE-264
CVE-2002-0433
Pi3Web 2.0.0 allows remote attackers to view restricted files via an HTTP request containing a "*" (wildcard or asterisk) character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: pi3web
References: http://online.securityfocus.com/archive/1/260734, http://www.iss.net/security_center/static/8429.php, http://www.securityfocus.com/bid/4262
CVE-2002-1809
The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL database.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mysql
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0185.html, http://www.iss.net/security_center/static/9902.php, http://www.securityfocus.com/bid/5503
CVE-2002-1771
Matt Wright FormMail 1.9 and earlier allows remote attackers to send spam or anonymous e-mail by injecting a newline character followed by CC:, BCC:, or additional TO: fields in the email and realname CGI variables.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: formmail
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0307.html, http://www.scriptarchive.com/readme/formmail.html#history, http://www.securityfocus.com/bid/3955
CVE-2002-0802
The multibyte support in PostgreSQL 6.5.x with SQL_ASCII encoding consumes an extra character when processing a character that cannot be converted, which could remove an escape character from the query and make the application subject to SQL injection attacks.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: postgresql
References: http://marc.info/?l=postgresql-general&m=102032794322362, http://www.iss.net/security_center/static/10328.php, http://www.redhat.com/support/errata/RHSA-2002-149.html
CVE-2002-0472
MSN Messenger Service 3.6, and possibly other versions, uses weak authentication when exchanging messages between clients, which allows remote attackers to spoof messages from other users.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: msn_messenger
References: http://www.encode-sec.com/esp0202.pdf, http://www.iss.net/security_center/static/8582.php, http://www.securityfocus.com/archive/1/262906
CVE-2002-0244
Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: atheos
References: http://marc.info/?l=bugtraq&m=101310622531303&w=2, http://www.securityfocus.com/bid/4051, https://exchange.xforce.ibmcloud.com/vulnerabilities/8108
CVE-2002-0850
Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: corporate_desktop
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0106.html, http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1.1/pgphotfix_outlookplugin711/ReadMe.txt, http://marc.info/?l=bugtraq&m=103133995920090&w=2
CVE-2002-1568
OpenSSL 0.9.6e uses assertions when detecting buffer overflow attacks instead of less severe mechanisms, which allows remote attackers to cause a denial of service (crash) via certain messages that cause OpenSSL to abort from a failed assertion, as demonstrated using SSLv2 CLIENT_MASTER_KEY messages, which are not properly handled in s2_srvr.c.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: openssl
References: http://cvs.openssl.org/chngview?cn=7659, http://marc.info/?l=bugtraq&m=106511018214983, http://www.ebitech.sk/patrik/SA/SA-20031002.txt
CVE-2002-0402
Buffer overflow in X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ethereal
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt, http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505, http://marc.info/?l=bugtraq&m=102268626526119&w=2
CVE-2002-0003
Buffer overflow in the preprocessor in groff 1.16 and earlier allows remote attackers to gain privileges via lpd in the LPRng printing system.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: groff
References: http://online.securityfocus.com/advisories/3793, http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-012.php, http://www.redhat.com/support/errata/RHSA-2002-004.html
CVE-2002-2384
hotfoon4.exe in Hotfoon 4.00 stores user names and passwords in cleartext in the hotfoon2 registry key, which allows local users to gain access to user accounts and steal phone service.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: hotfoon
Related CWEs: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0115.html, http://www.iss.net/security_center/static/10591.php, http://www.securityfocus.com/bid/6155
CWE: CWE-255
CVE-2002-1523
Directory traversal vulnerability in Daniel Arenz Mini Server 2.1.6 allows remote attackers to read arbitrary files via (1) ../ (dot-dot slash) or (2) ..\ (dot-dot backslash) sequences.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mini_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0181.html, http://www.da-home.de/miniserver/update.html, http://www.iss.net/security_center/static/10366.php
CVE-2002-2139
Cisco PIX Firewall 6.0.3 and earlier, and 6.1.x to 6.1.3, do not delete the duplicate ISAKMP SAs for a user's VPN session, which allows local users to hijack a session via a man-in-the-middle attack.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: pix_firewall_software
References: http://www.ciac.org/ciac/bulletins/n-017.shtml, http://www.cisco.com/warp/public/707/pix-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10660.php
CVE-2002-0807
Cross-site scripting vulnerabilities in Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, could allow remote attackers to execute script as other Bugzilla users via the full name (real name) field, which is not properly quoted by editusers.cgi.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bugzilla
