DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-0676
SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning, and supplying Trojan Horse updates.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x
References: http://www.cunap.com/~hardingr/projects/osx/exploit.html, http://www.iss.net/security_center/static/9502.php, http://www.osvdb.org/5137
CVE-2002-0656
Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: http_server, corporate_time_outlook_connector, openssl, application_server, mac_os_x
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-033.0.txt, ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-033.1.txt, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:33.openssl.asc
CVE-2002-0832
Internet Explorer 5, 5.6, and 6 allows remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData (storeuserData) feature.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://marc.info/?l=bugtraq&m=102864890006745&w=2, http://marc.info/?l=bugtraq&m=102864890006745&w=2
CVE-2002-0121
PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: php
References: http://online.securityfocus.com/archive/1/250196, http://www.iss.net/security_center/static/7908.php, http://www.securityfocus.com/bid/3873
CVE-2002-0043
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sudo
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000451, http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:003
CVE-2002-0288
Directory traversal vulnerability in Phusion web server 1.0 allows remote attackers to read arbitrary files via a ... (triple dot dot) in the HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: phusion_webserver
References: http://marc.info/?l=bugtraq&m=101408906001958&w=2, http://www.securityfocus.com/bid/4117, http://marc.info/?l=bugtraq&m=101408906001958&w=2
CVE-2002-0380
Buffer overflow in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via an NFS packet.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tcpdump
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-025.0.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000491, http://marc.info/?l=bugtraq&m=102339541014226&w=2
CVE-2002-0630
The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via long or malformed ICMP packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: viewstation_sp_384, viewstation_mp, viewstation_v.35, viewstation_dcp, viewstation_fx_vs4000
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21089, http://www.ciac.org/ciac/bulletins/m-123.shtml, http://www.iss.net/security_center/static/9350.php
CVE-2002-0652
xfsmd for IRIX 6.5 through 6.5.16 allows remote attackers to execute arbitrary code via shell metacharacters that are not properly filtered from several calls to the popen() function, such as export_fs().
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I, ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I, http://marc.info/?l=bugtraq&m=102459162909825&w=2
CVE-2002-0049
Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: exchange_server
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: http://www.osvdb.org/2042, http://www.securityfocus.com/bid/4053, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-003
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2002-0357
Unknown vulnerability in rpc.passwd in the nfs.sw.nis subsystem of SGI IRIX 6.5.15 and earlier allows local users to gain root privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020601-01-P, http://www.ciac.org/ciac/bulletins/m-087.shtml, http://www.iss.net/security_center/static/9261.php
CVE-2002-0090
Buffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: solaris
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0041.html, http://online.securityfocus.com/archive/1/270149, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/44842
CVE-2002-1076
Buffer overflow in the Web Messaging daemon for Ipswitch IMail before 7.12 allows remote attackers to execute arbitrary code via a long HTTP GET request for HTTP/1.0.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: imail
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0326.html, http://archives.neohapsis.com/archives/bugtraq/2002-07/0363.html, http://archives.neohapsis.com/archives/bugtraq/2002-07/0368.html
CVE-2002-0245
Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a nonexistent file with a .pl (Perl) extension, which leaks the pathname in the error message, or (2) make any request that causes an HTTP 500 error, which leaks the server's version name in the HTTP error message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: domino
References: http://marc.info/?l=bugtraq&m=101310812804716&w=2, http://www-1.ibm.com/support/manager.wss?rs=1&rt=0&org=sims&doc=07B32060E4CC97E985256B64005AEB0F, http://www.iss.net/security_center/static/8160.php
CVE-2002-0628
The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: viewstation_sp_384, viewstation_mp, viewstation_v.35, viewstation_dcp, viewstation_fx_vs4000
Related CWEs: CWE-307
Related CAPECs: CAPEC-560, CAPEC-653, CAPEC-600
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21089, http://www.ciac.org/ciac/bulletins/m-123.shtml, http://www.iss.net/security_center/static/9349.php
CWE: CWE-307
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2002-1452
Buffer overflow in the search capability for MyWebServer 1.0.2 allows remote attackers to execute arbitrary code via a long searchTarget parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mywebserver
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0077.html, http://marc.info/?l=bugtraq&m=102935720109934&w=2, http://www.iss.net/security_center/static/9859.php
CVE-2002-1396
