DuyTa/cve-kgrag-db huggingface dataset:
CVE-2002-1982
Directory traversal vulnerability in the list_directory function in Icecast 1.3.12 allows remote attackers to determine if a directory exists via a .. (dot dot) in the GET request, which returns different error messages depending on whether the directory exists or not.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: icecast
References: http://www.iss.net/security_center/static/9530.php, http://www.securityfocus.com/archive/82/281274, http://www.securityfocus.com/bid/5189
CVE-2002-2096
Buffer overflow in Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: netware
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0001.html, http://archives.neohapsis.com/archives/bugtraq/2002-04/0088.html, http://support.novell.com/servlet/tidfinder/2962026
CVE-2002-0786
iCon administrative web server for Critical Path inJoin Directory Server 4.0 allows authenticated inJoin administrators to read arbitrary files by specifying the target file in the LOG parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: injoin_directory_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0068.html, http://www.iss.net/security_center/static/9054.php, http://www.securityfocus.com/bid/4718
CVE-2002-0615
The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well known location on the local file system, allowing attackers to execute HTML scripts in the Local Computer zone, aka "Media Playback Script Invocation".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: excel, office
References: http://www.iss.net/security_center/static/9422.php, http://www.securityfocus.com/bid/5110, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-032
CVE-2002-2426
Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: presentation_server, access_essentials, metaframe_presentation_server
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://packetstormsecurity.org/0210-exploits/hackingcitrix.txt, http://secunia.com/advisories/27633, http://support.citrix.com/article/CTX115245
CWE: CWE-352
CVE-2002-2035
SQL injection vulnerability in RealityScape MyLogin 2000 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password in the login form.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mylogin_2000
References: http://www.iss.net/security_center/static/9016.php, http://www.securiteam.com/windowsntfocus/5CP041P75S.html, http://www.iss.net/security_center/static/9016.php
CVE-2002-1386
Buffer overflow in traceroute-nanog (aka traceroute-ng) may allow local users to execute arbitrary code via a long hostname argument.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tracesroute
References: http://marc.info/?l=bugtraq&m=103849968732634&w=2, http://www.debian.org/security/2003/dsa-254, http://www.iss.net/security_center/static/10608.php
CVE-2002-0284
Winamp 2.78 and 2.77, when opening a wma file that requires a license, sends the full path of the Temporary Internet Files directory to the web page that is processing the license, which could allow malicious web servers to obtain the pathname.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Affected Products: winamp
References: http://marc.info/?l=bugtraq&m=101408781031527&w=2, http://marc.info/?l=bugtraq&m=101408781031527&w=2
CVE-2002-1891
Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ircit
References: http://online.securityfocus.com/archive/1/276537, http://www.iss.net/security_center/static/9340.php, http://www.securityfocus.com/bid/4998
CVE-2002-2380
NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: netdsl, network_firmware
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/10/msg00416.html, http://www.iss.net/security_center/static/10498.php, http://www.securityfocus.com/bid/6064
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-0087
bindsock in Lotus Domino 5.07 on Solaris allows local users to create arbitrary files via a symlink attack on temporary files.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: domino
References: http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg21095671, http://www.esecurityonline.com/advisories/eSO4125.asp, http://www.securityfocus.com/bid/4318
CVE-2002-1180
A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_information_services
References: http://www.ciac.org/ciac/bulletins/n-011.shtml, http://www.iss.net/security_center/static/10504.php, http://www.securityfocus.com/bid/6068
CVE-2002-0700
Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers to execute code in the Local System context by authenticating to a web page that calls the function, aka "Unchecked Buffer in MDAC Function Could Enable SQL Server Compromise."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: content_management_server
References: http://www.iss.net/security_center/static/9783.php, http://www.osvdb.org/4862, http://www.securityfocus.com/bid/5420
CVE-2002-0202
PaintBBS 1.2 installs certain files and directories with insecure permissions, which allows local users to (1) obtain the encrypted server password via the world-readable oekakibbs.conf file, or (2) modify the server configuration via the world-writeable /oekaki/ folder.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: paintbbs
References: http://online.securityfocus.com/archive/1/251985, http://www.iss.net/security_center/static/7982.php, http://www.securityfocus.com/bid/3948
CVE-2002-0774
