DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-1368
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing negative arguments to be fed into memcpy() calls via HTTP requests with (1) a negative Content-Length value or (2) a negative length in a chunked transfer encoding.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x, cups
References: ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-004.0.txt, http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702
CVE-2002-1055
Buffer overflow in administrative web server for Brother NC-3100h printer allows remote attackers to cause a denial of service via a long password.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: nc-3100h
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0353.html, http://www.iss.net/security_center/static/9701.php, http://www.securityfocus.com/bid/5339
CVE-2002-1831
Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-encoded spaces (%20) in the Invitation-Cookie field.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: msn_messenger
References: http://online.securityfocus.com/archive/1/274086, http://www.iss.net/security_center/static/9161.php, http://www.securityfocus.com/bid/4827
CVE-2002-1469
scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls by uploading malicious programs and modifying the PATH variable in $HOME/.ssh/environment to locate those programs.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: scponly
References: http://online.securityfocus.com/archive/1/288245, http://www.iss.net/security_center/static/9913.php, http://www.securityfocus.com/bid/5526
CVE-2002-1283
Buffer overflow in Novell iManager (eMFrame) before 1.5 allows remote attackers to cause a denial of service via an authentication request with a long Distinguished Name (DN) attribute.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: emframe
References: http://marc.info/?l=bugtraq&m=103703760321408&w=2, http://support.novell.com/servlet/tidfinder/2963651, http://www.securityfocus.com/bid/6154
CVE-2002-1848
TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which could allow local users to access passwords.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tightvnc
References: http://www.securityfocus.com/bid/4835, http://www.tightvnc.com/changelog-win32.html, http://www.securityfocus.com/bid/4835
CVE-2002-0605
Buffer overflow in Flash OCX for Macromedia Flash 6 revision 23 (6,0,23,0) allows remote attackers to execute arbitrary code via a long movie parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: flash_player
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0051.html, http://marc.info/?l=bugtraq&m=102039374017185&w=2, http://marc.info/?l=vuln-dev&m=102038919414726&w=2
CVE-2002-1954
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the query string argument, as demonstrated using soinfo.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: php
References: http://archives.neohapsis.com/archives/bugtraq/2003-06/0027.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0021.html, http://www.iss.net/security_center/static/10355.php
CVE-2002-2323
Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored from backup, which could allow local or remote attackers to bypass intended access restrictions.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: solaris_pc_netlink
Related CWEs: CWE-281, CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-27807-1, http://www.iss.net/security_center/static/9665.php, http://www.securityfocus.com/bid/5281
CWE: CWE-281, CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2002-1591
AOL Instant Messenger (AIM) 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: instant_messenger
References: http://www.informationweek.com/story/IWK20010927S0021, http://www.instantmessagingplanet.com/security/article.php/10818_1014151, http://www.kb.cert.org/vuls/id/744139
CVE-2002-1312
Buffer overflow in the Web management interface in Linksys BEFW11S4 wireless access point router 2 and BEFSR11, BEFSR41, and BEFSRU31 EtherFast Cable/DSL routers with firmware before 1.43.3 with remote management enabled allows remote attackers to cause a denial of service (router crash) via a long password.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: befw11s4, hpro200, befsr41, befsr81, befsru31
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0022.html, http://www.idefense.com/application/poi/display?id=36&type=vulnerabilities&flashstatus=true, http://www.securityfocus.com/bid/6208
CVE-2002-1531
The administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows remote attackers to cause a denial of service (crash) via an HTTP request without a Content-Length parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: superscout_email_filter
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0137.html, http://www.iss.net/security_center/static/10321.php, http://www.securityfocus.com/bid/5930
CVE-2002-0062
Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to "routines for moving the physical cursor and scrolling."