Heap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow attackers to cause a denial of service or execute arbitrary code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php
References: http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0003.html, http://bugs.php.net/bug.php?id=20927, http://marc.info/?l=bugtraq&m=104102689503192&w=2
CVE-2002-1595
Cisco SN 5420 Storage Router 1.1(5) and earlier allows attackers to read configuration files without authorization.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: sn_5420_storage_router_firmware
References: http://www.cisco.com/warp/public/707/SN-multiple-pub.shtml, http://www.kb.cert.org/vuls/id/833459, http://www.securityfocus.com/bid/3832
CVE-2002-2406
Buffer overflow in HTTP server in LiteServe 2.0, 2.0.1 and 2.0.2 allows remote attackers to cause a denial of service (hang) via a large number of percent characters (%) in an HTTP GET request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: liteserve
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0075.html, http://www.iss.net/security_center/static/10644.php, http://www.securityfocus.com/bid/6192
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-0004
Heap corruption vulnerability in the "at" program allows local users to execute arbitrary code via a malformed execution time, which causes at to free the same memory twice.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: debian_linux, suse_linux, netbsd, mandrake_linux, linux
References: http://marc.info/?l=bugtraq&m=101128661602088&w=2, http://marc.info/?l=bugtraq&m=101147632721031&w=2, http://online.securityfocus.com/advisories/3833
CVE-2002-2080
Floositek FTGate PRO 1.05 allows remote attackers to cause a denial of service (memory and CPU consumption) via a large number of RCPT TO: messages during an SMTP session.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ftgatepro
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0053.html, http://www.ftgate.com/knwldgbs/hotfix.htm, http://www.iss.net/security_center/static/8750.php
CVE-2002-0399
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: tar
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000538, http://marc.info/?l=bugtraq&m=103419290219680&w=2, http://secunia.com/advisories/19130
CVE-2002-0322
Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: messenger
References: http://marc.info/?l=bugtraq&m=101466489113920&w=2, http://marc.info/?l=bugtraq&m=101467298107635&w=2, http://www.securityfocus.com/bid/4173
CVE-2002-0485
Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: norton_antivirus
Related CWEs: CWE-178
References: http://marc.info/?l=bugtraq&m=101684260510079&w=2, http://marc.info/?l=vuln-dev&m=101681724810317&w=2, http://marc.info/?l=bugtraq&m=101684260510079&w=2
CWE: CWE-178
CVE-2002-0587
Buffer overflow in Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows remote attackers to cause a denial of service or execute arbitrary code via the Error or Notice parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aol_server
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0195.html, http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/aolserver/aolserver/nspd/log.c.diff?r1=1.4&r2=1.4.6.1, http://sourceforge.net/tracker/index.php?func=detail&aid=533141&group_id=3152&atid=303152
CVE-2002-0070
Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_nt, windows_98se, windows_98
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://marc.info/?l=bugtraq&m=101594127017290&w=2, http://www.iss.net/security_center/static/8384.php, http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0203&L=ntbugtraq&F=P&S=&P=2404
CWE: CWE-119
CVE-2002-1807
Cross-site scripting (XSS) vulnerability in phpWebSite 0.8.3 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpwebsite
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0307.html, http://www.iss.net/security_center/static/10173.php, http://www.securityfocus.com/bid/5802
CVE-2002-1087
The scripts (1) createdir.php, (2) removedir.php and (3) uploadfile.php for ezContents 1.41 and earlier do not check credentials, which allows remote attackers to create or delete directories and upload files via a direct HTTP POST request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: ezcontents
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0040.html, http://online.securityfocus.com/archive/1/284229, http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0040.html
CVE-2002-1534
Macromedia Flash Player allows remote attackers to read arbitrary files via XML script in a .swf file that is hosted on a remote SMB share.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: flash_player
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0083.html, http://www.iss.net/security_center/static/10297.php, http://www.securityfocus.com/bid/5904
CVE-2002-1514
gds_lock_mgr in Borland InterBase allows local users to overwrite files and gain privileges via a symlink attack on a "isc_init1.X" temporary file, as demonstrated by modifying the xinetdbd file.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: interbase
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0311.html, http://www.iss.net/security_center/static/10196.php, http://www.securityfocus.com/bid/5805
CVE-2002-0843
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: oracle8i, database_server, application_server, http_server
References: ftp://patches.sgi.com/support/free/security/advisories/20021105-01-I, http://archives.neohapsis.com/archives/bugtraq/2002-10/0229.html, http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html
CVE-2002-0508
wwwisis 3.45 and earlier allows remote attackers to execute arbitrary commands and read files via the parameters (1) prolog or (2) epilog.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: wwwisis
