DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-2058
TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tracking_online
Related CWEs: CWE-327
Related CAPECs: CAPEC-614, CAPEC-97, CAPEC-459
MITRE ATT&CK Techniques: T1553.002, T1036.001
MITRE ATT&CK Tactics: T1553, T1036
References: http://online.securityfocus.com/archive/82/275246, http://www.iss.net/security_center/static/9286.php, http://www.securityfocus.com/bid/4926
CWE: CWE-327
MITRE ATT&CK techniques: T1553.002, T1036.001
MITRE ATT&CK tactics: T1553, T1036
CVE-2002-1663
The Post_Method function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service (crash) via a POST request with an invalid or missing Content-Length header value.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: monkey
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0023.html, http://monkeyd.sourceforge.net/Changelog.txt, http://secunia.com/advisories/7449
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-0342
Kmail 1.2 on KDE 2.1.1 allows remote attackers to cause a denial of service (crash) via an email message whose body is approximately 55 K long.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: k-mail
References: http://marc.info/?l=bugtraq&m=101475683425671&w=2, http://www.iss.net/security_center/static/8283.php, http://www.securityfocus.com/bid/4177
CVE-2002-0621
Buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000 allows remote attackers to cause the process to fail or run arbitrary code in the LocalSystem security context via certain input to the OWC package installer.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: commerce_server
References: http://www.iss.net/security_center/static/9424.php, http://www.osvdb.org/5172, http://www.securityfocus.com/bid/5108
CVE-2002-0392
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, http_server
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt, ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32, ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31
CVE-2002-0560
PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA_UTIL stored procedures (1) OWA_UTIL.signature, (2) OWA_UTIL.listprint, or (3) OWA_UTIL.show_query_columns.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: application_server_web_cache, application_server, oracle9i, oracle8i
References: http://marc.info/?l=bugtraq&m=101301813117562&w=2, http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf, http://www.cert.org/advisories/CA-2002-08.html
CVE-2002-0626
Polycom ViewStation before 7.2.4 has a default null password for the administrator account, which allows arbitrary users to conduct unauthorized activities.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: viewstation_sp_384, viewstation_mp, viewstation_v.35, viewstation_dcp, viewstation_fx_vs4000
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21089, http://www.ciac.org/ciac/bulletins/m-123.shtml, http://www.iss.net/security_center/static/9347.php
CVE-2002-0543
Directory traversal vulnerability in Aprelium Abyss Web Server (abyssws) before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. (dot dot) sequences in the HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: abyss_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0110.html, http://www.aprelium.com/forum/viewtopic.php?t=24, http://www.iss.net/security_center/static/8805.php
CVE-2002-0318
FreeRADIUS RADIUS server allows remote attackers to cause a denial of service (CPU consumption) via a flood of Access-Request packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: freeradius
References: http://marc.info/?l=bugtraq&m=101440113410083&w=2, http://www.iss.net/security_center/static/9968.php, http://marc.info/?l=bugtraq&m=101440113410083&w=2
CVE-2002-0059
The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: zlib
Related CWEs: CWE-415
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-015.1.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000469, http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:022
CWE: CWE-415
CVE-2002-2233
Directory traversal vulnerability in Enceladus Server Suite 3.9 allows remote attackers to list arbitrary directories and possibly cause a denial of service via "@" (at) characters in a CD (CWD) command, such as (1) "@/....\", (2) "@@@/..c:\", or (3) "@/..@/..".