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html, http://bugzilla.mozilla.org/show_bug.cgi?id=146447, http://www.iss.net/security_center/static/9304.php
CVE-2002-0944
Cross-site scripting vulnerability in DeepMetrix LiveStats 5.03 through 6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via the (1) user-agent or (2) referrer, which are not filtered by the stats program.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: livestats
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0207.html, http://www.deepmetrix.com/log_analyzer/xsp/service/release_notes/index.asp, http://www.iss.net/security_center/static/9390.php
CVE-2002-1687
Buffer overflow in the diagnostics library in AIX allows local users to "cause data and instructions to be overwritten" via a long DIAGNOSTICS environment variable.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2002-q1/0005.html, http://archives.neohapsis.com/archives/aix/2002-q1/0005.html
CVE-2002-1140
The Sun Microsystems RPC library Services for Unix 3.0 Interix SD, as implemented on Microsoft Windows NT4, 2000, and XP, allows remote attackers to cause a denial of service (service hang) via malformed packet fragments, aka "Improper parameter size check leading to denial of service."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: services
References: http://www.iss.net/security_center/static/10258.php, http://www.securityfocus.com/bid/5879, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-057
CVE-2002-1519
Format string vulnerability in the CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the password parameter.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: rapidstream, firebox
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0325.html, http://archives.neohapsis.com/archives/bugtraq/2002-09/0335.html, http://www.iss.net/security_center/static/10217.php
CVE-2002-0546
Cross-site scripting vulnerability in the mini-browser for Winamp 2.78 and 2.79 allows remote attackers to execute script via an ID3v1 or ID3v2 tag in an MP3 file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: winamp
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0026.html, http://archives.neohapsis.com/archives/bugtraq/2002-04/0049.html, http://www.iss.net/security_center/static/8753.php
CVE-2002-0998
Directory traversal vulnerability in cafenews.php for CARE 2002 before beta 1.0.02 allows remote attackers to read arbitrary files via .. (dot dot) sequences and null characters in the lang parameter, which is processed by a call to the include function.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: care_2002
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0128.html, http://www.care2x.com/modul.php?thispage=headlines&m_titel=NEWS&m_item=Headlines&lang=en, http://www.iss.net/security_center/static/9552.php
CVE-2002-1644
SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the parent process, which allows attackers to gain certain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ssh2
References: http://www.kb.cert.org/vuls/id/740619, http://www.securityfocus.com/bid/6247, http://www.ssh.com/company/newsroom/article/286/
CVE-2002-0771
Cross-site scripting vulnerability in viewcvs.cgi for ViewCVS 0.9.2 allows remote attackers to inject script and steal cookies via the (1) cvsroot or (2) sortby parameters.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: viewcvs
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0161.html, http://www.iss.net/security_center/static/9112.php, http://www.securityfocus.com/bid/4818
CVE-2002-1867
The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an administrative account, or (2) admin/nph-build.cgi, which allows remote attackers to cause a denial of service (CPU consumption).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: imagefolio
References: http://marc.info/?l=bugtraq&m=102373053829427&w=2, http://www.iss.net/security_center/static/9308.php, http://www.securityfocus.com/bid/4975
CVE-2002-1239
QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to find and execute the cp program while operating at raised privileges, which allows local users to gain privileges by modifying the PATH to point to a malicious cp program.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: rtos
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0066.html, http://marc.info/?l=bugtraq&m=103679043232178&w=2, http://www.idefense.com/advisory/11.08.02b.txt
CVE-2002-1823
Buffer overflow in the HttpGetRequest function in Zeroo HTTP server 1.5 allows remote attackers to execute arbitrary code via a long HTTP request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: zeroo_http_server
References: http://online.securityfocus.com/archive/1/300066, http://www.iss.net/security_center/static/10642.php, http://www.securityfocus.com/bid/6190
CVE-2002-2211
BIND 4 and BIND 8, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: bind
References: http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html, http://secunia.com/advisories/20217, http://www.imconf.net/imw-2002/imw2002-papers/198.pdf
CVE-2002-0378
The default configuration of LPRng print spooler in Red Hat Linux 7.0 through 7.3, Mandrake 8.1 and 8.2, and other operating systems, accepts print jobs from arbitrary remote hosts.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: lprng