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ncurses, debian_linux, suse_linux, linux, freebsd
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: http://www.debian.org/security/2002/dsa-113, http://www.iss.net/security_center/static/8222.php, http://www.redhat.com/support/errata/RHSA-2002-020.html
CWE: CWE-120
CVE-2002-1541
BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP request containing an extra / (slash).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: badblue
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0041.html, http://www.iss.net/security_center/static/10466.php, http://www.securityfocus.com/bid/6044
CVE-2002-1132
SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: squirrelmail
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0246.html, http://www.debian.org/security/2002/dsa-191, http://www.iss.net/security_center/static/10345.php
CVE-2002-0714
FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: squid
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-046.0.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000506, http://marc.info/?l=bugtraq&m=102674543407606&w=2
CVE-2002-0595
Buffer overflow in WTRS_UI.EXE (WTX_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a long HTTP GET request to the /reports/ directory.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: reporting_center
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0207.html, http://www.iss.net/security_center/static/8864.php, http://www.securityfocus.com/bid/4531
CVE-2002-2246
Cross-site scripting (XSS) vulnerability in VisNetic Website before 3.5.15 allows remote attackers to inject arbitrary web script or HTML via the HTTP referer header (HTTP_REFERER) to a non-existent page, which is injected into the resulting 404 error page.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: visnetic_website
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0113.html, http://www.deerfield.com/products/visnetic_website/, http://www.securityfocus.com/bid/6369
CWE: CWE-79
CVE-2002-1737
Astaro Security Linux 2.016 creates world-writable files and directories, which allows local users to overwrite arbitrary files.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: security_linux
References: http://online.securityfocus.com/archive/1/256124, http://online.securityfocus.com/archive/1/256127, http://www.securityfocus.com/bid/4103
CVE-2002-1102
The LAN-to-LAN IPSEC capability for Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.4, allows remote attackers to cause a denial of service via an incoming LAN-to-LAN connection with an existing security association with another device on the remote network, which causes the concentrator to remove the previous connection.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vpn_3002_hardware_client, vpn_3000_concentrator_series_software
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml, http://www.securityfocus.com/bid/5622, https://exchange.xforce.ibmcloud.com/vulnerabilities/10027
CVE-2002-0550
Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dynamic_guestbook
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0052.html, http://www.iss.net/security_center/static/8762.php, http://www.securityfocus.com/bid/4423
CVE-2002-1849
ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back button, then logging into the same chat room as a different user, which fills the chat room with invalid users.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: parachat_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0427.html, http://www.iss.net/security_center/static/9735.php, http://www.securityfocus.com/bid/5370
CVE-2002-2114
Artekopia Netjuke before 1.0 b7 allows remote attackers to execute arbitrary code on the web server, possibly via the section parameter, which is passed to an eval call.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: netjuke
References: http://sourceforge.net/tracker/index.php?func=detail&aid=507312&group_id=42076&atid=432052, http://www.securityfocus.com/bid/3988, https://exchange.xforce.ibmcloud.com/vulnerabilities/8101
CVE-2002-0350
HP Procurve Switch 4000M running firmware C.08.22 and C.09.09 allows remote attackers to cause a denial of service via a port scan of the management IP address, which disables the telnet service.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: procurve_switch_4000m
References: http://marc.info/?l=bugtraq&m=101500123900612&w=2, http://www.iss.net/security_center/static/8329.php, http://www.securityfocus.com/bid/4212
CVE-2002-0930
Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 (NWFTPD) allows remote attackers to cause a denial of service (ABEND) via format strings in the USER command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netware
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0127.html, http://online.securityfocus.com/archive/1/278689, http://www.iss.net/security_center/static/9429.php
CVE-2002-0804
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bugzilla
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html, http://bugzilla.mozilla.org/show_bug.cgi?id=129466, http://www.iss.net/security_center/static/9301.php
CVE-2002-0875
Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to the root group.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: fam, irix, debian_linux
