DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-0129
efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: efax
References: http://marc.info/?l=vuln-dev&m=101114350330912&w=2, http://seclists.org/bugtraq/2002/Jan/0212.html, http://www.iss.net/security_center/static/7921.php
CVE-2002-0400
ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL, aka DoS_findtype.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: bind
References: ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.24.1/CSSA-2002-SCO.24.1.txt, http://archives.neohapsis.com/archives/hp/2002-q3/0022.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000494
CVE-2002-1886
TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain the database username and password.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tightauction
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html, http://www.iss.net/security_center/static/10310.php, http://www.securityfocus.com/bid/5850
CVE-2002-2055
Cross-site scripting (XSS) vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: teekai_tracking_online
References: http://marc.info/?l=vuln-dev&m=102313697923798&w=2, http://www.ifrance.com/kitetoua/tuto/Teekai.txt, http://www.iss.net/security_center/static/9284.php
CVE-2002-0457
Cross-site scripting vulnerability in signgbook.php for BG GuestBook 1.0 allows remote attackers to execute arbitrary Javascript via encoded tags such as &lt;, &gt;, and &amp; in fields such as (1) name, (2) email, (3) AIM screen name, (4) website, (5) location, or (6) message.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: bg_guestbook
References: http://www.iss.net/security_center/static/8474.php, http://www.securityfocus.com/archive/1/262693, http://www.securityfocus.com/bid/4308
CVE-2002-0878
SQL injection vulnerability in the login form for LogiSense software including (1) Hawk-i Billing, (2) Hawk-i ASP and (3) DNS Manager allows remote attackers to bypass authentication via SQL code in the password field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dns_manager_system, hawk-i
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0010.html, http://www.iss.net/security_center/static/9268.php, http://www.securityfocus.com/bid/4931
CVE-2002-0914
Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely large or negative value for the year, which causes a tight loop.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: courier_mta
References: http://sourceforge.net/project/shownotes.php?release_id=93065, http://www.iss.net/security_center/static/9228.php, http://www.osvdb.org/5052
CVE-2002-1418
Buffer overflow in the interpreter for Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to cause a denial of service (ABEND) via a long module name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: small_business_suite, netware
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0199.html, http://support.novell.com/servlet/tidfinder/2963297, http://www.iss.net/security_center/static/9911.php
CVE-2002-1229
Avaya Cajun switches P880, P882, P580, and P550R 5.2.14 and earlier contain undocumented accounts (1) manuf and (2) diag with default passwords, which allows remote attackers to gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cajun_p882, cajun_p880, cajun_p550, cajun_p580, cajun_p550r
References: http://marc.info/?l=bugtraq&m=103470243012971&w=2, http://support.avaya.com/japple/css/japple?PAGE=avaya.css.OpenPage&temp.template.name=Avaya_P580_P882_Undocumented, http://www.iss.net/security_center/static/10374.php
CVE-2002-1834
The default configuration of Xerox DocuTech 6110 and DocuTech 6115 allows remote attackers to connect to the web server and (1) submit print jobs directly into the "print now" queue or (2) read the scanner job history.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: docutech_6115, docutech_6110
References: http://online.securityfocus.com/archive/1/273029, http://online.securityfocus.com/archive/1/273078, http://www.iss.net/security_center/static/9108.php
CVE-2002-0475
Cross-site scripting vulnerability in phpBB 1.4.4 and earlier allows remote attackers to execute arbitrary Javascript on web clients by embedding the script within an IMG image tag while editing a message.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: phpbb
References: http://www.iss.net/security_center/static/7459.php, http://www.securiteam.com/unixfocus/6W00Q202UM.html, http://www.securityfocus.com/bid/4379
CVE-2002-1108
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.6(Rel), when configured with all tunnel mode, can be forced into acknowledging a TCP packet from outside the tunnel.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: vpn_client
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml, http://www.securityfocus.com/bid/5651, https://exchange.xforce.ibmcloud.com/vulnerabilities/10047
CVE-2002-1981
Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: sql_server
References: http://seclists.org/lists/bugtraq/2002/Sep/0009.html, http://www.iss.net/security_center/static/10012.php, http://www.ngssoftware.com/advisories/mssql-sp_MSSetServerProperties.txt
CVE-2002-1684
Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in the script used to read Microsoft Office documents.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: badblue, d2gfx