Hosting Controller creates a default user AdvWebadmin with a default password, which could allow remote attackers to gain privileges if the password is not changed.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: hosting_controller
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0168.html, http://www.iss.net/security_center/static/9131.php, http://www.securityfocus.com/bid/4779
CVE-2002-0754
Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: heimdal, freebsd
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:07.k5su.asc, http://www.iss.net/security_center/static/7956.php, http://www.securityfocus.com/bid/3919
CVE-2002-1427
The print_html_to_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: easy_homepage_creator, advanced_easy_homepage_creator
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0350.html, http://www.iss.net/security_center/static/9696.php, http://www.securityfocus.com/bid/5340
CVE-2002-0025
Internet Explorer 5.01, 5.5 and 6.0 does not properly handle the Content-Type HTML header field, which allows remote attackers to modify which application is used to process a document.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: internet_explorer
References: http://online.securityfocus.com/archive/1/255767, http://www.securityfocus.com/bid/4085, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-005
CVE-2002-0128
cgitest.exe in Sambar Server 5.1 before Beta 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long argument.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sambar_server
References: http://www.der-keiler.de/Mailing-Lists/securityfocus/bugtraq/2002-02/0083.html, http://www.iss.net/security_center/static/7894.php, http://www.sambar.com/security.htm
CVE-2002-0283
Windows XP with port 445 open allows remote attackers to cause a denial of service (CPU consumption) via a flood of TCP SYN packets containing possibly malformed data.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_xp
References: http://marc.info/?l=bugtraq&m=101408718030099&w=2, http://marc.info/?l=bugtraq&m=101408718030099&w=2
CVE-2002-0673
The enrollment process for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to the phone to log out the current user and re-register the phone using MyPingtel Sign-In to gain remote access and perform unauthorized actions.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xpressa
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt, http://www.iss.net/security_center/static/9568.php, http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE-2002-0995
login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert," which adds the provided username to the adminUsers table.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpauction
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0014.html, http://www.iss.net/security_center/static/9462.php, http://www.phpauction.org/viewnew.php?id=5
CVE-2002-1730
ASPjar Guestbook 1.00 allows remote attackers to delete arbitrary messages accessing the delete.asp administrative script with certain cookie values set to "true".
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: aspjar_guestbook
References: http://online.securityfocus.com/archive/82/270970, http://www.ifrance.com/kitetoua/tuto/5holes4.txt, http://www.securityfocus.com/bid/4671
CVE-2002-1476
Buffer overflow in setlocale in libc on NetBSD 1.4.x through 1.6, and possibly other operating systems, when called with the LC_ALL category, allows local attackers to execute arbitrary code via a user-controlled locale string that has more than 6 elements, which exceeds the boundaries of the new_categories category array, as exploitable through programs such as xterm and zsh.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: netbsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-012.txt.asc, http://www.iss.net/security_center/static/10159.php, http://www.osvdb.org/7565
CVE-2002-0886
Cisco DSL CPE devices running CBOS 2.4.4 and earlier allows remote attackers to cause a denial of service (hang or memory consumption) via (1) a large packet to the DHCP port, (2) a large packet to the Telnet port, or (3) a flood of large packets to the CPE, which causes the TCP/IP stack to consume large amounts of memory.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: cbos
References: http://www.cisco.com/warp/public/707/CBOS-DoS.shtml, http://www.iss.net/security_center/static/9151.php, http://www.iss.net/security_center/static/9153.php
CVE-2002-2410
openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: open_webmail
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0278.html, http://www.iss.net/security_center/static/10684.php, http://www.securityfocus.com/bid/6232
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2002-0222
Etype Eserv 2.97 allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eserv
References: http://online.securityfocus.com/archive/1/252944, http://www.iss.net/security_center/static/8021.php, http://www.securityfocus.com/bid/3986
CVE-2002-0866
Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL terminated by a null string, aka "DLL Execution via JDBC Classes."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: virtual_machine
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0271.html, http://www.iss.net/security_center/static/10133.php, http://www.kb.cert.org/vuls/id/307306
CVE-2002-2399
Directory traversal vulnerability in viewAttachment.cgi in W3Mail 1.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: w3mail
