deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1212
Published: 2002-10-28
Description: Buffer overflow in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=49&type=vulnerabilities&flashstatus=true; http://www.iss.net/security_center/static/10372.php; http://www.securityfocus.com/bid/5967
CVE: CVE-2002-1213
Published: 2002-10-28
Description: Directory traversal vulnerability in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to read arbitrary files via an HTTP request with ".." (dot-dot) sequences containing URL-encoded forward slash ("%2F") characters.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=49&type=vulnerabilities&flashstatus=true; http://www.iss.net/security_center/static/10373.php; http://www.securityfocus.com/bid/5968
CVE: CVE-2002-1214
Published: 2002-10-28
Description: Buffer overflow in Microsoft PPTP Service on Windows XP and Windows 2000 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a certain PPTP packet with malformed control data.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/293146; http://www.iss.net/security_center/static/10199.php; http://www.securityfocus.com/bid/5807
CVE: CVE-2002-1215
Published: 2002-10-28
Description: Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier (claimed as buffer overflows in some sources) allow remote attackers to execute arbitrary code via certain packets to UDP port 694 (incorrectly claimed as TCP in some sources).
CVSS Score: 10.0 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000540; http://linux-ha.org/security/sec01.txt; http://www.debian.org/security/2002/dsa-174
CVE: CVE-2002-1216
Published: 2002-10-28
Description: GNU tar 1.13.19 and other versions before 1.13.25 allows remote attackers to overwrite arbitrary files via a symlink attack, as the result of a modification that effectively disabled the security check.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9680&w=2; http://www.iss.net/security_center/static/10224.php; http://www.mandriva.com/security/advisories?name=MDKSA-2006:219
CVE: CVE-2002-1217
Published: 2002-10-28
Description: Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0024.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7576&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]0570&w=2
CVE: CVE-2002-1222
Published: 2002-10-28
Description: Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reset) via a long HTTP request.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://www.cisco.com/warp/public/707/catos-http-overflow-vuln.shtml; http://www.iss.net/security_center/static/10382.php; http://www.securityfocus.com/bid/5976
CVE: CVE-2002-1223
Published: 2002-10-28
Description: Buffer overflow in DSC 3.0 parser from GSview, as used in KGhostView in KDE 1.1 and KDE 3.0.3a, may allow attackers to cause a denial of service or execute arbitrary code via a modified .ps (PostScript) input file.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0163.html; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101426-1; http://www.ciac.org/ciac/bulletins/n-155.shtml
CVE: CVE-2002-1224
Published: 2002-10-28
Description: Directory traversal vulnerability in kpf for KDE 3.0.1 through KDE 3.0.3a allows remote attackers to read arbitrary files as the kpf user via a URL with a modified icon parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0164.html; http://online.securityfocus.com/archive/1/294991; http://www.iss.net/security_center/static/10347.php
CVE: CVE-2002-1225
Published: 2002-10-28
Description: Multiple buffer overflows in Heimdal before 0.5, possibly in both the (1) kadmind and (2) kdc servers, may allow remote attackers to gain root access.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8817&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1246&w=2; http://www.debian.org/security/2002/dsa-178
CVE: CVE-2002-1226
Published: 2002-10-28
Description: Unknown vulnerabilities in Heimdal before 0.5 with unknown impact, possibly in the (1) kadmind and (2) kdc servers, may allow remote or local attackers to gain root or other access, but not via buffer overflows (CVE-2002-1225).