References: http://www.securityfocus.com/archive/1/251523, http://www.securityfocus.com/bid/3913, https://exchange.xforce.ibmcloud.com/vulnerabilities/7946
CVE-2002-1950
Cross-site scripting (XSS) vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML via the (1) the email parameter of add.php or (2) the banner URL (banurl parameter) in the main list.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phprank
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0148.html, http://www.iss.net/security_center/static/10351.php, http://www.securityfocus.com/bid/5946
CVE-2002-1885
PHP remote file inclusion vulnerability in showhits.php3 for PowerPhlogger (PPhlogger) 2.0.9 through 2.2.2 allows remote attackers to execute arbitrary PHP code via the rel_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: powerphlogger
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html, http://www.iss.net/security_center/static/10309.php, http://www.securityfocus.com/bid/5860
CVE-2002-1504
Directory traversal vulnerability in WebServer 4 Everyone 1.22 allows remote attackers to read arbitrary files via "..\" (dot-dot backslash) sequences in a URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webserver_4_everyone
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0045.html, http://www.iss.net/security_center/static/10051.php, http://archives.neohapsis.com/archives/bugtraq/2002-09/0045.html
CVE-2002-1973
Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0, and 6.0 before SP3, as used in multiple products including BadBlue, allows remote attackers to cause a denial of service (access violation and crash) and possibly execute arbitrary code via a long query string that causes a parsing error.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: badblue, foundation_class_library
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0082.html, http://archives.neohapsis.com/archives/bugtraq/2002-07/0135.html, http://archives.neohapsis.com/archives/bugtraq/2002-07/0144.html
CVE-2002-2299
PHP remote file inclusion vulnerability in thatfile.php in Thatware 0.3 through 0.5.2 allows remote attackers to execute arbitrary PHP code via the root_path parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: thatware
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0000.html, http://securitytracker.com/id?1005733, https://exchange.xforce.ibmcloud.com/vulnerabilities/10758
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-2077
The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: windows_2000
References: http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq300367, http://www.bindview.com/Services/razor/Advisories/2002/adv_dcom.cfm, http://www.iss.net/security_center/static/8739.php
CVE-2002-0324
Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-*.reg file which contains the administrator name and password in cleartext, then retrieving the file from the web server before the Greymatter administrator performs a "Clear And Exit" action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: graymatter
References: http://marc.info/?l=bugtraq&m=101465343308249&w=2, http://www.dangerousmonkey.com/dangblog/dangarch/00000051.htm, http://www.iss.net/security_center/static/8277.php
CVE-2002-0122
Siemens 3568i WAP mobile phones allows remote attackers to cause a denial of service (crash) via an SMS message containing unusual characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: 3568i_wap
References: http://online.securityfocus.com/archive/1/250115, http://www.iss.net/security_center/static/7902.php, http://www.securityfocus.com/bid/3870
CVE-2002-1159
Canna 3.6 and earlier does not properly validate requests, which allows remote attackers to cause a denial of service or information leak.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Affected Products: canna
References: http://canna.sourceforge.jp/sec/Canna-2002-01.txt, http://www.debian.org/security/2003/dsa-224, http://www.redhat.com/support/errata/RHSA-2002-246.html
CVE-2002-1284
The wizard in KGPG 0.6 through 0.8.2 does not properly provide the passphrase to gpg when creating new keys, which causes secret keys to be created with an empty passphrase and allows local attackers to steal the keys if they can be read.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: kgpg
References: http://devel-home.kde.org/~kgpg/bug.html, http://marc.info/?l=bugtraq&m=103702926611286&w=2, http://www.securityfocus.com/bid/6152
CVE-2002-1594
Buffer overflow in (1) grpck and (2) pwck, if installed setuid on a system as recommended in some AIX documentation, may allow local users to gain privileges via a long command line argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: pwck, grpck
References: http://marc.info/?l=vuln-dev&m=100999352406822&w=2, http://marc.info/?l=vulnwatch&m=100998205010794&w=2, http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds2/grpck.htm
CVE-2002-1045
Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service (crash) via a malformed Date field that is converted into a year greater than 2037.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: popcorn
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0117.html, http://www.iss.net/security_center/static/9547.php, http://www.securityfocus.com/bid/5212
CVE-2002-0782