References: http://online.securityfocus.com/advisories/4205, http://www.iss.net/security_center/static/9322.php, http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-042.php
CVE-2002-1095
Cisco VPN 3000 Concentrator before 2.5.2(F), with encryption enabled, allows remote attackers to cause a denial of service (reload) via a Windows-based PPTP client with the "No Encryption" option set.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vpn_3002_hardware_client, vpn_3000_concentrator_series_software, secure_access_control_server
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10021.php, http://www.securityfocus.com/bid/5625
CVE-2002-2348
Cross-site scripting (XSS) vulnerability in athcgi.exe in Authoria HR allows remote attackers to inject arbitrary web script or HTML via the command parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: authoria
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.iss.net/security_center/static/10324.php, http://www.securityfocus.com/archive/1/294624, http://www.securityfocus.com/bid/5932
CWE: CWE-79
CVE-2002-2257
Stack-based buffer overflow in the parse_field function in cgi_lib.c for LIBCGI 1.0.2 and 1.0.3 allows remote attackers to execute arbitrary code via a long argument.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: libcgi
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0346.html, http://www.securityfocus.com/bid/6270, https://exchange.xforce.ibmcloud.com/vulnerabilities/10722
CWE: CWE-119
CVE-2002-2021
Cross-site scripting (XSS) vulnerability in WoltLab Burning Board (wbboard) 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: burning_board
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0163.html, http://www.iss.net/security_center/static/8841.php, http://www.securityfocus.com/bid/4512
CVE-2002-0352
Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: phorum
References: http://marc.info/?l=bugtraq&m=101508207206900&w=2, http://www.iss.net/security_center/static/8344.php, http://www.securityfocus.com/bid/4226
CVE-2002-1075
Buffer overflow in Pegasus mail client 4.01 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long (1) To or (2) From headers.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pegasus_mail
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0277.html, http://www.iss.net/security_center/static/9673.php, http://www.securityfocus.com/bid/5302
CVE-2002-1429
Cross-site scripting vulnerability in board.php of endity.com ShoutBOX allows remote attackers to inject arbitrary HTML into the shoutbox page via the site parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: shoutbox
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0389.html, http://endity.com/board/index.php?act=ST&f=3&t=68&s=363128162825b2d7fcf60c9cd2a292fe, http://www.iss.net/security_center/static/9739.php
CVE-2002-1016
Adobe eBook Reader allows a user to bypass restrictions for copy, print, lend, and give operations by backing up key data files, performing the operations, and restoring the original data files.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: digital_editions
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000177.html, http://www.iss.net/security_center/static/9634.php, http://www.kb.cert.org/vuls/id/438867
CVE-2002-1622
Buffer overflow in certain RPC routines in IBM AIX 4.3 may allow attackers to execute arbitrary code, related to a "variable data type."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aix
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY28706&apar=only, http://www.kb.cert.org/vuls/id/273779, https://exchange.xforce.ibmcloud.com/vulnerabilities/10112
CVE-2002-0263
Buffer overflow in EasyBoard 2000 1.27 (aka EZboard) allows remote attackers to execute arbitrary code via a long boundary value in a multipart Content-Type header to (1) ezboard.cgi, (2) ezman.cgi, or (3) ezadmin.cgi.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ezboard_2000
References: http://marc.info/?l=bugtraq&m=101345069220199&w=2, http://www.iss.net/security_center/static/8162.php, http://www.securityfocus.com/bid/4068
CVE-2002-0571
Oracle Oracle9i database server 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: oracle9i
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0175.html, http://otn.oracle.com/deploy/security/pdf/sql_joins_alert.pdf, http://www.ciac.org/ciac/bulletins/m-071.shtml
CVE-2002-1081
The Administration console for Abyss Web Server 1.0.3 allows remote attackers to read files without providing login credentials via an HTTP request to a target file that ends in a "+" character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: abyss_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0229.html, http://www.aprelium.com/news/patch1033.html, http://www.iss.net/security_center/static/9956.php
CVE-2002-0410
send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: aeromail
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0004.html, http://the.cushman.net/projects/aeromail/download/, http://the.cushman.net/projects/aeromail/download/aeromail-1.45.tar.gz
CVE-2002-0860
The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that redirects to the target file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: project, office_web_components
References: http://marc.info/?l=bugtraq&m=101829911018463&w=2, http://www.iss.net/security_center/static/8778.php, http://www.osvdb.org/3007
CVE-2002-2258
Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-numeric value in the Content-Length header, which causes an access violation after a failed atoi function call.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netsuite
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0364.html, http://www.securityfocus.com/bid/6277, https://exchange.xforce.ibmcloud.com/vulnerabilities/10725
CWE: CWE-119
CVE-2002-0247
Buffer overflows in wmtv 0.6.5 and earlier may allow local users to gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: wmtv
References: http://www.debian.org/security/2002/dsa-108, http://www.iss.net/security_center/static/8111.php, http://www.securityfocus.com/bid/4054
CVE-2002-1013
Buffer overflow in traffic_manager for Inktomi Traffic Server 4.0.18 through 5.2.2, Traffic Edge 1.1.2 and 1.5.0, and Media-IXT 3.0.4 allows local users to gain root privileges via a long -path argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: traffic_edge, media-ixt, traffic_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0023.html, http://support.inktomi.com/kb/070202-003.html, http://www.iss.net/security_center/static/9465.php
CVE-2002-0692
Buffer overflow in SmartHTML Interpreter (shtml.dll) in Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to cause a denial of service (CPU consumption) or run arbitrary code, respectively, via a certain type of web file request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: frontpage_server_extensions, windows_2000, windows_xp
References: http://www.iss.net/security_center/static/10194.php, http://www.iss.net/security_center/static/10195.php, http://www.kb.cert.org/vuls/id/723537
CVE-2002-2403
Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...", "....", ".....", and other multiple dot sequences.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: kf_web_server
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0073.html, http://securityreason.com/securityalert/3331, http://www.iss.net/security_center/static/10622.php
CWE: CWE-22
CVE-2002-1423
tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: fudforum
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html, http://online.securityfocus.com/archive/1/288042, http://www.iss.net/security_center/static/9896.php
CVE-2002-0141
Maelstrom GPL 3.0.1 allows local users to overwrite arbitrary files of other Maelstrom users via a symlink attack on the /tmp/f file.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: maelstrom_gpl
References: http://online.securityfocus.com/archive/1/251419, http://www.iss.net/security_center/static/7939.php, http://www.securityfocus.com/bid/3911
CVE-2002-0172
/dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions (644), which could allow a local user to cause a denial of service (traffic disruption).
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020408-01-I, http://www.iss.net/security_center/static/8960.php, http://www.kb.cert.org/vuls/id/770891
CVE-2002-0426
VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via manual key entry, which makes it easier for attackers to crack the keys.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: befvp41
References: ftp://ftp.linksys.com/pub/befsr41/befvp41-1402.zip, http://online.securityfocus.com/archive/1/260613, http://www.iss.net/security_center/static/8397.php
CVE-2002-1223
Buffer overflow in DSC 3.0 parser from GSview, as used in KGhostView in KDE 1.1 and KDE 3.0.3a, may allow attackers to cause a denial of service or execute arbitrary code via a modified .ps (PostScript) input file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: kde
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0163.html, http://sunsolve.sun.com/search/document.do?assetkey=1-26-101426-1, http://www.ciac.org/ciac/bulletins/n-155.shtml
CVE-2002-0366
Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_nt, windows_xp
References: http://online.securityfocus.com/archive/1/276776, http://online.securityfocus.com/archive/1/278145, http://www.nextgenss.com/vna/ms-ras.txt
CVE-2002-0806
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with the "del" option.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: bugzilla
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html, http://bugzilla.mozilla.org/show_bug.cgi?id=141557, http://www.iss.net/security_center/static/9303.php
CVE-2002-1798
MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: midicart_php_maxi, midicart_php, midicart_php_plus
Related CWEs: CWE-425
Related CAPECs: CAPEC-668, CAPEC-144, CAPEC-127
MITRE ATT&CK Techniques: T1565.002, T1083
MITRE ATT&CK Tactics: T1565
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html, http://www.iss.net/security_center/static/10306.php, http://www.securityfocus.com/bid/5851
CWE: CWE-425
MITRE ATT&CK techniques: T1565.002, T1083
MITRE ATT&CK tactics: T1565
CVE-2002-2352
The NBActiveX.ocx ActiveX control in NeoBook 4 allows remote attackers to install and execute arbitrary programs.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: neobook
References: http://online.securityfocus.com/archive/1/300073, http://securityreason.com/securityalert/3317, http://www.iss.net/security_center/static/10645.php
CVE-2002-2367
Off-by-one buffer overflow in NEC SOCKS5 1.0 r11 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long hostname.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: socks5