CVSS v2.0 Score: 8.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:C
Affected Products: enceladus_server_suite
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0193.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/11019, https://exchange.xforce.ibmcloud.com/vulnerabilities/11020
CWE: CWE-22
CVE-2002-1165
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sendmail, netbsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-023.txt.asc, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000532, http://marc.info/?l=bugtraq&m=103350914307274&w=2
CVE-2002-0271
Runtime library in GNU Ada compiler (GNAT) 3.12p through 3.14p allows local users to modify files of other users via a symlink attack on temporary files.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: gnat_pro_native
References: http://marc.info/?l=bugtraq&m=101353440624007&w=2, http://www.securityfocus.com/bid/4086, http://marc.info/?l=bugtraq&m=101353440624007&w=2
CVE-2002-1278
The mailconf module in Linuxconf 1.24, and other versions before 1.28, on Conectiva Linux 6.0 through 8, and possibly other distributions, generates the Sendmail configuration file (sendmail.cf) in a way that configures Sendmail to run as an open mail relay, which allows remote attackers to send Spam email.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: linuxconf
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000544, http://www.iss.net/security_center/static/10554.php, http://www.osvdb.org/6066
CVE-2002-2189
Cross-site scripting (XSS) vulnerability in ActiveXperts Software ActiveWebserver allows remote attackers to execute arbitrary web script via a link.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: windows_2003_server, activwebserver
References: http://www.iss.net/security_center/static/9540.php, http://www.securiteam.com/windowsntfocus/5MP0C0K7PM.html, http://www.iss.net/security_center/static/9540.php
CVE-2002-0268
Identix BioLogon 3 allows users with physical access to the system to gain administrative privileges by using CTRL-ALT-DEL and running a "Browse" function, which runs Explorer with SYSTEM privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: biologon
References: http://marc.info/?l=bugtraq&m=101366270807034&w=2, http://www.iss.net/security_center/static/8201.php, http://www.securityfocus.com/bid/4101
CVE-2002-1462
details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by modifying certain hidden form fields.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: php-affiliate
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0141.html, http://www.iss.net/security_center/static/9858.php, http://www.securityfocus.com/bid/5482
CVE-2002-1438
The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to obtain Perl version information via the -v option.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: netware
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0202.html, http://support.novell.com/servlet/tidfinder/2963307, http://www.iss.net/security_center/static/9917.php
CVE-2002-2270
Unspecified vulnerability in the ied command in HP-UX 10.10, 10.20, and 11.0 allows local users to view "normally invisible data" via unknown attack vectors.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: hp-ux
Related CWEs: CWE-264
References: http://www.securityfocus.com/advisories/4742, http://www.securityfocus.com/bid/6317, https://exchange.xforce.ibmcloud.com/vulnerabilities/10777
CWE: CWE-264
CVE-2002-0862
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: macos, internet_explorer, windows_2000, windows_nt, windows_me
Related CWEs: CWE-295
Related CAPECs: CAPEC-475, CAPEC-459
References: http://marc.info/?l=bugtraq&m=102866120821995&w=2, http://marc.info/?l=bugtraq&m=102918200405308&w=2, http://marc.info/?l=bugtraq&m=102976967730450&w=2
CWE: CWE-295
CVE-2002-0773
imp_rootdir.asp for Hosting Controller allows remote attackers to copy or delete arbitrary files and directories via a direct request to imp_rootdir.asp and modifying parameters such as (1) ftp, (2) owwwPath, and (3) oftpPath.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: hosting_controller
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0142.html, http://www.iss.net/security_center/static/9105.php, http://www.securityfocus.com/bid/4761
CVE-2002-1632
Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: application_server
References: http://www.kb.cert.org/vuls/id/717827, http://www.kb.cert.org/vuls/id/SVIM-576QLZ, http://www.nextgenss.com/papers/hpoas.pdf
CVE-2002-1971
The ping utility in networking_utils.php in Sourcecraft Networking_Utils 1.0 allows remote attackers to read arbitrary files via shell metacharacters in the Domain name or IP address argument.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: networking_utils
References: http://online.securityfocus.com/archive/1/298588, http://securitytracker.com/id?1005543, http://www.iss.net/security_center/static/10541.php
CVE-2002-0455
IncrediMail stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in other software that rely on installing and reading files from directories with known pathnames.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: incredimail