Novell BorderManager 3.5 with PAT (Port-Address Translate) enabled allows remote attackers to cause a denial of service by filling the connection table with a large number of connection requests to hosts that do not have a specific route, which may be forwarded to the public interface.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: bordermanager
References: http://online.securityfocus.com/archive/1/271957, http://www.iss.net/security_center/static/9062.php, http://www.securityfocus.com/bid/4726
CVE-2002-2041
Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allows local users to execute arbitrary code via (1) a long ABLANG environment variable in phlocale or (2) a long -u option to pkg-installer.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: rtos
References: http://online.securityfocus.com/archive/1/275218, http://www.iss.net/security_center/static/9258.php, http://www.iss.net/security_center/static/9259.php
CVE-2002-0520
Cross-site scripting vulnerability in functions-inc.asp for ASP-Nuke RC1 allows remote attackers to execute script as other ASP-Nuke users by embedding it within an IMG tag.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: asp-nuke
References: http://online.securityfocus.com/archive/82/266705, http://www.asp-nuke.com/news.asp?date=20020412&cat=11, http://www.ifrance.com/kitetoua/tuto/ASPNuke.txt
CVE-2002-0712
Entrust Authority Security Manager (EASM) 6.0 does not properly require multiple master users to change the password of a master user, which could allow a master user to perform operations that require multiple authorizations.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: entrust_authority_security_manager
References: http://www.kb.cert.org/vuls/id/720017, http://www.kb.cert.org/vuls/id/AAMN-5KKVXC, http://www.securityfocus.com/bid/7284
CVE-2002-0398
Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: 1050ap_lan_acess_point
References: http://www.atstake.com/research/advisories/2002/a060502-1.txt, http://www.securityfocus.com/bid/4943, https://exchange.xforce.ibmcloud.com/vulnerabilities/9267
CVE-2002-1530
The administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows users to obtain usernames and plaintext passwords via a request to the userlist.asp program, which includes the passwords in a user editing form.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: superscout_email_filter
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0137.html, http://www.iss.net/security_center/static/10320.php, http://www.securityfocus.com/bid/5929
CVE-2002-0824
BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: point-to-point_protocol_daemon
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-010.txt.asc, http://marc.info/?l=bugtraq&m=102812546815606&w=2, http://www.iss.net/security_center/static/9738.php
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2002-0498
Etnus TotalView 5.0.0-4 installs certain files with UID 5039 and GID 59, which could allow local users with that UID or GID to modify the files and gain privileges as other TotalView users.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: totalview
References: http://www.iss.net/security_center/static/8635.php, http://www.securityfocus.com/archive/1/264085, http://www.securityfocus.com/bid/4365
CVE-2002-1014
Buffer overflow in RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary code via an RFS skin file whose skin.ini contains a long value in a CONTROLnImage argument, such as CONTROL1Image.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: realone_player, realjukebox_2_plus, realjukebox_2
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0127.html, http://service.real.com/help/faq/security/bufferoverrun07092002.html, http://www.iss.net/security_center/static/9538.php
CVE-2002-1325
Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir Exposure Vulnerability."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: windows_2000, windows_nt, windows_98se, windows_98, windows_me
References: http://www.securityfocus.com/bid/6380, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-069, http://www.securityfocus.com/bid/6380
CVE-2002-1612
Buffer overflow in mailcv in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: hp-ux, tru64
References: http://ftp.support.compaq.com.au/pub/patches/Digital_UNIX/v5.1a/patch_kit/Tru64_UNIX_V5.1A/doc/txt/OSFPAT00131500520.txt, http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11, http://www.kb.cert.org/vuls/id/408771
CVE-2002-0596
WebTrends Reporting Center 4.0d allows remote attackers to determine the real path of the web server via a GET request to get_od_toc.pl with an empty Profile parameter, which leaks the pathname in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: reporting_center
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0207.html, http://www.iss.net/security_center/static/8865.php, http://www.ngssoftware.com/advisories/wtr.txt
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-1109
securetar, as used in AMaViS shell script 0.2.1 and earlier, allows users to cause a denial of service (CPU consumption) via a malformed TAR file, possibly via an incorrect file size parameter.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: virus_scanner
References: http://marc.info/?l=amavis-announce&m=103121272122242&w=2, http://marc.info/?l=bugtraq&m=103124270321404&w=2, http://www.iss.net/security_center/static/10056.php