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0077.html, http://online.securityfocus.com/archive/1/264682, http://online.securityfocus.com/archive/1/265456
CVE-2002-1327
Buffer overflow in the Windows Shell function in Microsoft Windows XP allows remote attackers to execute arbitrary code via an .MP3 or .WMA audio file with a corrupt custom attribute, aka "Unchecked Buffer in Windows Shell Could Enable System Compromise."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_xp
References: http://marc.info/?l=bugtraq&m=104025849109384&w=2, http://www.cert.org/advisories/CA-2002-37.html, http://www.kb.cert.org/vuls/id/591890
CVE-2002-0163
Heap-based buffer overflow in Squid before 2.4 STABLE4, and Squid 2.5 and 2.6 until March 12, 2002 distributions, allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via compressed DNS responses.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: squid
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-017.1.txt, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:19.squid.asc, http://marc.info/?l=bugtraq&m=101716495023226&w=2
CVE-2002-0151
Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_nt, windows_xp
References: http://marc.info/?l=bugtraq&m=101793727306282&w=2, http://www.iss.net/security_center/static/8752.php, http://www.securityfocus.com/bid/4426
CVE-2002-2427
The security handler in GoAhead WebServer before 2.1.1 allows remote attackers to bypass authentication and obtain access to protected web content via "an extra slash in a URL," a different vulnerability than CVE-2002-1603.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: goahead_webserver
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#security-features-can-be-bypassed-by-adding-an-extra-slash-in-the-url-bug01518, http://www.kb.cert.org/vuls/id/124059, http://data.goahead.com/Software/Webserver/2.1.8/release.htm#security-features-can-be-bypassed-by-adding-an-extra-slash-in-the-url-bug01518
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2002-1160
The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: linux
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000693, http://marc.info/?l=bugtraq&m=104431622818954&w=2, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55760
CVE-2002-1738
Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send anonymous email.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: mdaemon
References: http://online.securityfocus.com/archive/1/271374, http://www.securityfocus.com/bid/4685, https://exchange.xforce.ibmcloud.com/vulnerabilities/9024
CVE-2002-1991
PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: oscommerce
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://online.securityfocus.com/archive/1/277312, http://www.iss.net/security_center/static/9369.php, http://www.oscommerce.com/about.php/news%2C72
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-1293
The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loader.CabCracker), which allows remote attackers to bypass the security checks that are performed by the load() method.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: java_virtual_machine
References: http://marc.info/?l=bugtraq&m=103682630823080&w=2, http://marc.info/?l=ntbugtraq&m=103684360031565&w=2, http://www.iss.net/security_center/static/10586.php
CVE-2002-2262
Unspecified vulnerability in xntpd of HP-UX 10.20 through 11.11 allows remote attackers to cause a denial of service (hang) via unknown attack vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: hp-ux
References: http://www.securityfocus.com/advisories/4764, http://www.securityfocus.com/bid/6356, https://exchange.xforce.ibmcloud.com/vulnerabilities/10836
CVE-2002-1557
Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service (reset to TCC, TCC+, TCCi or XTC) via a malformed HTTP request that does not contain a leading / (slash) character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: optical_networking_systems_software
References: http://www.cisco.com/warp/public/707/ons-multiple-vuln-pub.shtml, http://www.iss.net/security_center/static/10509.php, http://www.securityfocus.com/bid/6082
CVE-2002-1455
Multiple cross-site scripting (XSS) vulnerabilities in OmniHTTPd allow remote attackers to insert script or HTML into web pages via (1) test.php, (2) test.shtml, or (3) redir.exe.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: omnihttpd
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0263.html, http://archives.neohapsis.com/archives/bugtraq/2002-08/0264.html, http://archives.neohapsis.com/archives/bugtraq/2002-08/0266.html
CVE-2002-2099
Buffer overflow in the GNU DataDisplay Debugger (DDD) 3.3.1 allows local users to execute arbitrary code and possibly gain privileges via a long HOME environment variable.  NOTE: since DDD is not installed setuid or setgid, perhaps this issue should not be included in CVE.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: data_display_debugger
References: http://securitytracker.com/id?1003241, https://exchange.xforce.ibmcloud.com/vulnerabilities/7979, http://securitytracker.com/id?1003241
CVE-2002-2311
Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage.  NOTE: it was reported that the vendor has disputed the severity of this issue.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: opera_web_browser, internet_explorer
Related CWEs: CWE-264
References: http://online.securityfocus.com/archive/1/283866, http://online.securityfocus.com/archive/1/284068, http://www.iss.net/security_center/static/9653.php
CWE: CWE-264
CVE-2002-0298
ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) via certain HTTP GET requests containing (1) a %2e%2e (encoded dot-dot), (2) several /../ (dot dot) sequences, (3) a missing URI, or (4) several ../ in a URI that does not begin with a / (slash) character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: scriptease_webserver