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8817&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1246&w=2; http://www.debian.org/security/2002/dsa-178
CVE: CVE-2002-1227
Published: 2002-10-28
Description: PAM 0.76 treats a disabled password as if it were an empty (null) password, which allows local and remote attackers to gain privileges as disabled users.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2002/dsa-177; http://www.iss.net/security_center/static/10405.php; http://www.securityfocus.com/bid/5994
CVE: CVE-2002-1228
Published: 2002-10-28
Description: Unknown vulnerability in NFS on Solaris 2.5.1 through Solaris 9 allows an NFS client to cause a denial of service by killing the lockd daemon.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3193&w=2; http://sunsolve.sun.com/search/document.do?assetkey=1-26-47815-1; http://www.iss.net/security_center/static/10394.php
CVE: CVE-2002-1229
Published: 2002-10-28
Description: Avaya Cajun switches P880, P882, P580, and P550R 5.2.14 and earlier contain undocumented accounts (1) manuf and (2) diag with default passwords, which allows remote attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2971&w=2; http://support.avaya.com/japple/css/japple?PAGE=avaya.css.OpenPage&temp.template.name=Avaya_P580_P882_Undocumented; http://www.iss.net/security_center/static/10374.php
CVE: CVE-2002-1590
Published: 2002-10-29
Description: The Web-Based Enterprise Management (WBEM) packages (1) SUNWwbdoc, (2) SUNWwbcou, (3) SUNWwbdev and (4) SUNWmgapp packages, when installed using Solaris 8 Update 1/01 or later, install files with world or group write permissions, which allows local users to gain root privileges or cause a denial of service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-48320-1; http://www.ciac.org/ciac/bulletins/n-010.shtml; http://www.securityfocus.com/bid/6061
CVE: CVE-2002-0386
Published: 2002-11-04
Description: The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash) via (1) an HTTP GET request containing a ".." (dot dot) sequence, or (2) a malformed HTTP GET request with a chunked Transfer-Encoding with missing data.
CVSS Score: 5.0 (MEDIUM)
References: http://otn.oracle.com/deploy/security/pdf/2002alert43rev1.pdf; http://www.atstake.com/research/advisories/2002/a102802-1.txt; http://www.iss.net/security_center/static/10284.php
CVE: CVE-2002-0666
Published: 2002-11-04
Description: IPSEC implementations including (1) FreeS/WAN and (2) KAME do not properly calculate the length of authentication data, which allows remote attackers to cause a denial of service (kernel panic) via spoofed, short Encapsulating Security Payload (ESP) packets, which result in integer signedness errors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-016.txt.asc; http://razor.bindview.com/publish/advisories/adv_ipsec.html; http://www.debian.org/security/2002/dsa-201
CVE: CVE-2002-1157
Published: 2002-11-04
Description: Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0374.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000541; http://online.securityfocus.com/archive/1/296753
CVE: CVE-2002-1167
Published: 2002-11-04
Description: Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP GET request.
CVSS Score: 6.8 (MEDIUM)
References: http://www.iss.net/security_center/static/10453.php; http://www.securityfocus.com/bid/6000; http://www.iss.net/security_center/static/10453.php
CVE: CVE-2002-1168
Published: 2002-11-04
Description: Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that contains an Location: header with a "%0a%0d" (CRLF) sequence, which echoes the Location as an HTTP header in the server response.
CVSS Score: 6.8 (MEDIUM)
References: http://www.iss.net/security_center/static/10454.php; http://www.securityfocus.com/bid/6001; http://www.iss.net/security_center/static/10454.php
CVE: CVE-2002-1169
Published: 2002-11-04
Description: IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to cause a denial of service (crash) via an HTTP request to helpout.exe with a missing HTTP version number, which causes ibmproxy.exe to crash.
CVSS Score: 5.0 (MEDIUM)
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY35970&apar=only; http://www.iss.net/security_center/static/10452.php; http://www.osvdb.org/2090
CVE: CVE-2002-1209
Published: 2002-11-04
Description: Directory traversal vulnerability in SolarWinds TFTP Server 5.0.55, and possibly earlier, allows remote attackers to read arbitrary files via "..\" (dot-dot backslash) sequences in a GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0044.html; http://www.idefense.com/advisory/10.24.02.txt; http://www.securityfocus.com/bid/6045
CVE: CVE-2002-1230
Published: 2002-11-04
Description: NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message, as demonstrated by GetAd, aka "Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation."