CVE-2002-0038
Vulnerability in the cache-limiting function of the unified name service daemon (nsd) in IRIX 6.5.4 through 6.5.11 allows remote attackers to cause a denial of service by forcing the cache to fill the disk.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020102-01-I, ftp://patches.sgi.com/support/free/security/advisories/20020102-02-I, ftp://patches.sgi.com/support/free/security/advisories/20020102-03-P
CVE-2002-0688
ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: zope
References: http://www.debian.org/security/2004/dsa-490, http://www.iss.net/security_center/static/9610.php, http://www.redhat.com/support/errata/RHSA-2002-060.html
CVE-2002-0099
Buffer overflow in Michael Lamont Savant Web Server 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP request to the cgi-bin directory in which the CGI program name contains a large number of . (dot) characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: savant_webserver
References: http://marc.info/?l=bugtraq&m=101027722904078&w=2, http://marc.info/?l=ntbugtraq&m=101062823305479&w=2, http://www.iss.net/security_center/static/7786.php
CVE-2002-0950
Cross-site scripting vulnerability in TransWARE Active! mail 1.422 and 2.0 allows remote attackers to execute arbitrary code via a certain e-mail header, which is not properly filtered.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: active_mail
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0108.html, http://www.iss.net/security_center/static/9358.php, http://www.securityfocus.com/bid/5007
CVE-2002-1837
The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album parameter, which generates different error messages depending on whether the directory exists or not.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ids
References: http://ids.sourceforge.net/ChangeLog.html, http://online.securityfocus.com/archive/1/274433, http://www.iss.net/security_center/static/9201.php
CVE-2002-1061
Multiple buffer overflows in Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTTP GET request with a long major version number, (2) an HTTP GET request to the HTTP proxy on port 3128 with a long major version number, (3) a long OK reply from a POP3 server, and (4) a long SMTP server response.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jana_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0329.html, http://www.iss.net/security_center/static/9682.php, http://www.iss.net/security_center/static/9683.php
CVE-2002-1002
Buffer overflow in Novell iManager (eMFrame 1.2.1) allows remote attackers to cause a denial of service (crash) via a long user name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: emframe
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0093.html, http://online.securityfocus.com/archive/1/279683, http://www.iss.net/security_center/static/9444.php
CVE-2002-1024
Cisco IOS 12.0 through 12.2, when supporting SSH, allows remote attackers to cause a denial of service (CPU consumption) via a large packet that was designed to exploit the SSH CRC32 attack detection overflow (CVE-2001-0144).
CVSS v2.0 Score: 7.1 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Affected Products: ios, pix_firewall_software, css11000_content_services_switch, catos
Related CWEs: CWE-399
References: http://www.cisco.com/warp/public/707/SSH-scanning.shtml, http://www.iss.net/security_center/static/9437.php, http://www.kb.cert.org/vuls/id/290140
CWE: CWE-399
CVE-2002-1007
Cross-site scripting vulnerabilities in Blackboard 5 allow remote attackers to execute arbitrary web script via (1) the course_id parameter in a link to login.pl, (2) the CTID parameter in ProcessInfo.cgi, or (3) the Message parameter in index.cgi.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: blackboard
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0005.html, http://www.iss.net/security_center/static/9467.php, http://www.securityfocus.com/bid/5137
CVE-2002-1447
Buffer overflow in the vpnclient program for UNIX VPN Client before 3.5.2 allows local users to gain administrative privileges via a long profile name in a connect argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: vpn_client
References: http://online.securityfocus.com/archive/1/277653, http://sec.angrypacket.com/advisories/0002_AP.vpnclient.txt, http://www.cisco.com/warp/public/707/cisco-unix-vpnclient-buffer-overflow-pub.shtml
CVE-2002-2026
Buffer overflow in BrowseFTP 1.62 client allows remote FTP servers to execute arbitrary code via a long FTP "220" message reply.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: browseftp_client
References: http://securitytracker.com/id?1003130, http://www.iss.net/security_center/static/7793.php, http://www.securityfocus.com/bid/3781
CVE-2002-2434
NWFTPD.nlm before 5.02i in the FTP server in Novell NetWare does not properly listen for data connections, which allows remote attackers to cause a denial of service (abend) via multiple FTP sessions.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netware_ftp_server, netware
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1, http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE-2002-1734
NewsPro 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to "logged,true".