References: http://marc.info/?l=bugtraq&m=101424439220931&w=2, http://www.securityfocus.com/bid/4145, http://marc.info/?l=bugtraq&m=101424439220931&w=2
CVE-2002-0966
Buffer overflow in 4D web server 6.7.3 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: 4d_webserver
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0208.html, http://www.iss.net/security_center/static/9374.php, http://www.securityfocus.com/bid/5045
CVE-2002-1511
The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand() function instead of srand(), which causes vncserver to generate weak cookies.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tightvnc, vnc
References: http://changelogs.credativ.org/debian/pool/main/v/vnc/vnc_3.3.6-3/changelog, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000640, http://security.gentoo.org/glsa/glsa-200302-15.xml
CVE-2002-0308
admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: admentor
References: http://marc.info/?l=bugtraq&m=101430885516675&w=2, http://www.securityfocus.com/bid/4152, https://exchange.xforce.ibmcloud.com/vulnerabilities/8245
CVE-2002-2425
Sun AnswerBook2 1.2 through 1.4.2 allows remote attackers to execute administrative scripts such as (1) AdminViewError and (2) AdminAddadmin via a direct request.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: solaris_answerbook2
Related CWEs: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0486.html, http://www.iss.net/security_center/static/9756.php, http://www.securityfocus.com/bid/5383
CWE: CWE-264
CVE-2002-1101
Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via a long user name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vpn_3002_hardware_client, vpn_3000_concentrator_series_software
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml, http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml
CVE-2002-1879
SQL injection vulnerability in LokwaBB 1.2.2 allows remote attackers to execute arbitrary SQL commands via the (1) member parameter to member.php or (2) loser parameter to misc.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: lokwabb
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0055.html, http://www.ifrance.com/kitetoua/tuto/LokwaBB.txt, http://www.iss.net/security_center/static/9318.php
CVE-2002-2093
The Video Control Panel on SGI O2/IRIX 6.5, when the Default Input is set to "Output Video", allows attackers to access a console session by running videoout then videoin.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020103-01-I, http://www.securityfocus.com/bid/3974, https://exchange.xforce.ibmcloud.com/vulnerabilities/8016
CVE-2002-1707
install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_dir parameter to reference a URL on a remote web server that contains the code.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: phpbb
References: http://online.securityfocus.com/archive/1/277318, http://www.securityfocus.com/bid/5038, https://exchange.xforce.ibmcloud.com/vulnerabilities/9370
CVE-2002-2195
Buffer overflow in the version update check for Winamp 2.80 and earlier allows remote attackers who can spoof www.winamp.com to execute arbitrary code via a long server response.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: winamp
References: http://online.securityfocus.com/archive/1/280786, http://www.iss.net/security_center/static/9488.php, http://www.securityfocus.com/bid/5170
CVE-2002-0926
Directory traversal vulnerability in Wolfram Research webMathematica 1.0.0 and 1.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the MSPStoreID parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webmathematica
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0174.html, http://support.wolfram.com/webmathematica/security/fileaccess.html, http://www.iss.net/security_center/static/9373.php
CVE-2002-0234
NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trusted network to cause a denial of service (resource exhaustion) via a port scan to an external network, which consumes all available connections.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netscreen_screenos
References: http://marc.info/?l=bugtraq&m=101258281818524&w=2, http://marc.info/?l=bugtraq&m=101258887105690&w=2, http://online.securityfocus.com/archive/1/254268
CVE-2002-1296
Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://marc.info/?l=bugtraq&m=103842619803173&w=2, http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doc=fsalert/49131, http://www.iss.net/security_center/static/10717.php
CVE-2002-2238
Directory traversal vulnerability in the Kunani ODBC FTP Server 1.0.10 allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in a GET request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: kunani_odbc_ftp_server
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0088.html, http://www.securityfocus.com/bid/6355, https://exchange.xforce.ibmcloud.com/vulnerabilities/10819
CWE: CWE-22
CVE-2002-0289
Buffer overflow in Phusion web server 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long HTTP request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: phusion_webserver
References: http://marc.info/?l=bugtraq&m=101408906001958&w=2, http://www.securityfocus.com/bid/4118, http://www.securityfocus.com/bid/4119
CVE-2002-0651
Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bind
References: ftp://ftp.NetBSD.ORG/pub/NetBSD/security/advisories/NetBSD-SA2002-006.txt.asc, ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.39, ftp://ftp.caldera.com/pub/updates/UnixWare/CSSA-2002-SCO.37
CVE-2002-2057