CVSS Score: 4.6 (MEDIUM)
References: http://getad.chat.ru/; http://www.ciac.org/ciac/bulletins/n-027.shtml; http://www.iss.net/security_center/static/10343.php
CVE: CVE-2002-1231
Published: 2002-11-04
Description: SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to cause a denial of service via an rcp call on /proc.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.41; http://www.iss.net/security_center/static/10425.php; http://www.securityfocus.com/bid/6025
CVE: CVE-2002-1232
Published: 2002-11-04
Description: Memory leak in ypdb_open in yp_db.c for ypserv before 2.5 in the NIS package 3.9 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of requests for a map that does not exist.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-054.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000539; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8894&w=2
CVE: CVE-2002-1233
Published: 2002-11-04
Description: A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2007&w=2; http://www.debian.org/security/2002/dsa-187; http://www.debian.org/security/2002/dsa-188
CVE: CVE-2002-1234
Published: 2002-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-0180.  Reason: This candidate is a an out-of-band assignment duplicate of CVE-2002-0180.  Notes: All CVE users should reference CVE-2002-0180 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2002-1235
Published: 2002-11-04
Description: The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-026.txt.asc; http://archives.neohapsis.com/archives/bugtraq/2002-10/0399.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000534
CVE: CVE-2002-1585
Published: 2002-11-08
Description: Unknown vulnerability in Solaris 8 for Intel and Solaris 8 and 9 for SPARC allows remote attackers to cause a denial of service via certain packets that cause some network interfaces to stop responding to TCP traffic.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-48601-1; http://www.securityfocus.com/bid/6147; https://exchange.xforce.ibmcloud.com/vulnerabilities/10600
CVE: CVE-2002-0711
Published: 2002-11-12
Description: Unknown vulnerability in Cluster Interconnect for HP TruCluster Server 5.0A, 5.1, and 5.1A may allow local and remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6272&w=2; http://www.iss.net/security_center/static/10551.php; http://www.securityfocus.com/advisories/4633
CVE: CVE-2002-0869
Published: 2002-11-12
Description: Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0059.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5574&w=2; http://www.ciac.org/ciac/bulletins/n-011.shtml
CVE: CVE-2002-1180
Published: 2002-11-12
Description: A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://www.ciac.org/ciac/bulletins/n-011.shtml; http://www.iss.net/security_center/static/10504.php; http://www.securityfocus.com/bid/6068
CVE: CVE-2002-1181
Published: 2002-11-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5736&w=2; http://www.ciac.org/ciac/bulletins/n-011.shtml; http://www.iss.net/security_center/static/10501.php
CVE: CVE-2002-1182
Published: 2002-11-12
Description: IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0048.html; http://www.ciac.org/ciac/bulletins/n-011.shtml; http://www.nextgenss.com/advisories/ms-iisdos.txt
CVE: CVE-2002-1184
Published: 2002-11-12
Description: The system root folder of Microsoft Windows 2000 has default permissions of Everyone group with Full access (Everyone:F) and is in the search path when locating programs during login or application launch from the desktop, which could allow attackers to gain privileges as other users via Trojan horse programs.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/bid/5415; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-064; https://exchange.xforce.ibmcloud.com/vulnerabilities/9779
CVE: CVE-2002-1211
Published: 2002-11-12
Description: Prometheus 6.0 and earlier allows remote attackers to execute arbitrary PHP code via a modified PROMETHEUS_LIBRARY_BASE that points to code stored on a remote server, which is then used in (1) index.php, (2) install.php, or (3) various test_*.php scripts.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0050.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3031&w=2; http://www.idefense.com/advisory/10.31.02b.txt
CVE: CVE-2002-1236
Published: 2002-11-12
Description: The remote management web server for Linksys BEFSR41 EtherFast Cable/DSL Router before firmware 1.42.7 allows remote attackers to cause a denial of service (crash) via an HTTP request to Gozila.cgi without any arguments.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0049.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3171&w=2; http://www.idefense.com/advisory/10.31.02a.txt
CVE: CVE-2002-1238