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: newspro
References: http://www.derkeiler.com/Mailing-Lists/securityfocus/vuln-dev/2002-05/0135.html, http://www.securityfocus.com/bid/4672, https://exchange.xforce.ibmcloud.com/vulnerabilities/9007
CVE-2002-0143
Buffer overflow in Eterm of Enlightenment Imlib2 1.0.4 and earlier allows local users to execute arbitrary code via a long HOME environment variable.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eterm, imlib
References: http://online.securityfocus.com/archive/1/250145, http://online.securityfocus.com/archive/1/251597, http://www.iss.net/security_center/static/7896.php
CVE-2002-0200
Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: cyberstop_web_server
References: http://marc.info/?l=bugtraq&m=101174569103289&w=2, http://www.iss.net/security_center/static/7959.php, http://www.securityfocus.com/bid/3929
CVE-2002-1256
The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: windows_2000, windows_2000_terminal_services, windows_xp
References: http://www.securityfocus.com/bid/6367, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-070, https://exchange.xforce.ibmcloud.com/vulnerabilities/10843
CVE-2002-0551
Cross-site scripting vulnerability in Dynamic Guestbook 3.0 allows remote attackers to execute code in clients who access guestbook pages via the parameters (1) name, (2) mail, or (3) kommentar.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dynamic_guestbook
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0052.html, http://www.iss.net/security_center/static/8763.php, http://www.securityfocus.com/bid/4422
CVE-2002-2141
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: weblogic_server
References: http://dev2dev.bea.com/pub/advisory/39, http://www.iss.net/security_center/static/10291.php, http://www.securityfocus.com/bid/5846
CVE-2002-0622
The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer, aka "OWC Package Command Execution".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: commerce_server
References: http://www.iss.net/security_center/static/9425.php, http://www.osvdb.org/5170, http://www.securityfocus.com/bid/5111
CVE-2002-0316
Cross-site scripting vulnerability in eXtreme message board (XMB) 1.6x and earlier allows remote attackers to execute script as other XMB users by inserting the script into an IMG tag.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xmb_forum
References: http://marc.info/?l=bugtraq&m=101447886404876&w=2, http://www.iss.net/security_center/static/8262.php, http://www.securityfocus.com/bid/4167
CVE-2002-2110
The RCA Digital Cable Modems DCM225 and DCM225E allow remote attackers to cause a denial of service (modem device reset) by connecting to port 80 on the 10.0.0.0/8 device.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: digital_cable_modem
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0335.html, http://www.iss.net/security_center/static/8661.php, http://www.securityfocus.com/bid/4375
CVE-2002-2091
Format string vulnerability in Deception Finger Daemon, decfingerd, 0.7 may allow remote attackers to execute arbitrary code via the username of a finger request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: decfingerd
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0314.html, http://www.iss.net/security_center/static/9434.php, http://www.securityfocus.com/bid/5105
CVE-2002-0425
mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message in a DCC connection request that cannot be ignored or canceled by the user, which may leak the alternate nickname in a response message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mirc
References: http://online.securityfocus.com/archive/1/260244, http://www.iss.net/security_center/static/8393.php, http://www.osvdb.org/5301
CVE-2002-0731
Cross-site scripting vulnerability in demonstration scripts for vqServer allows remote attackers to execute arbitrary script via a link that contains the script in arguments to demo scripts such as respond.pl.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vqserver
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0313.html, http://www.iss.net/security_center/static/8935.php, http://www.securityfocus.com/bid/4573
CVE-2002-1416
The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct brute force attacks.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webeasymail
References: http://online.securityfocus.com/archive/1/288222, http://www.iss.net/security_center/static/9925.php, http://www.securityfocus.com/bid/5519
CVE-2002-0662
scrollkeeper-get-cl in ScrollKeeper 0.3 to 0.3.11 allows local users to create and overwrite files via a symlink attack on the scrollkeeper-tempfile.x temporary files.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: scrollkeeper
References: http://marc.info/?l=bugtraq&m=103098575826031&w=2, http://marc.info/?l=bugtraq&m=103115387102294&w=2, http://www.debian.org/security/2002/dsa-160
CVE-2002-1718
Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: internet_information_services