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0150.html, http://www.iss.net/security_center/static/10612.php, http://www.securityfocus.com/bid/6170
CWE: CWE-22
CVE-2002-0840
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: http_server, oracle8i, database_server, application_server, oracle9i
References: ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I, http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html, http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0003.html
CVE-2002-1419
The upgrade of IRIX on Origin 3000 to 6.5.13 through 6.5.16 changes the MAC address of the system, which could modify intended access restrictions that are based on a MAC address.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: irix
References: ftp://patches.sgi.com/support/free/security/advisories/20020805-01-I, http://www.iss.net/security_center/static/9868.php, http://www.securityfocus.com/bid/5467
CVE-2002-1018
The library feature for Adobe Content Server 3.0 does not verify if a customer has already checked out an eBook, which allows remote attackers to cause a denial of service (resource exhaustion) by checking out the same book multiple times.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: adobe_content_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0020.html, http://marc.info/?l=vuln-dev&m=102649215618643&w=2, http://marc.info/?l=vuln-dev&m=102650064028760&w=2
CVE-2002-1340
The "ConnectionFile" property in the DataSourceControl component in Office Web Components (OWC) 10 allows remote attackers to determine the existence of local files by detecting an exception.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: office_web_components
References: http://marc.info/?l=bugtraq&m=101830175621193&w=2, http://security.greymagic.com/adv/gm008-ie/, http://marc.info/?l=bugtraq&m=101830175621193&w=2
CVE-2002-0574
Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that trigger a bug in ip_output() in which the reference count for a routing table entry is not decremented, which prevents the entry from being removed.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: freebsd
Related CWEs: CWE-401
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:21.tcpip.asc, http://www.iss.net/security_center/static/8893.php, http://www.osvdb.org/5232
CWE: CWE-401
CVE-2002-2083
The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help feature, which can be launched from the Novell Netware login screen.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: netware
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0151.html, http://archives.neohapsis.com/archives/bugtraq/2002-01/0151.html
CVE-2002-0650
The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a "ping" style packet to the Resolution Service (UDP port 1434) with a spoofed IP address of another SQL Server system, which causes the two servers to exchange packets in an infinite loop.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sql_server
References: http://marc.info/?l=bugtraq&m=102760196931518&w=2, http://marc.info/?l=ntbugtraq&m=102760479902411&w=2, http://www.iss.net/security_center/static/9662.php
CVE-2002-0899
Falcon web server 2.0.0.1021 and earlier allows remote attackers to bypass access restrictions for protected files via a URL whose directory portion ends in a . (dot).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: falcon_web_server
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0084.html, http://online.securityfocus.com/archive/1/274205, http://www.iss.net/security_center/static/9179.php
CVE-2002-2368
Multiple buffer overflows in NEC SOCKS5 1.0 r11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long username to (1) the GetString function in proxy.c for the SOCKS5 module or (2) the HandleS4Connection function in proxy.c for the SOCKS4 module.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: socks_5
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0033.html, http://www.iss.net/security_center/static/9485.php, http://www.securityfocus.com/bid/5145
CWE: CWE-119
CVE-2002-1597
Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (halt) via a fragmented packet to the Gigabit interface.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sn_5420_storage_router_firmware
References: http://www.cisco.com/warp/public/707/SN-multiple-pub.shtml, http://www.kb.cert.org/vuls/id/855195, http://www.securityfocus.com/bid/3833
CVE-2002-0315
fasttrack p2p, as used in (1) KaZaA, (2) grokster, and (3) morpheus allows remote attackers to spoof other users by modifying the username and network information in the message header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: morpheus, kazaa, grokster
References: http://marc.info/?l=bugtraq&m=101441689224760&w=2, http://www.iss.net/security_center/static/8272.php, http://www.securityfocus.com/bid/4121
CVE-2002-0112
Etype Eserv 2.97 allows remote attackers to view password protected files via /./ in the URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: eserv
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0010.html, http://marc.info/?l=bugtraq&m=101062172226812&w=2, http://marc.info/?l=ntbugtraq&m=101062823505486&w=2
CVE-2002-1349
Buffer overflow in pop3trap.exe for PC-cillin 2000, 2002, and 2003 allows local users to execute arbitrary code via a long input string to TCP port 110 (POP3).