References: http://www.iss.net/security_center/static/8460.php, http://www.securityfocus.com/archive/1/262262, http://www.securityfocus.com/bid/4297
CVE-2002-1791
SGI IRIX 6.5 through 6.5.17 creates temporary desktop files with world-writable permissions, which allows local users to overwrite or corrupt those files.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020903-02-P, http://www.ciac.org/ciac/bulletins/n-004.shtml, http://www.iss.net/security_center/static/10273.php
CVE-2002-2273
Cross-site scripting (XSS) vulnerability in Webster HTTP Server allows remote attackers to inject arbitrary web script or HTML via the URL.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: webster_http_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://securityreason.com/securityalert/3262, http://www.securityfocus.com/archive/1/301893, http://www.securityfocus.com/bid/6292
CWE: CWE-79
CVE-2002-1996
Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and (2) catid parameter in index.php.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: postnuke
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0288.html, http://archives.neohapsis.com/archives/bugtraq/2002-03/0299.html, http://sourceforge.net/tracker/index.php?func=detail&aid=524777&group_id=27927&atid=392228
CVE-2002-1044
Buffer overflow in Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Subject field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: popcorn
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0117.html, http://www.iss.net/security_center/static/9547.php, http://www.securityfocus.com/bid/5212
CVE-2002-1060
Cross-site scripting (XSS) vulnerability in Blue Coat Systems (formerly CacheFlow) CacheOS on Client Accelerator 4.1.06, Security Gateway 2.1.02, and Server Accelerator 4.1.06 allows remote attackers to inject arbitrary web script or HTML via a URL to a nonexistent hostname that includes the HTML, which is inserted into the resulting error page.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: cacheos
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0283.html, http://download.cacheflow.com/release/CA/4.1.00-docs/CACacheOS41fixes.htm, http://www.iss.net/security_center/static/9674.php
CVE-2002-2239
The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: ios, catalyst_6500, catalyst_7600
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.cisco.com/warp/public/707/osm-lc-ios-pkt-vuln-pub.shtml, http://www.securityfocus.com/bid/6358, https://exchange.xforce.ibmcloud.com/vulnerabilities/10823
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-0631
Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020607-02-I, http://www.iss.net/security_center/static/9418.php, http://www.securityfocus.com/bid/5092
CVE-2002-0096
The installation of Geeklog 1.3 creates an extra group_assignments record which is not properly deleted, which causes the first newly created user to be added to the GroupAdmin and UserAdmin groups, which could provide that user with administrative privileges that were not intended.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: geeklog
References: http://geeklog.sourceforge.net/index.php?topic=Security, http://www.iss.net/security_center/static/7780.php, http://www.securityfocus.com/archive/1/248367
CVE-2002-2186
Macromedia JRun 3.0, 3.1, and 4.0 allow remote attackers to view the source code of .JSP files via Unicode encoded character values in a URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jrun
References: http://www.iss.net/security_center/static/10570.php, http://www.macromedia.com/v1/Handlers/index.cfm?ID=23500, http://www.securityfocus.com/bid/6126
CVE-2002-1003
Buffer overflow in MyWebServer 1.02 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mywebserver
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0073.html, http://www.iss.net/security_center/static/9501.php, http://www.securityfocus.com/bid/5184
CVE-2002-2214
The php_if_imap_mime_header_decode function in the IMAP functionality in PHP before 4.2.2 allows remote attackers to cause a denial of service (crash) via an e-mail header with a long "To" header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: php
References: http://bugs.php.net/bug.php?id=15595, http://secunia.com/advisories/21202, http://www.redhat.com/support/errata/RHSA-2006-0567.html
CVE-2002-1457
SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: l-forum
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0074.html, http://www.iss.net/security_center/static/9837.php, http://www.securityfocus.com/bid/5468
CVE-2002-0155
Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: msn_chat_control, msn_messenger_service_for_exchange, msn_messenger
References: http://marc.info/?l=bugtraq&m=102089960531919&w=2, http://www.cert.org/advisories/CA-2002-13.html, http://www.iss.net/security_center/static/9041.php
CVE-2002-0447
Directory traversal vulnerability in Xerver Free Web Server 2.10 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in an HTTP GET request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: xerver
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0091.html, http://archives.neohapsis.com/archives/bugtraq/2002-03/0155.html, http://www.iss.net/security_center/static/8421.php
CVE-2002-2098
Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: axspawn
References: http://securitytracker.com/id?1003242, http://www.dabo.de/software/axspawn.html, http://www.securityfocus.com/bid/3824
CVE-2002-0307
Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existence of arbitrary files or execute any Perl program on the system via a .. (dot dot) in the p parameter, which reads the target file and attempts to execute the line using Perl's eval function.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: avengers_news_system
References: http://marc.info/?l=bugtraq&m=101430868616112&w=2, http://www.securityfocus.com/bid/4147, http://marc.info/?l=bugtraq&m=101430868616112&w=2
CVE-2002-2178
Cross-site scripting (XSS) vulnerability in article.php module for phpWebSite 0.8.3 allows remote attackers to execute arbitrary Javascript script via the sid parameter, as demonstrated using an IMG tag.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpwebsite
References: http://www.iss.net/security_center/static/10256.php, http://www.securityfocus.com/archive/1/293879, http://www.securityfocus.com/bid/5864
CVE-2002-0018
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_nt
References: http://www.securityfocus.com/bid/3997, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-001, https://exchange.xforce.ibmcloud.com/vulnerabilities/8023
CVE-2002-0552
Multiple buffer overflows in Melange Chat server 2.02 allow remote or local attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a long argument in the /yell command, (2) long lines in the /etc/melange.conf configuration file, (3) long file names, or possibly other attacks.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: melange_chat_system
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0157.html, http://online.securityfocus.com/archive/1/267932, http://www.iss.net/security_center/static/8842.php
CVE-2002-0744
namerslv in AIX 4.3.3 core dumps when called with a very long argument, possibly as a result of a buffer overflow.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://archives.neohapsis.com/archives/aix/2002-q2/0005.html, http://archives.neohapsis.com/archives/aix/2002-q2/0005.html
CVE-2002-1038
Double Choco Latte (DCL) before 20020706 does not properly verify if a file was uploaded, which allows remote attackers to conduct certain operations on arbitrary files via the (1) Projects: Upload File Attachment or (2) Work Orders: Import features.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: double_choco_latte
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0022.html, http://dcl.sourceforge.net/index.php, http://marc.info/?l=bugtraq&m=102668783632589&w=2
CVE-2002-1851
Buffer overflow in WS_FTP Pro 7.5 allows remote attackers to execute code on a client system via unknown attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ws_ftp_pro
References: http://www.iss.net/security_center/static/10185.php, http://www.nextgenss.com/vna/ips-wsftp.txt, http://www.securityfocus.com/bid/4850
CVE-2002-1592
The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: http_server
References: http://www.apache.org/dist/httpd/CHANGES_2.0, http://www.iss.net/security_center/static/9623.php, http://www.kb.cert.org/vuls/id/165803
CVE-2002-1271
The Mail::Mailer Perl module in the perl-MailTools package 1.47 and earlier uses mailx as the default mailer, which allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: perl-mailtools
References: http://marc.info/?l=bugtraq&m=103659723101369&w=2, http://marc.info/?l=bugtraq&m=103679569705086&w=2, http://www.debian.org/security/2003/dsa-386
CVE-2002-0798
Vulnerability in swinstall for HP-UX 11.00 and 11.11 allows local users to view obtain data views for files that cannot be directly read by the user, which reportedly can be used to cause a denial of service.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: hp-ux
References: http://archives.neohapsis.com/archives/hp/2002-q2/0059.html, http://www.iss.net/security_center/static/9207.php, http://www.securityfocus.com/bid/4886
CVE-2002-0346
Cross-site scripting vulnerability in Cobalt RAQ 4 allows remote attackers to execute arbitrary script as other Cobalt users via Javascript in a URL to (1) service.cgi or (2) alert.cgi.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cobalt_raq_3i, cobalt_raq_4, cobalt_raq_2
References: http://marc.info/?l=bugtraq&m=101495944202452&w=2, http://www.iss.net/security_center/static/8321.php, http://www.securityfocus.com/bid/4211
CVE-2002-0477
Standalone Macromedia Flash Player 5.0 before 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the "exec" FSCommand.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: flash_player
References: http://marc.info/?l=bugtraq&m=101071988413107&w=2, http://www.iss.net/security_center/static/8587.php, http://www.macromedia.com/support/flash/ts/documents/standalone_update.htm
CVE-2002-0007
CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which causes a null password to be sent to the LDAP server.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: bugzilla
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html, http://bugzilla.mozilla.org/show_bug.cgi?id=54901, http://rhn.redhat.com/errata/RHSA-2002-001.html