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc, ftp://patches.sgi.com/support/free/security/advisories/20000301-03-I, http://www.debian.org/security/2002/dsa-154
CVE-2002-0701
ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: openbsd, freebsd
References: http://marc.info/?l=bugtraq&m=102650797504351&w=2, http://www.iss.net/security_center/static/9474.php, http://www.openbsd.org/errata.html#ktrace
CVE-2002-1456
Buffer overflow in mIRC 6.0.2 and earlier allows remote attackers to execute arbitrary code via a long $asctime value.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mirc
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0092.html, http://marc.info/?l=bugtraq&m=103046375002380&w=2, http://marc.info/?l=ntbugtraq&m=103046138631893&w=2
CVE-2002-1482
SQL injection vulnerability in login.php for phpGB 1.20 and earlier, when magic_quotes_gpc is not enabled, allows remote attackers to gain administrative privileges via SQL code in the password entry.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: phpgb
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0076.html, http://www.iss.net/security_center/static/10068.php, http://www.securityfocus.com/bid/5673
CVE-2002-1233
A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:N
Affected Products: http_server
References: http://marc.info/?l=bugtraq&m=103480856102007&w=2, http://www.debian.org/security/2002/dsa-187, http://www.debian.org/security/2002/dsa-188
CVE-2002-1894
Cross-site scripting (XSS) vulnerability in viewtopic.php in phpBB 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpbb
References: http://online.securityfocus.com/archive/1/300362, http://www.iss.net/security_center/static/10653.php, http://www.phpbb.com/phpBB/viewtopic.php?t=56283
CVE-2002-1114
config_inc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) g_bottom_include_page, (2) g_top_include_page, (3) g_css_include_file, (4) g_meta_include_file, or (5) a cookie.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mantis
References: http://marc.info/?l=bugtraq&m=102978711618648&w=2, http://www.debian.org/security/2002/dsa-153, http://www.iss.net/security_center/static/9900.php
CVE-2002-0046
Linux kernel, and possibly other operating systems, allows remote attackers to read portions of memory via a series of fragmented ICMP packets that generate an ICMP TTL Exceeded response, which includes portions of the memory in the response packet.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: linux_kernel
References: http://www.osvdb.org/5394, http://www.redhat.com/support/errata/RHSA-2002-007.html, http://www.securityfocus.com/archive/1/251418
CVE-2002-2290
Mambo Site Server 4.0.11 installs with a default username and password of admin, which allows remote attackers to gain privileges.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mambo_site_server
Related CWEs: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0111.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/10857, http://archives.neohapsis.com/archives/bugtraq/2002-12/0111.html
CWE: CWE-255
CVE-2002-1821
Ultimate PHP Board (UPB) 1.0 and 1.0b allows remote authenticated users to gain privileges and perform unauthorized actions via direct requests to (1) admin_members.php, (2) admin_config.php, (3) admin_cat.php, or (4) admin_forum.php.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ultimate_php_board
References: http://securitytracker.com/id?1005198, http://www.securityfocus.com/bid/5666, http://securitytracker.com/id?1005198
CVE-2002-1797
ChaiVM for HP color LaserJet 4500 and 4550 or HP LaserJet 4100 and 8150 does not properly enforce access control restrictions, which could allow local users to add, delete, or modify any services hosted by the ChaiServer.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: chaivm
References: http://online.securityfocus.com/archive/1/284648, http://www.iss.net/security_center/static/9694.php, http://www.phenoelit.de/stuff/HP_Chai.txt
CVE-2002-1048
HP JetDirect printers allow remote attackers to obtain the administrative password for the (1) web and (2) telnet services via an SNMP request to the variable (.iso.3.6.1.4.1.11.2.3.9.4.2.1.3.9.1.1.0.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jetdirect
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0345.html, http://www.iss.net/security_center/static/9693.php, http://www.kb.cert.org/vuls/id/377003
CVE-2002-1065
Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, does not restrict the number of unsuccessful login attempts, which makes it easier for remote attackers to gain privileges via brute force username and password guessing.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jana_web_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0329.html, http://www.iss.net/security_center/static/9688.php, http://archives.neohapsis.com/archives/bugtraq/2002-07/0329.html
CVE-2002-1068
The web server for D-Link DP-300 print server allows remote attackers to cause a denial of service (hang) via a large HTTP POST request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: dp-303
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0341.html, http://marc.info/?l=vuln-dev&m=102779425117680&w=2, http://www.iss.net/security_center/static/9703.php
CVE-2002-1755
tinc 1.0pre3 and 1.0pre4 VPN does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on CBC.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: tinc