TeeKai Forum 1.2 uses weak encryption of web usage statistics in data/member_log.txt, which is stored under the web document root with insufficient access control, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: teekai_forum
References: http://marc.info/?l=vuln-dev&m=102313697923798&w=2, http://www.ifrance.com/kitetoua/tuto/Teekai.txt, http://www.iss.net/security_center/static/9286.php
CVE-2002-0736
Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: backoffice
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html, http://support.microsoft.com/support/kb/articles/q316/8/38.asp, http://www.iss.net/security_center/static/8862.php
CVE-2002-0094
config_converters.py in BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bscw
References: http://bscw.gmd.de/WhatsNew.html, http://www.iss.net/security_center/static/7774.php, http://www.securityfocus.com/archive/1/248000
CVE-2002-0434
Marcus S. Xenakis directory.php script allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: directory.php
References: http://www.iss.net/security_center/static/8440.php, http://www.securityfocus.com/archive/1/261512, http://www.securityfocus.com/bid/4278
CVE-2002-0446
categorie.php3 in Black Tie Project (BTP) 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an invalid category ID (cid) parameter, which leaks the pathname in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: black_tie_project
References: http://www.iss.net/security_center/static/8439.php, http://www.securityfocus.com/archive/1/261681, http://www.securityfocus.com/bid/4275
CVE-2002-0940
domesticinstall.exe for nCipher MSCAPI CSP 5.50 and 5.54 does not use Operator Card Set protected keys when the user requests them but does not generate the Operator Card Set, which results in a lower protection level than specified by the user (module protection only).
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mscapi_csp
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0103.html, http://online.securityfocus.com/archive/1/277241, http://www.securityfocus.com/bid/4729
CVE-2002-2421
acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: acweb
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0304.html, http://www.iss.net/security_center/static/10190.php, http://archives.neohapsis.com/archives/bugtraq/2002-09/0304.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-2275
Fortres 101 4.1 allows local users to bypass Fortres by pressing the Windows and "F" key together for 30 seconds, which opens multiple windows and eventually causes explorer.exe to crash, which then opens an unrestricted explorer.exe.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: fortres
References: http://archives.neohapsis.com/archives/ntbugtraq/2002-q4/0093.html, http://securitytracker.com/id?1005766, http://www.securityfocus.com/bid/6332
CVE-2002-1664
Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensitive information.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: messenger
References: http://marc.info/?l=bugtraq&m=101439616623230&w=2, http://www.cert.org/advisories/CA-2002-16.html, http://www.kb.cert.org/vuls/id/393195
CVE-2002-1580
Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that facilitates a buffer overflow attack, a different vulnerability than CVE-2002-1347.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cyrus_imap_server
References: http://asg.web.cmu.edu/cyrus/download/imapd/changes.html, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000557, http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557
CVE-2002-0948
Scripts For Educators MakeBook 2.2 CGI program allows remote attackers to execute script as other visitors, or execute server-side includes (SSI) as the web server, via the (1) Name or (2) Email parameters, which are not properly filtered.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: makebook
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0094.html, http://cert.uni-stuttgart.de/archive/bugtraq/2002/06/msg00135.html, http://www.iss.net/security_center/static/9356.php
CVE-2002-2428
webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP POST request that contains a Content-Length header but no body data.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: goahead_webserver
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-webs-c, http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-webs-c
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-0548
Anthill allows remote attackers to bypass authentication and file bug reports by directly accessing the postbug.php program instead of enterbug.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: anthill
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0089.html, http://www.iss.net/security_center/static/8771.php, http://www.securityfocus.com/bid/4443
CVE-2002-2251
Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code via a long argument.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: lib_cgi
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0330.html, http://www.securityfocus.com/bid/6264, https://exchange.xforce.ibmcloud.com/vulnerabilities/10715
CWE: CWE-119
CVE-2002-0937
The Java Server Pages (JSP) engine in JRun allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: jrun
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0095.html, http://www.iss.net/security_center/static/9339.php, http://www.securityfocus.com/bid/4997
CVE-2002-0371
Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: proxy_server, isa_server, gopher, internet_explorer
References: http://marc.info/?l=bugtraq&m=102320516707940&w=2, http://marc.info/?l=bugtraq&m=102397955217618&w=2, http://online.securityfocus.com/archive/1/276848
CVE-2002-1869
Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.