CVE-2002-1506
Buffer overflow in Linuxconf before 1.28r4 allows local users to execute arbitrary code via a long LINUXCONF_LANG environment variable, which overflows an error string that is generated.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: linuxconf
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0304.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0093.html, http://www.iss.net/security_center/static/9980.php
CVE-2002-1417
Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to read arbitrary files via a URL containing a "..%5c" sequence (modified dot-dot), which is mapped to the directory separator.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: small_business_suite, netware
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0199.html, http://support.novell.com/servlet/tidfinder/2963297, http://www.iss.net/security_center/static/9910.php
CVE-2002-0977
Buffer overflow in Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to execute arbitrary code via a long TS value.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: file_transfer_manager
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0189.html, http://archives.neohapsis.com/archives/bugtraq/2002-08/0189.html
CVE-2002-2084
Directory traversal vulnerability in index.php of Portix 0.4.02 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) l and (2) topic parameters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: portix-php
References: http://archives.neohapsis.com/archives/vuln-dev/2002-q1/0279.html, http://securitytracker.com/id?1003430, http://www.securityfocus.com/bid/4038
CVE-2002-1614
Buffer overflow in HP Tru64 UNIX allows local users to execute arbitrary code via a long argument to /usr/bin/at.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: hp-ux, tru64
References: http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html, http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html, http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11
CVE-2002-0541
Buffer overflow in Tivoli Storage Manager TSM (1) Server or Storage Agents 3.1 through 5.1, and (2) the TSM Client Acceptor Service 4.2 and 5.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 1580 or port 1581.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tivoli_storage_manager
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0126.html, http://online.securityfocus.com/archive/1/267143, http://www.iss.net/security_center/static/8817.php
CVE-2002-2229
Directory traversal vulnerability in Sapio Design Ltd. WebReflex 1.53 allows remote attackers to read arbitrary files via a .. in an HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: webreflex
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0068.html, http://www.iss.net/security_center/static/10782.php, http://www.securityfocus.com/bid/6327
CWE: CWE-22
CVE-2002-1481
savesettings.php in phpGB 1.20 and earlier does not require authentication, which allows remote attackers to cause a denial of service or execute arbitrary PHP code by using savesettings.php to modify config.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpgb
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0076.html, http://www.iss.net/security_center/static/10065.php, http://www.securityfocus.com/bid/5679
CVE-2002-1529
Cross-site scripting (XSS) vulnerability in msgError.asp for the administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows remote attackers to insert arbitrary script or HTML via the Reason parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: superscout_email_filter
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0137.html, http://www.iss.net/security_center/static/10319.php, http://www.securityfocus.com/bid/5928
CVE-2002-0510
The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remote attackers to determine that a target system is running Linux.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: linux_kernel
References: http://www.iss.net/security_center/static/8588.php, http://www.securityfocus.com/archive/1/262840, http://www.securityfocus.com/bid/4314
CVE-2002-1138
Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka "Flaw in Output File Handling for Scheduled Jobs."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sql_server, data_engine
References: http://www.ciac.org/ciac/bulletins/n-003.shtml, http://www.iss.net/security_center/static/10257.php, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056
CVE-2002-1492
Buffer overflows in the Cisco VPN 5000 Client before 5.2.7 for Linux, and VPN 5000 Client before 5.2.8 for Solaris, allow local users to gain root privileges via (1) close_tunnel and (2) open_tunnel.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: vpn_5000_client
References: http://www.cisco.com/warp/public/707/vpn5k-client-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10131.php, http://www.securityfocus.com/bid/5734
CVE-2002-1650
The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: squirrelmail
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0296.html, http://archives.neohapsis.com/archives/bugtraq/2002-01/0306.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/7990
CVE-2002-0408
htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: domino