Published: 2002-11-12
Description: Peter Sandvik's Simple Web Server 0.5.1 and earlier allows remote attackers to bypass access restrictions for files via an HTTP request with a sequence of multiple / (slash) characters such as http://www.example.com///file/.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0065.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1857&w=2; http://www.idefense.com/advisory/11.08.02a.txt
CVE: CVE-2002-1239
Published: 2002-11-12
Description: QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to find and execute the cp program while operating at raised privileges, which allows local users to gain privileges by modifying the PATH to point to a malicious cp program.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0066.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2178&w=2; http://www.idefense.com/advisory/11.08.02b.txt
CVE: CVE-2002-1242
Published: 2002-11-12
Description: SQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0051.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3171&w=2; http://www.idefense.com/advisory/10.31.02c.txt
CVE: CVE-2002-1244
Published: 2002-11-12
Description: Format string vulnerability in Pablo FTP Server 1.5, 1.3, and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format strings in the USER command.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0057.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2889&w=2; http://www.iss.net/security_center/static/10532.php
CVE: CVE-2002-1245
Published: 2002-11-12
Description: Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, which allows local users to modify /dev/mem and gain privileges via a modified PATH environment variable that points to a Trojan horse gzip program.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0062.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9855&w=2; http://www.debian.org/security/2002/dsa-189
CVE: CVE-2002-1248
Published: 2002-11-12
Description: Northern Solutions Xeneo Web Server 2.1.0.0, 2.0.759.6, and other versions before 2.1.5 allows remote attackers to cause a denial of service (crash) via a GET request for a "%" URI.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2308&w=2; http://www.idefense.com/advisory/11.04.02b.txt; http://www.iss.net/security_center/static/10534.php
CVE: CVE-2002-1250
Published: 2002-11-12
Description: Buffer overflow in Abuse 2.00 and earlier allows local users to gain root privileges via a long -net command line argument.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0055.html; http://www.idefense.com/advisory/11.01.02.txt; http://www.iss.net/security_center/static/10519.php
CVE: CVE-2002-1251
Published: 2002-11-12
Description: Buffer overflow in log2mail before 0.2.5.1 allows remote attackers to execute arbitrary code via a long log message.
CVSS Score: 10.0 (HIGH)
References: http://www.debian.org/security/2002/dsa-186; http://www.iss.net/security_center/static/10527.php; http://www.securityfocus.com/bid/6089
CVE: CVE-2002-1253
Published: 2002-11-12
Description: Abuse 2.00 and earlier allows local users to gain privileges via command line arguments that specify alternate Lisp scripts that run at escalated privileges, which can contain functions that execute commands or modify files.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0055.html; http://www.idefense.com/advisory/11.01.02.txt; http://www.iss.net/security_center/static/11300.php
CVE: CVE-2002-1264
Published: 2002-11-12
Description: Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0060.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2284&w=2; http://technet.oracle.com/deploy/security/pdf/2002alert46rev1.pdf
CVE: CVE-2002-1265
Published: 2002-11-12
Description: The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang).
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20021103-01-P; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/51082; http://www-1.ibm.com/services/continuity/recover1.nsf/mss/MSS-OAR-E01-2004.0800.1
CVE: CVE-2002-1271
Published: 2002-11-12
Description: The Mail::Mailer Perl module in the perl-MailTools package 1.47 and earlier uses mailx as the default mailer, which allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1369&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5086&w=2; http://www.debian.org/security/2003/dsa-386
CVE: CVE-2002-1275
Published: 2002-11-12
Description: Unknown vulnerability in html2ps HTML/PostScript converter 1.0, when used within LPRng, allows remote attackers to execute arbitrary code via "unsanitized input."
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2002/dsa-192; http://www.iss.net/security_center/static/10526.php; http://www.novell.com/linux/security/advisories/2002_040_lprng_html2ps.html