CVSS v3.1 Score: 3.3 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: eventsave, eventsave\+
Related CWEs: CWE-667
Related CAPECs: CAPEC-25, CAPEC-27, CAPEC-26
MITRE ATT&CK Techniques: T1499.004
MITRE ATT&CK Tactics: T1499
References: http://securitytracker.com/id?1005517, http://www.heysoft.de/nt/eventlog/hsb01e.htm, http://www.iss.net/security_center/static/10535.php
CWE: CWE-667
MITRE ATT&CK techniques: T1499.004
MITRE ATT&CK tactics: T1499
CVE-2002-1421
SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: fudforum
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html, http://online.securityfocus.com/archive/1/288042, http://www.iss.net/security_center/static/9912.php
CVE-2002-0413
Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: rebb
References: http://online.securityfocus.com/archive/1/259464, http://www.iss.net/security_center/static/8353.php, http://www.securityfocus.com/bid/4220
CVE-2002-0784
Directory traversal vulnerability in Lysias Lidik web server 0.7b allows remote attackers to list directories via an HTTP request with a ... (modified dot dot).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: lidik_webserver
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0039.html, http://www.iss.net/security_center/static/9028.php, http://www.lysias.de/send/news/index.php?page=3
CVE-2002-1458
Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to insert arbitrary script or HTML via message fields including (1) From, (2) E-Mail, (3) Subject and (4) Body.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: l-forum
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0115.html, http://sourceforge.net/tracker/download.php?group_id=53716&atid=471343&file_id=26687&aid=579278, http://www.iss.net/security_center/static/9838.php
CVE-2002-2039
/bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: rtos
References: http://marc.info/?l=bugtraq&m=102312549511726&w=2, http://www.iss.net/security_center/static/9256.php, http://www.securityfocus.com/bid/4914
CVE-2002-1579
SAP GUI (Sapgui) 4.6D allows remote attackers to cause a denial of service (crash) via a connection to a high-numbered port, which generates an "unknown connection data" error.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sapgui
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0334.html, http://www.securityfocus.com/bid/3972, https://exchange.xforce.ibmcloud.com/vulnerabilities/8007
CVE-2002-2314
Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, which causes the host/path check to fail.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mozilla
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://bugzilla.mozilla.org/show_bug.cgi?id=152725, http://cert.uni-stuttgart.de/archive/bugtraq/2002/09/msg00230.html, http://seclists.org/bugtraq/2002/Jul/0260.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-0720
A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_2000_terminal_services
References: http://www.iss.net/security_center/static/9856.php, http://www.securityfocus.com/bid/5480, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-042
CVE-2002-2385
Buffer overflow in hotfoon4.exe in Hotfoon 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL containing a long voice phone number.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hotfoon
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0115.html, http://www.iss.net/security_center/static/10593.php, http://www.securityfocus.com/bid/6156
CWE: CWE-119
CVE-2002-0892
The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct request to com.newatlanta.servletexec.JSP10Servlet without a filename, which leaks the pathname in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: servletexec_isapi
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0077.html, http://online.securityfocus.com/archive/1/273615, http://www.iss.net/security_center/static/9139.php
CVE-2002-0260
Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, which is not properly handled by the logging utility.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: miniportal
References: http://marc.info/?l=bugtraq&m=101329397901071&w=2, http://www.instantservers.com/releases.html, http://www.iss.net/security_center/static/8172.php
CVE-2002-1925
Tiny Personal Firewall 3.0 through 3.0.6 allows remote attackers to cause a denial of service (crash) by via SYN, UDP, ICMP and TCP portscans when the administrator selects the Log tab of the Personal Firewall Agent module.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tiny_personal_firewall
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/08/msg00298.html, http://www.iss.net/security_center/static/9918.php, http://www.securityfocus.com/bid/5525
CVE-2002-0822
Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly excecute arbitrary code via the (1) SOCKS, (2) RSVP, (3) AFS, or (4) LMP dissectors, which can be caused to core dump.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ethereal
References: http://www.ethereal.com/appnotes/enpa-sa-00005.html, http://www.securityfocus.com/bid/5167, http://www.ethereal.com/appnotes/enpa-sa-00005.html