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://online.securityfocus.com/archive/1/255555, http://online.securityfocus.com/archive/1/256125, http://www.securityfocus.com/bid/4084
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-1035
Omnicron OmniHTTPd 2.09 allows remote attackers to cause a denial of service (crash) via an HTTP request with a long, malformed HTTP 1version number.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: omnihttpd
References: http://online.securityfocus.com/archive/1/280132, http://www.iss.net/security_center/static/9457.php, http://www.osvdb.org/5000
CVE-2002-2215
The imap_header function in the IMAP functionality for PHP before 4.3.0 allows remote attackers to cause a denial of service via an e-mail message with a large number of "To" addresses, which triggers an error in the rfc822_write_address function.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: php
References: http://bugs.php.net/bug.php?id=19280, https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175040, http://bugs.php.net/bug.php?id=19280
CVE-2002-0523
ASP-Nuke RC2 and earlier allows remote attackers to list all logged-in users by submitting an invalid "pseudo" cookie.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: asp-nuke
References: http://online.securityfocus.com/archive/82/266705, http://www.asp-nuke.com/news.asp?date=20020412&cat=11, http://www.ifrance.com/kitetoua/tuto/ASPNuke.txt
CVE-2002-1907
TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: simplewebserver
References: http://online.securityfocus.com/archive/1/295149, http://www.iss.net/security_center/static/10367.php, http://www.securityfocus.com/bid/5961
CVE-2002-1381
Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitrary code by modifying the pid_file_path value.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: exim
References: http://groups.yahoo.com/group/exim-users/message/42358, http://marc.info/?l=bugtraq&m=103903403527788&w=2, http://marc.info/?l=bugtraq&m=104006219018664&w=2
CVE-2002-1362
mICQ 0.4.9 and earlier allows remote attackers to cause a denial of service (crash) via malformed ICQ message types without a 0xFE separator character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: micq
References: http://www.debian.org/security/2002/dsa-211, http://www.redhat.com/support/errata/RHSA-2003-118.html, http://www.securityfocus.com/bid/6392
CVE-2002-0945
Buffer overflow in SeaNox Devwex allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: devwex
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0056.html, http://www.iss.net/security_center/static/9298.php, http://www.osvdb.org/5047
CVE-2002-0603
Snapgear Lite+ firewall 1.5.3 allows remote attackers to cause a denial of service (IPSEC crash) via a zero length packet to UDP port 500.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: snapgear_lite\+_firewall
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0050.html, http://marc.info/?l=bugtraq&m=102035583114759&w=2, http://www.iss.net/security_center/static/8987.php
CVE-2002-0982
Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sql_server
References: http://marc.info/?l=bugtraq&m=103004505027360&w=2, http://marc.info/?l=bugtraq&m=103004505027360&w=2
CVE-2002-1745
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: internet_information_services
Related CWEs: CWE-193
References: http://online.securityfocus.com/archive/1/268303, http://www.securityfocus.com/bid/4543, https://exchange.xforce.ibmcloud.com/vulnerabilities/8853
CWE: CWE-193
CVE-2002-0139
Pi-Soft SpoonFTP 1.1 and earlier allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: spoonftp
References: http://online.securityfocus.com/archive/1/251422, http://www.iss.net/security_center/static/7943.php, http://www.pi-soft.com/spoonftp/index.shtml
CVE-2002-1127
Buffer overflow in uucp in Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long source (-s) command line parameter.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: osf_1
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0122.html, http://www.iss.net/security_center/static/10146.php, http://www.securityfocus.com/bid/5745
CVE-2002-1912
SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Ethernet interface when the buffers are full, which allows remote attackers to cause a denial of service (null pointer exception and kernel panic) via a large number of packets.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: emr5000
Related CWEs: CWE-476
References: http://www.globalintersec.com/adv/skystream-2002021001.txt, http://www.iss.net/security_center/static/10380.php, http://www.securityfocus.com/archive/1/295516
CWE: CWE-476
CVE-2002-1814
Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via long command line arguments.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: slackware_linux, linux, bonobo, mandrake_linux
References: http://online.securityfocus.com/archive/1/279676, http://www.iss.net/security_center/static/9451.php, http://www.securiteam.com/exploits/5AP0E0K8AO.html
CVE-2002-2002