References: http://www.securityfocus.com/archive/1/249142, https://exchange.xforce.ibmcloud.com/vulnerabilities/7868, http://www.securityfocus.com/archive/1/249142
CVE-2002-1906
The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) by sending incomplete HTTP requests and leaving the connections open.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: viavideo
References: http://online.securityfocus.com/archive/1/295146, http://www.iss.net/security_center/static/10360.php, http://www.polycom.com/common/pw_item_show_doc/0%2C1449%2C1442%2C00.pdf
CVE-2002-0524
ASP-Nuke RC2 and earlier allows remote attackers to determine the absolute path of the server by (1) calling database-inc.asp with incorrect cookies, or (2) calling Post.asp with certain arguments, which leak the pathname in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: asp-nuke
References: http://online.securityfocus.com/archive/82/266705, http://www.asp-nuke.com/news.asp?date=20020412&cat=11, http://www.ifrance.com/kitetoua/tuto/ASPNuke.txt
CVE-2002-0576
ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: coldfusion_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0028.html, http://online.securityfocus.com/archive/1/268263, http://www.iss.net/security_center/static/8866.php
CVE-2002-0717
PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php
References: http://marc.info/?l=bugtraq&m=102734515923277&w=2, http://marc.info/?l=bugtraq&m=102734516023281&w=2, http://www.cert.org/advisories/CA-2002-21.html
CVE-2002-0354
The XMLHttpRequest object (XMLHTTP) in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories on a client system by opening a URL that redirects the browser to the file on the client, then reading the result using the responseText property.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: mozilla, navigator
References: http://marc.info/?l=bugtraq&m=102017952204097&w=2, http://marc.info/?l=ntbugtraq&m=102020343728766&w=2, http://marc.info/?l=bugtraq&m=102017952204097&w=2
CVE-2002-0223
Infopop UBB.Threads 5.4 and Wired Community Software WWWThreads 5.0 through 5.0.9 allows remote attackers to upload arbitrary files by using a filename that contains an accepted extension, but ends in a different extension.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: wwwthreads, ultimate_bulletin_board
References: http://online.securityfocus.com/archive/1/253172, http://www.iss.net/security_center/static/8022.php, http://www.securityfocus.com/bid/3993
CVE-2002-1731
The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: os_400
References: http://securitytracker.com/id?1003507, http://www.securityfocus.com/bid/4059, https://exchange.xforce.ibmcloud.com/vulnerabilities/8179
CVE-2002-1698
Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument in the message header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: msn_messenger
References: http://online.securityfocus.com/archive/1/271130, http://www.securityfocus.com/bid/4675, https://exchange.xforce.ibmcloud.com/vulnerabilities/9014
CVE-2002-1495
Cross-site scripting (XSS) vulnerability in JAWmail 1.0-rc1 allows remote attackers to insert arbitrary script or HTML via (1) attached file names in the Read Mail feature, (2) text/html mails that are displayed in a pop-up window, and (3) certain malicious attributes within otherwise safe tags, such as onMouseOver.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: jawmail
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0270.html, http://www.iss.net/security_center/static/10152.php, http://www.securityfocus.com/bid/5771
CVE-2002-1352
Per Magne Knutsen's CartMan shopping cart (cartman.php) 1.04 and earlier allows remote attackers to modify product prices by changing the price parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: cartman
References: http://securitytracker.com/id?1005829, http://www.idefense.com/advisory/12.16.02c.txt, http://securitytracker.com/id?1005829
CVE-2002-2070
SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: secureclean
Related CWEs: CWE-459
References: http://www.ciac.org/ciac/bulletins/m-034.shtml, http://www.iss.net/security_center/static/7953.php, http://www.securityfocus.com/archive/1/251565
CWE: CWE-459
CVE-2002-0181
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: imp, horde
References: http://bugs.horde.org/show_bug.cgi?id=916, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000473, http://marc.info/?l=bugtraq&m=101828033830744&w=2
CVE-2002-1322
Rational ClearCase 4.1, 2002.05, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain packets to port 371, e.g. via nmap.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: clearcase
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0084.html, http://marc.info/?l=bugtraq&m=103808239618238&w=2, http://www.securityfocus.com/bid/6228
CVE-2002-2372
The telnet server in Infoprint 21 running controller software before 1.056007 allows remote attackers to cause a denial of service (crash) via a long username, possibly due to a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: infoprint_21, infoprint
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0364.html, http://www.iss.net/security_center/static/10474.php, http://www.securityfocus.com/bid/6047
CWE: CWE-119
CVE-2002-2330
Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to stats.html and executed in client browsers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: statsplus