Related CWEs: CWE-189, CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0033.html, http://www.iss.net/security_center/static/9484.php, http://www.securityfocus.com/bid/5149
CWE: CWE-189, CWE-119
CVE-2002-1778
Symantec Norton Personal Firewall 2002 allows remote attackers to bypass the portscan protection by using a (1) SYN/FIN, (2) SYN/FIN/URG, (3) SYN/FIN/PUSH, or (4) SYN/FIN/URG/PUSH scan.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: norton_personal_firewall
References: http://online.securityfocus.com/archive/1/267850, http://securityresponse.symantec.com/avcenter/security/Content/2002.05.16.html, http://www.securityfocus.com/bid/4521
CVE-2002-1770
Qualcomm Eudora 5.1 allows remote attackers to execute arbitrary code via an HTML e-mail message that uses a file:// URL in a t:video tag to reference an attached Windows Media Player file containing JavaScript code, which is launched and executed in the My Computer zone by Internet Explorer.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: eudora
References: http://marc.info/?l=bugtraq&m=101680576827641&w=2, http://marc.info/?l=ntbugtraq&m=101680201823534&w=2, http://security.greymagic.com/adv/gm002-ie/
CVE-2002-0372
Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_media_player
References: http://www.iss.net/security_center/static/9420.php, http://www.securityfocus.com/bid/5107, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-032
CVE-2002-0309
SMTP proxy in Symantec Enterprise Firewall (SEF) 6.5.x includes the firewall's physical interface name and address in an SMTP protocol exchange when NAT translation is made to an address other than the firewall, which could allow remote attackers to determine certain firewall configuration information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: enterprise_firewall
References: http://marc.info/?l=bugtraq&m=101424307617060&w=2, http://marc.info/?l=bugtraq&m=101430810813853&w=2, http://securityresponse.symantec.com/avcenter/security/Content/2002.02.20.html
CVE-2002-1729
Cross-site scripting vulnerability (XSS) in ASPjar Guestbook 1.00 allows remote attackers to execute arbitrary script as other users via the "web site" parameter in a guestbook message.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: aspjar_guestbook
References: http://online.securityfocus.com/archive/82/270970, http://www.ifrance.com/kitetoua/tuto/5holes4.txt, http://www.securityfocus.com/bid/4671
CVE-2002-1658
Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: http_server
References: http://marc.info/?l=bugtraq&m=103480856102007&w=2, http://www.securityfocus.com/bid/5993, https://exchange.xforce.ibmcloud.com/vulnerabilities/10414
CVE-2002-0682
Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tomcat
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0014.html, http://marc.info/?l=bugtraq&m=102631703811297&w=2, http://www.osvdb.org/4973
CVE-2002-1812
Buffer overflow in gdam123 0.933 and 0.942 allows local users to execute arbitrary code via a long filename parameter.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: gdam
References: http://www.iss.net/security_center/static/9991.php, http://www.netric.org/advisories/netric-adv007.txt, http://www.securiteam.com/exploits/5CP0Y0080G.html
CVE-2002-1199
The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: sunos, openserver, openlinux, solaris
References: ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.40, http://marc.info/?l=bugtraq&m=103426842025029&w=2, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/47903
CVE-2002-1702
Cross-site scripting vulnerability (XSS) in DeltaScripts PHP Classifieds 6.0.5 allows remote attackers to execute arbitrary script as other users via the URL parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: php_classifieds
References: http://online.securityfocus.com/archive/1/277049, http://www.securityfocus.com/bid/5022, https://exchange.xforce.ibmcloud.com/vulnerabilities/9363
CVE-2002-0724
Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka "Unchecked Buffer in Network Share Provider Can Lead to Denial of Service".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000, windows_nt, windows_xp
References: http://marc.info/?l=bugtraq&m=103011556323184&w=2, http://www.kb.cert.org/vuls/id/250635, http://www.kb.cert.org/vuls/id/311619
CVE-2002-0329
Cross-site scripting vulnerability in Snitz Forums 2000 3.3.03 and earlier allows remote attackers to execute arbitrary script as other Forums 2000 users via Javascript in an IMG tag.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: snitz_forums_2000
References: http://forum.snitz.com/forum/link.asp?TOPIC_ID=23660, http://marc.info/?l=bugtraq&m=101485184605149&w=2, http://online.securityfocus.com/archive/1/258981
CVE-2002-0057
XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: xml_core_services, sql_server, windows_xp, internet_explorer
References: http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html, http://marc.info/?l=bugtraq&m=101366383408821&w=2, http://www.osvdb.org/3032
CVE-2002-0609
Vulnerability in HP MPE/iX 6.0 through 7.0 allows attackers to cause a denial of service (system failure with "SA1457 out of i_port_timeout.fix_up_message_frame") via malformed IP packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mpe_ix
References: http://online.securityfocus.com/advisories/4047, http://www.iss.net/security_center/static/8901.php, http://www.securityfocus.com/bid/4536