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pc-cillin, officescan
References: http://kb.trendmicro.com/solutions/solutionDetail.asp?solutionId=12982, http://marc.info/?l=bugtraq&m=103953822705917&w=2, http://www.kb.cert.org/vuls/id/157961
CVE-2002-1700
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: windows_2000, coldfusion, internet_information_services
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://online.securityfocus.com/archive/1/277487, http://www.macromedia.com/v1/Handlers/index.cfm?ID=23047, http://www.securityfocus.com/bid/5011
CWE: CWE-79
CVE-2002-0624
Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication, aka "Unchecked Buffer in Password Encryption Procedure."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sql_server, msde
References: http://www.cert.org/advisories/CA-2002-22.html, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A291
CVE-2002-2166
Cross-site scripting (XSS) vulnerability in FuseTalk 2.0 and 3.0 allows remote attackers to insert arbitrary HTML and web script.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: fusetalk
References: http://www.iss.net/security_center/static/9637.php, http://www.securityfocus.com/bid/5236, http://www.iss.net/security_center/static/9637.php
CVE-2002-1753
csNewsPro.cgi in CGIScript.net csNews Professional (csNewsPro) allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: csnews_professional
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/04/msg00106.html, http://www.securityfocus.com/bid/4451, https://exchange.xforce.ibmcloud.com/vulnerabilities/8636
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-1510
xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: x11r6
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000533, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55602, http://wuarchive.wustl.edu/mirrors/NetBSD/NetBSD-current/xsrc/xfree/xc/programs/Xserver/hw/xfree86/CHANGELOG
CVE-2002-0725
NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000, windows_nt
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://www.atstake.com/research/advisories/2000/a081602-1.txt, http://www.iss.net/security_center/static/9869.php, http://www.securityfocus.com/bid/5484
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2002-0341
GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server via an HTTP request with an invalid HTMLVER parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: groupwise
References: http://marc.info/?l=bugtraq&m=101494830315071&w=2, http://marc.info/?l=bugtraq&m=101494830315071&w=2
CVE-2002-0616
The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by attaching an inline macro to an object within an Excel workbook, aka the "Excel Inline Macros Vulnerability."