Buffer overflow in libc in Compaq Tru64 4.0F, 5.0, 5.1 and 5.1A allows attackers to execute arbitrary code via long (1) LANG and (2) LOCPATH environment variables.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tru64
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/04/msg00219.html, http://ftp.support.compaq.com/patches/.new/html/SSRT-541.shtml, http://www.iss.net/security_center/static/8863.php
CVE-2002-1751
csLiveSupport.cgi in CGIScript.net csLiveSupport allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: cslivesupport
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/04/msg00106.html, http://www.securityfocus.com/bid/4450, https://exchange.xforce.ibmcloud.com/vulnerabilities/8636
CVE-2002-0952
Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service (reset) by sending IP packets with non-zero Type of Service (TOS) bits to the Timing Control Card (TCC) LAN interface.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: optical_networking_systems_software
References: http://www.cisco.com/warp/public/707/ons-tos-vuln-pub.shtml, http://www.iss.net/security_center/static/9377.php, http://www.securityfocus.com/bid/5058
CVE-2002-2378
Cross-site scripting (XSS) vulnerability in AN HTTP 1.41d allows remote attackers to inject arbitrary web script or HTML via a colon (:) in the query string, which is inserted into the resulting error page.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: an_httpd
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/10/msg00387.html, http://www.iss.net/security_center/static/10487.php, http://www.securityfocus.com/bid/6054
CWE: CWE-79
CVE-2002-1280
Memory leak in RealSecure Event Collector 6.5 allows attackers to cause a denial of service (memory consumption and crash).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: realsecure_event_collector
References: http://www.isskk.co.jp/support/XPressUpdates/RS/RS65ECSR15RNj.html, http://www.isskk.co.jp/support/XPressUpdates/RS/RS65ECSR15RNj.html
CVE-2002-1816
Off-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: atphttpd
Related CWEs: CWE-193
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0187.html, http://secunia.com/advisories/7293, http://www.iss.net/security_center/static/10362.php
CWE: CWE-193
CVE-2002-1439
Unknown vulnerability related to stack corruption in the TGA daemon for HP-UX 11.04 (VVOS) Virtualvault 4.0, 4.5, and 4.6 may allow attackers to obtain access to system files.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: virtualvault, vvos
References: http://archives.neohapsis.com/archives/hp/2002-q3/0050.html, http://www.iss.net/security_center/static/9846.php, http://www.securityfocus.com/bid/5459
CVE-2002-1070
Cross-site scripting vulnerability in PHPWiki Postnuke wiki module allows remote attackers to execute script as other PHPWiki users via the pagename parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php-wiki
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0190.html, http://www.iss.net/security_center/static/9627.php, http://www.securityfocus.com/bid/5254
CVE-2002-1250
Buffer overflow in Abuse 2.00 and earlier allows local users to gain root privileges via a long -net command line argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: abuse
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0055.html, http://www.idefense.com/advisory/11.01.02.txt, http://www.iss.net/security_center/static/10519.php
CVE-2002-0149
Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_information_server, internet_information_services
References: http://www.cert.org/advisories/CA-2002-09.html, http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml, http://www.iss.net/security_center/static/8798.php
CVE-2002-1931
Cross-site scripting (XSS) vulnerability in PHP Arena paFileDB 1.1.3 and 2.1.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the search string.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: pafiledb
References: http://online.securityfocus.com/archive/1/296387, http://www.iss.net/security_center/static/10451.php, http://www.phparena.net/downloads/pafiledb.php?action=license&id=1&file=16
CVE-2002-1659
user_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user_id variable.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: portalapp
References: http://secunia.com/advisories/10465, http://securitytracker.com/id?1005541, https://exchange.xforce.ibmcloud.com/vulnerabilities/10558
CVE-2002-1623
The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses before the password is supplied or (2) sniffing, as originally reported for FireWall-1 SecuRemote.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: vpn-1_firewall-1
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001223.html, http://marc.info/?l=bugtraq&m=103124812629621&w=2, http://marc.info/?l=bugtraq&m=103176164729351&w=2
CVE-2002-0148
Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_information_server, internet_information_services
References: http://www.cert.org/advisories/CA-2002-09.html, http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml, http://www.iss.net/security_center/static/8803.php