References: http://marc.info/?l=bugtraq&m=101310812804716&w=2, http://marc.info/?l=bugtraq&m=101785616526383&w=2, http://www.securityfocus.com/bid/4049
CVE-2002-2030
Stack-based buffer overflow in SQLData Enterprise Server 3.0 allows remote attacker to execute arbitrary code and cause a denial of service via a long HTTP request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sqldata_enterprise_server
References: http://securitytracker.com/id?1003123, http://www.iss.net/security_center/static/7821.php, http://www.securityfocus.com/bid/3778
CVE-2002-0715
Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: squid
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-046.0.txt, http://marc.info/?l=bugtraq&m=102674543407606&w=2, http://rhn.redhat.com/errata/RHSA-2002-051.html
CVE-2002-0780
IP/IPX gateway for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service via a connection to port 8225 with a large amount of random data, which causes ipipxgw.nlm to ABEND.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: bordermanager
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0060.html, http://online.securityfocus.com/archive/1/271475, http://www.iss.net/security_center/static/9032.php
CVE-2002-0336
Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a LIST command containing a large number of / (slash), * (wildcard), and .. characters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: worldgroup, worldgroup_lite_personal_server
References: http://marc.info/?l=bugtraq&m=101484128203523&w=2, http://www.iss.net/security_center/static/8297.php, http://www.securityfocus.com/bid/4185
CVE-2002-0558
Directory traversal vulnerability in TYPSoft FTP server 0.97.1 and earlier allows a remote authenticated user (possibly anonymous) to list arbitrary directories via a .. in a LIST (ls) command ending in wildcard *.* characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: typsoft_ftp_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0090.html, http://www.iss.net/security_center/static/6165.php, http://www.securityfocus.com/bid/2489
CVE-2002-1085
Multiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary and other capabilities.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ezcontents
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0040.html, http://online.securityfocus.com/archive/1/284229, http://www.iss.net/security_center/static/9712.php
CVE-2002-1680
Cross-site scripting (XSS) vulnerability in CGI Online Worldweb Shopping 1.1 (a.k.a. COWS) allows remote attackers to execute arbitrary script as other users by injecting script into (1) diagnose.cgi or (2) compatible.cgi.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: cgi_online_worldweb_shopping
References: http://online.securityfocus.com/archive/82/251570, http://www.securityfocus.com/bid/3914, http://www.securityfocus.com/bid/3921
CVE-2002-2347
Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: application_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://otn.oracle.com/deploy/security/pdf/2002alert41rev1.pdf, http://www.iss.net/security_center/static/9842.php, http://www.securityfocus.com/bid/5452
CWE: CWE-79
CVE-2002-2411
Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: bannerwheel
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://seclists.org/lists/bugtraq/2002/May/0183.html, http://www.securityfocus.com/bid/4782, https://exchange.xforce.ibmcloud.com/vulnerabilities/9115
CWE: CWE-119
CVE-2002-1989
Resin 2.1.1 allows remote attackers to cause a denial of service (thread and connection consumption) via multiple URL requests containing the DOS 'CON' device name and a registered file extension such as .jsp or .xtp.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: resin
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0108.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0108.html
CVE-2002-2183
phpShare.php in phpShare before 0.6 beta 3 allows remote attackers to include and execute arbitrary PHP scripts from remote servers.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpshare
References: http://www.securityfocus.com/bid/5049, http://www.securityfocus.com/bid/5049
CVE-2002-1545
CooolSoft Personal FTP Server 2.24 allows remote attackers to obtain the absolute pathname of the FTP root via a PWD command, which includes the full path in the response.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: personal_ftp_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0142.html, http://archives.neohapsis.com/archives/bugtraq/2002-10/0142.html
CVE-2002-1838
Charities.cron 1.0.2 through 1.6.0 allows local users to write to arbitrary files via a symlink attack on temporary files.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: charities.cron
References: http://www.securityfocus.com/bid/4869, http://www.stevesachs.com/charities.cron_CHANGELOG, http://www.securityfocus.com/bid/4869
CVE-2002-0867
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet Explorer via invalid handle data in a Java applet, aka "Handle Validation Flaw."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: virtual_machine
References: http://www.iss.net/security_center/static/10134.php, http://www.kb.cert.org/vuls/id/792881, http://www.securityfocus.com/bid/5750