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: excel, office
References: http://www.iss.net/security_center/static/9397.php, http://www.securityfocus.com/bid/5063, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-031
CVE-2002-0254
ICQ 2001b Build 3659 allows remote attackers to cause a denial of service (crash) via a malformed picture that contains large height and width values, which causes the crash when viewed in Userdetails.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: icq
References: http://marc.info/?l=bugtraq&m=101320492009565&w=2, http://marc.info/?l=bugtraq&m=101320492009565&w=2
CVE-2002-0898
Opera 6.0.1 and 6.0.2 allows a remote web site to upload arbitrary files from the client system, without prompting the client, via an input type=file tag whose value contains a newline.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: opera_web_browser
References: http://marc.info/?l=ntbugtraq&m=102256058220402&w=2, http://online.securityfocus.com/archive/1/274202, http://www.iss.net/security_center/static/9188.php
CVE-2002-2319
Static code injection vulnerability in users.php in MySimpleNews allows remote attackers to inject arbitrary PHP code and HTML via the (1) LOGIN, (2) DATA, and (3) MESS parameters, which are inserted into news.php3.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mysimplenews
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0027.html, http://www.iss.net/security_center/static/10296.php, http://www.securityfocus.com/bid/5865
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2002-1152
Konqueror in KDE 3.0 through 3.0.2 does not properly detect the "secure" flag in an HTTP cookie, which could cause Konqueror to send the cookie across an unencrypted channel, which could allow remote attackers to steal the cookie via sniffing.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: kde
References: http://marc.info/?l=bugtraq&m=103175827225044&w=2, http://www.iss.net/security_center/static/10083.php, http://www.kde.org/info/security/advisory-20020908-1.txt
CVE-2002-0847
tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tinyproxy
References: http://sourceforge.net/project/shownotes.php?release_id=88790, http://www.iss.net/security_center/static/9079.php, http://www.securityfocus.com/bid/4731
CVE-2002-1735
Buffer overflow in dlogin 1.0a could allow local users to gain privileges via unknown attack vectors.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: dlogin
References: http://securitytracker.com/id?1003493, http://www.securityfocus.com/bid/4043, https://exchange.xforce.ibmcloud.com/vulnerabilities/8186
CVE-2002-1574
Buffer overflow in the ixj telephony card driver in Linux before 2.4.20 has unknown impact and attack vectors.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: linux_kernel
References: http://www.ciac.org/ciac/bulletins/n-096.shtml, http://www.redhat.com/support/errata/RHSA-2002-205.html, http://www.redhat.com/support/errata/RHSA-2002-206.html
CVE-2002-2313
Eudora email client 5.1.1, with "use Microsoft viewer" enabled, allows remote attackers to execute arbitrary programs via an HTML email message containing a META refresh tag that references an embedded .mhtml file with ActiveX controls that execute a second embedded program, which is processed by Internet Explorer.
CVSS v2.0 Score: 8.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:N
Affected Products: eudora
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000644.html, http://www.iss.net/security_center/static/9654.php, http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000644.html
CVE-2002-0791
Novell Netware FTP server NWFTPD before 5.02r allows remote attackers to cause a denial of service (CPU consumption) via a connection to the server followed by a carriage return, and possibly other invalid commands with improper syntax or length.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netware
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0059.html, http://online.securityfocus.com/archive/1/271589, http://support.novell.com/cgi-bin/search/searchtid.cgi?/2962252.htm
CVE-2002-2237
tftp32 TFTP server 2.21 and earlier allows remote attackers to cause a denial of service via a GET request with a DOS device name such as com1 or aux.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tftp_server
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0084.html, http://www.kb.cert.org/vuls/id/632633, https://exchange.xforce.ibmcloud.com/vulnerabilities/10817
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-2038
Next Generation POSIX Threading (NGPT) 1.9.0 uses a filesystem-based shared memory entry, which allows local users to cause a denial of service or in threaded processes or spoof files via unknown methods.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:P
Affected Products: next_generation_posix_threading
References: http://www.iss.net/security_center/static/9255.php, http://www.securityfocus.com/bid/4913, http://www.iss.net/security_center/static/9255.php
CVE-2002-0516
SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: squirrelmail
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0350.html, http://archives.neohapsis.com/archives/bugtraq/2002-03/0386.html, http://www.iss.net/security_center/static/8671.php
CVE-2002-0820