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://online.securityfocus.com/archive/1/284254, http://www.iss.net/security_center/static/9678.php, http://www.securityfocus.com/bid/5316
CWE: CWE-79
CVE-2002-0588
PVote before 1.9 does not authenticate users for restricted operations, which allows remote attackers to add or delete polls by modifying parameters to (1) add.php or (2) del.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: pvote
References: http://online.securityfocus.com/archive/1/268231, http://orbit-net.net:8001/php/pvote/, http://www.iss.net/security_center/static/8877.php
CVE-2002-1665
Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long set_buddygrp field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: messenger
References: http://marc.info/?l=bugtraq&m=101439616623230&w=2, http://www.cert.org/advisories/CA-2002-16.html, http://www.kb.cert.org/vuls/id/755755
CVE-2002-0566
PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Authorization header without an authentication type.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: application_server_web_cache, application_server, oracle9i, oracle8i
References: http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf, http://www.cert.org/advisories/CA-2002-08.html, http://www.kb.cert.org/vuls/id/805915
CVE-2002-0180
Buffer overflow in Webalizer 2.01-06, when configured to use reverse DNS lookups, allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webalizer
References: http://marc.info/?l=bugtraq&m=101888467527673&w=2, http://www.kb.cert.org/vuls/id/582923, http://www.mrunix.net/webalizer/news.html
CVE-2002-0420
Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user sessions.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: puretls
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0056.html, http://www.iss.net/security_center/static/8386.php, http://www.securityfocus.com/bid/4237
CVE-2002-0082
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: apache-ssl, mod_ssl
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000465, http://ftp.support.compaq.com/patches/.new/html/SSRT0817.shtml, http://marc.info/?l=bugtraq&m=101518491916936&w=2
CVE-2002-0704
The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: linux_kernel
Related CWEs: CWE-212
Related CAPECs: CAPEC-168
References: http://marc.info/?l=bugtraq&m=102088521517722&w=2, http://online.securityfocus.com/advisories/4116, http://www.iss.net/security_center/static/9043.php
CWE: CWE-212
CVE-2002-1808
Cross-site scripting (XSS) vulnerability in Meunity Community System 1.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag when creating a topic.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: meunity_community_system
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0179.html, http://www.iss.net/security_center/static/10369.php, http://www.securityfocus.com/bid/5957
CVE-2002-1803
Cross-site scripting (XSS) vulnerability in PHP-Nuke 6.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: php-nuke
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0307.html, http://www.iss.net/security_center/static/10173.php, http://www.securityfocus.com/bid/5796
CVE-2002-2388
Buffer overflow in INweb POP3 mail server 2.01 allows remote attackers to cause a denial of service (crash) via a long HELO command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mail_server
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0070.html, http://www.iss.net/security_center/static/10601.php, http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0070.html
CWE: CWE-119
CVE-2002-0270
Opera, when configured with the "Determine action by MIME type" option disabled, interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent cross-site scripting attacks.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: opera_web_browser
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://marc.info/?l=bugtraq&m=101363764421623&w=2, http://marc.info/?l=bugtraq&m=101363764421623&w=2
CWE: CWE-79
CVE-2002-1539
Buffer overflow in MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service via long (1) DELE or (2) UIDL arguments.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mdaemon
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0382.html, http://www.iss.net/security_center/static/10488.php, http://www.securityfocus.com/bid/6053
CVE-2002-0509
Transparent Network Substrate (TNS) Listener in Oracle 9i 9.0.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a single malformed TCP packet to port 1521.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: oracle9i
References: http://online.securityfocus.com/archive/1/264697, http://www.iss.net/security_center/static/8657.php, http://www.securityfocus.com/bid/4391
CVE-2002-0561
The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: application_server_web_cache, application_server, oracle9i, oracle8i
References: http://marc.info/?l=bugtraq&m=101301813117562&w=2, http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf, http://www.cert.org/advisories/CA-2002-08.html
CVE-2002-1226
Unknown vulnerabilities in Heimdal before 0.5 with unknown impact, possibly in the (1) kadmind and (2) kdc servers, may allow remote or local attackers to gain root or other access, but not via buffer overflows (CVE-2002-1225).