CVE-2002-1527
emumail.cgi in EMU Webmail 5.0 allows remote attackers to determine the full pathname for emumail.cgi via a malformed string containing script, which generates a regular expression matching error that includes the pathname in the resulting error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: emu_webmail
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0131.html, http://www.iss.net/security_center/static/10204.php, http://www.iss.net/security_center/static/10205.php
CVE-2002-1903
Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: pine
References: http://online.securityfocus.com/archive/1/276029, http://www.iss.net/security_center/static/9297.php, http://www.securityfocus.com/bid/4963
CVE-2002-0250
Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authentication via a direct HTTP request to the web_access.html file, which allows the user to change the switch's configuration and modify the administrator password.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: advancestack_10base-t_switching_hub_j3200a, advancestack_10base-t_switching_hub_j3205a, advancestack_10base-t_switching_hub_j3204a, advancestack_10base-t_switching_hub_j3202a, advancestack_10base-t_switching_hub_j3201a
References: http://marc.info/?l=bugtraq&m=101318469216213&w=2, http://online.securityfocus.com/advisories/3870, http://www.iss.net/security_center/static/8124.php
CVE-2002-0739
Cross-site scripting in PostCalendar 3.02 allows remote attackers to insert arbitrary HTML and script, and steal cookies, by modifying a calendar entry in its preview page.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: postcalendar
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0288.html, http://www.iss.net/security_center/static/8899.php, http://www.securityfocus.com/bid/4563
CVE-2002-2407
Certain patches for QNX Neutrino realtime operating system (RTOS) 6.2.0 set insecure permissions for the files (1) /sbin/io-audio by OS Update Patch A, (2) /bin/shutdown, (3) /sbin/fs-pkg, and (4) phshutdown by QNX experimental patches, (5) cpim, (6) vpim, (7) phrelaycfg, and (8) columns, (9) othello, (10) peg, (11) solitaire, and (12) vpoker in the games pack 2.0.3, which allows local users to gain privileges by modifying the files before permissions are changed.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: rtos
Related CWEs: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0255.html, http://www.iss.net/security_center/static/10656.php, http://www.securityfocus.com/bid/6206
CWE: CWE-264
CVE-2002-0500
Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc property that references the target file, which sets certain elements of the image object such as file size.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: internet_explorer
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0331.html, http://www.iss.net/security_center/static/8658.php, http://www.securityfocus.com/bid/4371
CVE-2002-2289
soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive information including ODBC passwords.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: badblue
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://online.securityfocus.com/archive/1/300992, http://securityreason.com/securityalert/3243, http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2002-11/0329.html
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-1619
Buffer overflow in the FC client for IBM AIX 4.3.x allows remote attackers to cause a denial of service (crash and core dump).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: aix
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY27310&apar=only, http://www.kb.cert.org/vuls/id/152955, https://exchange.xforce.ibmcloud.com/vulnerabilities/10127
CVE-2002-0799
Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cmailserver
References: http://online.securityfocus.com/archive/1/273512, http://www.iss.net/security_center/static/9132.php, http://www.securityfocus.com/bid/4789
CVE-2002-1341
Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the (1) mailbox and (2) passed_id parameters.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: squirrelmail
References: http://f0kp.iplus.ru/bz/008.txt, http://marc.info/?l=bugtraq&m=103893844126484&w=2, http://marc.info/?l=bugtraq&m=103911130503272&w=2
CVE-2002-0428
Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the to_expire or expire values in the client's users.C configuration file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: firewall-1, next_generation, check_point_vpn
References: http://online.securityfocus.com/archive/1/260662, http://www.iss.net/security_center/static/8423.php, http://www.securityfocus.com/bid/4253
CVE-2002-0849
Linux-iSCSI iSCSI implementation installs the iscsi.conf file with world-readable permissions on some operating systems, including Red Hat Linux Limbo Beta #1, which could allow local users to gain privileges by reading the cleartext CHAP password.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: iscsi_driver
References: http://marc.info/?l=bugtraq&m=102882056105806&w=2, http://marc.info/?l=bugtraq&m=102891036424424&w=2, http://www.iss.net/security_center/static/9792.php