FreeBSD kernel 4.6 and earlier closes the file descriptors 0, 1, and 2 after they have already been assigned to /dev/null when the descriptors reference procfs or linprocfs, which could allow local users to reuse the file descriptors in a setuid or setgid program to modify critical data and gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: freebsd
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc, http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0047.html, http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&frame=right&th=d429cd2ef1d3a2b7&seekm=ai6c0q%242289%241%40FreeBSD.csie.NCTU.edu.tw#link16
CVE-2002-0954
The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, which make it easier for an attacker to decrypt the passwords using brute force techniques.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pix_firewall
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0121.html, http://marc.info/?l=bugtraq&m=102651159507659&w=2, http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0121.html
CVE-2002-0675
Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not require administrative privileges to perform a firmware upgrade, which allows unauthorized users to upgrade the phone.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xpressa
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt, http://www.iss.net/security_center/static/9570.php, http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE-2002-2393
Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights, which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: serv-u_file_server
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0109.html, http://www.iss.net/security_center/static/10573.php, http://www.securityfocus.com/bid/6112
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2002-2134
haut.php in PEEL 1.0b allows remote attackers to execute arbitrary PHP code by modifying the dirroot parameter to reference a URL on a remote web server that contains the code in a lang.php file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: peel
References: http://secunia.com/advisories/7797, http://www.iss.net/security_center/static/10960.php, http://www.securityfocus.com/archive/1/304779
CVE-2002-0620
Buffer overflow in the Profile Service of Microsoft Commerce Server 2000 allows remote attackers to cause the server to fail or run arbitrary code in the LocalSystem security context via an input field using an affected API.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: commerce_server
References: http://www.securityfocus.com/bid/4853, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-033, http://www.securityfocus.com/bid/4853
CVE-2002-2395
InterScan VirusWall 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 gzip content encoding.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: interscan_viruswall
Related CWEs: CWE-264
References: http://www.iss.net/security_center/static/10107.php, http://www.securityfocus.com/archive/1/291538, http://www.securityfocus.com/bid/5701
CWE: CWE-264
CVE-2002-2280
syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which can cause incorrect information to be sent to the syslog server.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: openbsd
Related CWEs: CWE-16
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0272.html, http://www.securityfocus.com/bid/6219, https://exchange.xforce.ibmcloud.com/vulnerabilities/10702
CWE: CWE-16
CVE-2002-0154
Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sql_server
References: http://marc.info/?l=bugtraq&m=101535353331625&w=2, http://www.cert.org/advisories/CA-2002-22.html, http://www.kb.cert.org/vuls/id/627275
CVE-2002-1083
Directory traversal vulnerabilities in ezContents 1.41 and earlier allow remote attackers to cause ezContents to (1) create directories using the Maintain Images:Add New:Create Subdirectory item, or (2) list directories using the Maintain Images file listing, via .. (dot dot) sequences.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: ezcontents
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0040.html, http://online.securityfocus.com/archive/1/284229, http://www.iss.net/security_center/static/9710.php
CVE-2002-0983
IRC client irssi in irssi-text before 0.8.4 allows remote attackers to cause a denial of service (crash) via an IRC channel that has a long topic followed by a certain string, possibly triggering a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: irssi
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A05.asc, http://www.debian.org/security/2002/dsa-157, http://www.securityfocus.com/bid/5055
CVE-2002-1445
Cross-site scripting (XSS) vulnerability in CERN Proxy Server allows remote attackers to execute script as other users via a link to a non-existent page whose name contains the script, which is inserted into the resulting error page.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: cern_httpd
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0097.html, http://www.iss.net/security_center/static/9834.php, http://www.securityfocus.com/bid/5447
CVE-2002-1852
Cross-site scripting (XSS) vulnerability in Monkey 0.5.0 allows remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) a parameter to test2.pl.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: monkey
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0344.html, http://www.iss.net/security_center/static/10226.php, http://www.iss.net/security_center/static/10229.php
CWE: CWE-79
CVE-2002-1587