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: heimdal
References: http://marc.info/?l=bugtraq&m=103341355708817&w=2, http://marc.info/?l=bugtraq&m=103462479621246&w=2, http://www.debian.org/security/2002/dsa-178
CVE-2002-0698
Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: exchange_server
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20759, http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ326322, http://www.iss.net/security_center/static/9658.php
CWE: CWE-120
CVE-2002-0376
Buffer overflow in Apple QuickTime 5.0 ActiveX component allows remote attackers to execute arbitrary code via a long pluginspage field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: quicktime
References: http://online.securityfocus.com/archive/1/293095, http://www.atstake.com/research/advisories/2002/a091002-1.txt, http://www.iss.net/security_center/static/10077.php
CVE-2002-1927
Aquonics File Manager 1.5 allows users with edit privileges to modify user accounts by editing the userlist.cgi file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: aquonics_file_manager
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0212.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/9930, http://archives.neohapsis.com/archives/bugtraq/2002-08/0212.html
CVE-2002-2198
Buffer overflow in ZMailer before 2.99.51_1 allows remote attackers to execute arbitrary code during HELO processing from an IPv6 address, possibly using an address that resolves to a long hostname.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: zmailer
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc, http://www.iss.net/security_center/static/10013.php, http://www.securityfocus.com/bid/5592
CVE-2002-1053
Cross-site scripting (XSS) vulnerability in W3C Jigsaw Proxy Server before 2.2.1 allows remote attackers to execute arbitrary script via a URL that contains a reference to a nonexistent host followed by the script, which is included in the resulting error message.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: jigsaw
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0190.html, http://www.iss.net/security_center/static/9914.php, http://www.osvdb.org/4015
CVE-2002-2408
Gordano Messaging Server (GMS) Mail 8 (a.k.a. NTMail) only filters email messages for the first recipient, which allows remote attackers to bypass JUCE filters by sending a message to more than one user on the GMS server.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ntmail
References: http://securitytracker.com/id?1005650, http://www.gordano.com/kb.htm?q=1709, http://www.iss.net/security_center/static/10657.php
CVE-2002-2404
Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP port 110).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: iispop
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://marc.info/?l=bugtraq&m=103729432602720&w=2, http://www.iss.net/security_center/static/10632.php, http://www.securityfocus.com/bid/6183
CWE: CWE-119
CVE-2002-1972
Unknown vulnerability in Parallel port powerSwitch (aka pp_powerSwitch) 0.1 does not properly enforce access controls, which allows local users to access arbitrary ports.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pp_powerswitch
References: http://freshmeat.net/releases/101529/, http://securitytracker.com/id?1005534, http://www.iss.net/security_center/static/10552.php
CVE-2002-0391
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: openbsd, freebsd, solaris, windows_2000, windows_nt
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-055.0.txt, ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-011.txt.asc, ftp://patches.sgi.com/support/free/security/advisories/20020801-01-A
CWE: CWE-190
CVE-2002-2432
Unspecified vulnerability in NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via a crafted username.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netware_ftp_server, netware
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1, http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE-2002-1739
Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mdaemon
Related CWEs: CWE-326
Related CAPECs: CAPEC-112, CAPEC-192, CAPEC-20
MITRE ATT&CK Techniques: T1110
References: http://online.securityfocus.com/archive/1/271374, http://www.securityfocus.com/bid/4686, https://exchange.xforce.ibmcloud.com/vulnerabilities/9025
CWE: CWE-326
MITRE ATT&CK techniques: T1110
CVE-2002-1000
Buffer overflow in AnalogX SimpleServer:Shout 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long request to TCP port 8001.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: simpleserver_shout