CVE-2002-0162
LogWatch before 2.5 allows local users to execute arbitrary code via a symlink attack on the logwatch temporary directory.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: logwatch
References: http://list.kaybee.org/archives/logwatch-announce/2002-March/000002.html, http://marc.info/?l=bugtraq&m=101724766216872, http://online.securityfocus.com/archive/82/264233
CVE-2002-0812
Information leak in Compaq WL310, and the Orinoco Residential Gateway access point it is based on, uses a system identification string as a default SNMP read/write community string, which allows remote attackers to obtain and modify sensitive configuration information by querying for the identification string.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: orinoco_rg-1100, compaq_wl310_firmware, orinoco_rg-1000, orinoco_rg-1000_firmware, compaq_wl310
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0066.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0075.html, http://www.iss.net/security_center/static/9810.php
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-2089
Buffer overflow in rcp in Solaris 9.0 allows local users to execute arbitrary code via a long command line argument.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: solaris
References: http://cert.uni-stuttgart.de/archive/vuln-dev/2002/06/msg00262.html, http://www.iss.net/security_center/static/9411.php, http://www.securityfocus.com/bid/5085
CVE-2002-0396
The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, which allows attackers to connect to the server from the same IP address as a user who has already established a session.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: 1050ap_lan_acess_point
References: http://www.atstake.com/research/advisories/2002/a060502-1.txt, http://www.securityfocus.com/bid/4940, https://exchange.xforce.ibmcloud.com/vulnerabilities/9265
CVE-2002-1399
Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later versions before 7.2.3, with unknown impact, based on an invalid integer input which is processed as a different data type, as demonstrated using cash_out(2).
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: postgresql
References: http://archives.postgresql.org/pgsql-hackers/2002-08/msg00708.php, http://archives.postgresql.org/pgsql-hackers/2002-08/msg00713.php, http://marc.info/?l=bugtraq&m=102978152712430&w=2
CVE-2002-1294
The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities via an applet that uses those references to access proprietary Microsoft methods.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: java_virtual_machine
References: http://marc.info/?l=bugtraq&m=103682630823080&w=2, http://marc.info/?l=ntbugtraq&m=103684360031565&w=2, http://www.iss.net/security_center/static/10587.php
CVE-2002-0126
Buffer overflow in BlackMoon FTP Server 1.0 through 1.5 allows remote attackers to execute arbitrary code via a long argument to (1) USER, (2) PASS, or (3) CWD.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: blackmoon_ftp_server
References: http://members.rogers.com/blackmoon2k/pages/news_page.html, http://online.securityfocus.com/archive/1/250543, http://www.iss.net/security_center/static/7895.php
CVE-2002-1357
Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: winscp, securenetterm, putty, shellguard_ssh, ssh_client
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0110.html, http://securitytracker.com/id?1005812, http://securitytracker.com/id?1005813
CWE: CWE-119
CVE-2002-1426
HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 characters, possibly triggering a buffer overflow.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: procurve_switch_4000m
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0338.html, http://www.iss.net/security_center/static/9708.php, http://www.phenoelit.de/stuff/HP_ProCurve.txt
CVE-2002-0994
SunPCi II VNC uses a weak authentication scheme, which allows remote attackers to obtain the VNC password by sniffing the random byte challenge, which is used as the key for encrypted communications.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sun_pci_ii_driver
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0003.html, http://www.iss.net/security_center/static/9476.php, http://www.securityfocus.com/bid/5146
CVE-2002-2164
Buffer overflow in Microsoft Outlook Express 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (crash) via a long <A HREF> link.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: outlook_express
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0082.html, http://online.securityfocus.com/archive/1/291058, http://www.iss.net/security_center/static/10067.php
CVE-2002-1522
Buffer overflow in PowerFTP FTP server 2.24, and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long USER argument.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: powerftp
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0075.html, http://archives.neohapsis.com/archives/bugtraq/2002-10/0194.html, http://www.iss.net/security_center/static/10286.php
CVE-2002-1966
Directory traversal vulnerability in magiccard.cgi in My Postcards Platinum 5.0 and 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: my_postcards_platinum
References: http://packetstormsecurity.nl/0206-exploits/magiccard_vuln.txt, http://www.securiteam.com/unixfocus/5IP0G2K7FQ.html, http://www.securityfocus.com/bid/5029