The libthread library (libthread.so.1) for Solaris 2.5.1 through 8 allows local users to cause a denial of service (hang) of an application that uses libthread by causing the application to wait for a certain mutex.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sunos, solaris
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-46867-1, http://www.securityfocus.com/bid/6318, https://exchange.xforce.ibmcloud.com/vulnerabilities/11146
CVE-2002-0590
Cross-site scripting (CSS) vulnerability in IcrediBB 1.1 Beta allows remote attackers to execute arbitrary script and steal cookies as other IcrediBB users via the (1) title or (2) body of posts.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: icredibb
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0263.html, http://www.iss.net/security_center/static/8879.php, http://www.securityfocus.com/bid/4548
CVE-2002-0913
Format string vulnerability in log_doit function of Slurp NNTP client 1.1.0 allows a malicious news server to execute arbitrary code on the client via format strings in a server response.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: slurp
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0014.html, http://marc.info/?l=vuln-dev&m=102323341407280&w=2, http://www.iss.net/security_center/static/9270.php
CVE-2002-2153
Format string vulnerability in the administrative pages of the PL/SQL module for Oracle Application Server 4.0.8 and 4.0.8 2 allows remote attackers to execute arbitrary code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: application_server
References: http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf, http://www.kb.cert.org/vuls/id/467555, http://www.nextgenss.com/vna/ora-ias.txt
CVE-2002-0106
BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: weblogic_server
References: http://marc.info/?l=bugtraq&m=101050440629269&w=2, http://www.iss.net/security_center/static/7808.php, http://www.securityfocus.com/bid/3816
CVE-2002-0667
Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain access to the phone.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: xpressa
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt, http://www.iss.net/security_center/static/9562.php, http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE-2002-1167
Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP GET request.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: websphere_caching_proxy_server
References: http://www.iss.net/security_center/static/10453.php, http://www.securityfocus.com/bid/6000, http://www.iss.net/security_center/static/10453.php
CVE-2002-1260
The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000, windows_nt, windows_98se, windows_98, windows_me
References: http://www.ciac.org/ciac/bulletins/n-026.shtml, http://www.securityfocus.com/bid/6379, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-069
CVE-2002-0123
MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier, and possibly 3.5.3, allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: web_server_4d_ecommerce
References: http://online.securityfocus.com/archive/1/250242, http://www.iss.net/security_center/static/7879.php, http://www.securityfocus.com/bid/3874
CVE-2002-0610
Vulnerability in FTPSRVR in HP MPE/iX 6.0 through 7.0 does not properly validate certain FTP commands, which allows attackers to gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mpe_ix
References: http://online.securityfocus.com/advisories/4082, http://www.ciac.org/ciac/bulletins/m-075.shtml, http://www.iss.net/security_center/static/8990.php
CVE-2002-0775
browse.asp in Hosting Controller allows remote attackers to view arbitrary directories by specifying the target pathname in the FilePath parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: hosting_controller
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0168.html, http://hostingcontroller.com/english/logs/sp2log.html, http://www.hostingcontroller.com/english/patches/ForAll/download/drivebrowse.zip
CVE-2002-0772
Directory traversal vulnerability in dsnmanager.asp for Hosting Controller allows remote attackers to read arbitrary files and directories via a .. (dot dot) in the RootName parameter.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: hosting_controller
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0142.html, http://www.iss.net/security_center/static/9104.php, http://www.securityfocus.com/bid/4759
CVE-2002-1348
w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: w3m
References: http://marc.info/?l=bugtraq&m=104552193927323&w=2, http://sourceforge.net/project/shownotes.php?release_id=126233, http://www.debian.org/security/2003/dsa-249
CVE-2002-0490
Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: instant_web_mail
References: http://instantwebmail.sourceforge.net/#changeLog, http://www.iss.net/security_center/static/8650.php, http://www.securityfocus.com/archive/1/264041
CVE-2002-1754
Buffer overflow in Novell NetWare Client 4.80 through 4.83 allows local users to cause a denial of service (crash) by using ping, traceroute, or a similar utility to force the client to resolve a large hostname.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netware_client
References: http://support.novell.com/servlet/tidfinder/2962694, http://www.cqure.net/advisories.jsp?id=15, https://exchange.xforce.ibmcloud.com/vulnerabilities/9035
CVE-2002-2145
Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: savant_webserver
References: http://online.securityfocus.com/archive/1/291791, http://www.iss.net/security_center/static/10104.php, http://www.securityfocus.com/bid/5709