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0338.html, http://www.analogx.com/contents/download/network/ssshout.htm, http://www.iss.net/security_center/static/9427.php
CVE-2002-1688
The browser history feature in Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to execute arbitrary script as other users and steal authentication information via cookies by injecting JavaScript into the URL, which is executed when the user hits the Back button.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: internet_explorer
References: http://online.securityfocus.com/archive/1/267561, http://www.securityfocus.com/bid/4505, https://exchange.xforce.ibmcloud.com/vulnerabilities/8844
CVE-2002-0375
Cross-site scripting vulnerability in sgdynamo.exe for Sgdynamo allows remote attackers to execute arbitrary Javascript via a URL with the script in the HTNAME parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: sgdynamo
References: http://marc.info/?l=bugtraq&m=102107488402057&w=2, http://marc.info/?l=vuln-dev&m=101908986415768&w=2, http://www.osvdb.org/3458
CVE-2002-1010
Lotus Domino R4 allows remote attackers to bypass access restrictions for files in the web root via an HTTP request appended with a "?" character, which is treated as a wildcard character and bypasses the web handlers.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: domino_r4
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0001.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0001.html
CVE-2002-1046
Dynamic VPN Configuration Protocol service (DVCP) in Watchguard Firebox firmware 5.x.x allows remote attackers to cause a denial of service (crash) via a malformed packet containing tab characters to TCP port 4110.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: soho_firewall, firebox
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0012.html, http://www.iss.net/security_center/static/9509.php, http://www.securityfocus.com/bid/5186
CVE-2002-1507
Unreal Tournament 2003 (ut2003) clients and servers allow remote attackers to cause a denial of service via malformed messages containing a small number of characters to UDP ports 7778 or 10777.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: unreal_tournament_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0116.html, http://www.iss.net/security_center/static/10128.php, http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0116.html
CVE-2002-1590
The Web-Based Enterprise Management (WBEM) packages (1) SUNWwbdoc, (2) SUNWwbcou, (3) SUNWwbdev and (4) SUNWmgapp packages, when installed using Solaris 8 Update 1/01 or later, install files with world or group write permissions, which allows local users to gain root privileges or cause a denial of service.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
Related CWEs: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-48320-1, http://www.ciac.org/ciac/bulletins/n-010.shtml, http://www.securityfocus.com/bid/6061
CWE: CWE-264
CVE-2002-0961
Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other users, e.g. by deleting clients via dltclnt.php, possibly in a SQL injection attack.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cbms
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0043.html, http://www.iss.net/security_center/static/9295.php, http://www.securityfocus.com/bid/4957
CVE-2002-0732
Cross-site scripting vulnerability in MyGuestbook 1.0 allows remote attackers to execute arbitrary script or inject HTML via fields such as (1) user name or (2) comments.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: myguestbook
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0422.html, http://www.iss.net/security_center/static/8968.php, http://www.levcgi.com/programs.cgi?program=myguestbook&action=history
CVE-2002-1201
IBM AIX 4.3.3 and AIX 5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a flood of malformed TCP packets without any flags set, which prevents AIX from releasing the associated memory buffers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: aix
References: http://marc.info/?l=bugtraq&m=103418410408599&w=2, http://www-1.ibm.com/support/docview.wss?rs=0&q=IY31641&uid=isg1IY31641&loc=en_US&cs=utf-8&cc=us&lang=en, http://www.iss.net/security_center/static/10326.php
CVE-2002-1316
importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315).
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: iplanet_web_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html, http://marc.info/?l=bugtraq&m=103772308030269&w=2, http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1