deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-0114
Published: 2002-03-25
Description: EMC NetWorker (formerly Legato NetWorker) before 7.0 stores passwords in plaintext in the daemon.log file, which allows local users to gain privileges by reading the password from the file.  NOTE: this was originally reported for Legato NetWorker 6.1 on the Solaris 7 platform.
CVSS Score: 4.6 (MEDIUM)
References: http://online.securityfocus.com/archive/1/249420; http://www.iss.net/security_center/static/7898.php; http://www.securityfocus.com/bid/3842
CVE: CVE-2002-0115
Published: 2002-03-25
Description: Snort 1.8.3 does not properly define the minimum ICMP header size, which allows remote attackers to cause a denial of service (crash and core dump) via a malformed ICMP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/249340; http://online.securityfocus.com/cgi-bin/archive.pl?id=1&start=2002-03-08&end=2002-03-14&mid=249623&threads=1; http://www.iss.net/security_center/static/7874.php
CVE: CVE-2002-0116
Published: 2002-03-25
Description: Palm OS 3.5h and possibly other versions, as used in Handspring Visor and Xircom products, allows remote attackers to cause a denial of service via a TCP connect scan, e.g. from nmap.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9208&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9956&w=2; http://www.iss.net/security_center/static/7865.php
CVE: CVE-2002-0117
Published: 2002-03-25
Description: Cross-site scripting vulnerability in Yet Another Bulletin Board (YaBB) 1 Gold SP 1 and earlier allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/249031; http://online.securityfocus.com/cgi-bin/vulns-item.pl?section=info&id=3828; http://www.iss.net/security_center/static/7840.php
CVE: CVE-2002-0118
Published: 2002-03-25
Description: Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) 6.2.0 Beta Release 1.0 allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/249031; http://www.iss.net/security_center/static/7838.php; http://www.securityfocus.com/bid/3829
CVE: CVE-2002-0119
Published: 2002-03-25
Description: Alcatel Speed Touch Home ADSL Modem allows remote attackers to cause a denial of service (reboot) via a network scan with unusual packets, such as nmap with OS detection.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/249746; http://www.iss.net/security_center/static/7893.php; http://www.securityfocus.com/bid/3851
CVE: CVE-2002-0120
Published: 2002-03-25
Description: Apple Palm Desktop 4.0b76 and 4.0b77 creates world-readable backup files and folders when a hotsync is performed, which could allow a local user to obtain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://online.securityfocus.com/archive/1/250093; http://www.iss.net/security_center/static/7937.php; http://www.securityfocus.com/bid/3863
CVE: CVE-2002-0121
Published: 2002-03-25
Description: PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections.
CVSS Score: 2.1 (LOW)
References: http://online.securityfocus.com/archive/1/250196; http://www.iss.net/security_center/static/7908.php; http://www.securityfocus.com/bid/3873
CVE: CVE-2002-0122
Published: 2002-03-25
Description: Siemens 3568i WAP mobile phones allows remote attackers to cause a denial of service (crash) via an SMS message containing unusual characters.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/250115; http://www.iss.net/security_center/static/7902.php; http://www.securityfocus.com/bid/3870
CVE: CVE-2002-0123
Published: 2002-03-25
Description: MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier, and possibly 3.5.3, allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/250242; http://www.iss.net/security_center/static/7879.php; http://www.securityfocus.com/bid/3874
CVE: CVE-2002-0124
Published: 2002-03-25
Description: MDG Computer Services Web Server 4D/eCommerce 3.5.3 allows remote attackers to exploit directory traversal vulnerability via a ../ (dot dot) containing URL-encoded slashes in the HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/250231; http://www.iss.net/security_center/static/7878.php; http://www.securityfocus.com/bid/3872
CVE: CVE-2002-0125
Published: 2002-03-25
Description: Buffer overflow in ClanLib library 0.5 may allow local users to execute arbitrary code in games that use the library, such as (1) Super Methane Brothers, (2) Star War, (3) Kwirk, (4) Clankanoid, and others, via a long HOME environment variable.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/250414; http://www.iss.net/security_center/static/7905.php; http://www.securityfocus.com/bid/3877
CVE: CVE-2002-0126
Published: 2002-03-25
Description: Buffer overflow in BlackMoon FTP Server 1.0 through 1.5 allows remote attackers to execute arbitrary code via a long argument to (1) USER, (2) PASS, or (3) CWD.
CVSS Score: 7.5 (HIGH)
References: http://members.rogers.com/blackmoon2k/pages/news_page.html; http://online.securityfocus.com/archive/1/250543; http://www.iss.net/security_center/static/7895.php
CVE: CVE-2002-0127
Published: 2002-03-25
Description: Netgear RP114 Cable/DSL Web Safe Router Firmware 3.26, when configured to block traffic below port 1024, allows remote attackers to cause a denial of service (hang) via a port scan of the WAN port.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/250405; http://www.securityfocus.com/bid/3876; http://online.securityfocus.com/archive/1/250405
CVE: CVE-2002-0128
Published: 2002-03-25
Description: cgitest.exe in Sambar Server 5.1 before Beta 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long argument.
CVSS Score: 7.5 (HIGH)
References: http://www.der-keiler.de/Mailing-Lists/securityfocus/bugtraq/2002-02/0083.html; http://www.iss.net/security_center/static/7894.php; http://www.sambar.com/security.htm
CVE: CVE-2002-0129
Published: 2002-03-25
Description: efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]0912&w=2; http://seclists.org/bugtraq/2002/Jan/0212.html; http://www.iss.net/security_center/static/7921.php
CVE: CVE-2002-0130
Published: 2002-03-25
Description: Buffer overflow in efax 0.9 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -x argument.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]4289&w=2; http://seclists.org/bugtraq/2002/Jan/0212.html; http://www.iss.net/security_center/static/7920.php
CVE: CVE-2002-0131
Published: 2002-03-25
Description: ActivePython ActiveX control for Python in the AXScript package, when used in Internet Explorer, does not prevent a script from reading files from the client's filesystem, which allows remote attackers to read arbitrary files via a malicious web page containing Python script.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?t=[PII_REDACTED]0001&r=1&w=2; http://www.iss.net/security_center/static/7910.php; http://www.securityfocus.com/archive/1/250814
CVE: CVE-2002-0132
Published: 2002-03-25
Description: Buffer overflow in Chinput 3.0 allows local users to execute arbitrary code via a long HOME environment variable.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/250815; http://www.iss.net/security_center/static/7911.php; http://www.securityfocus.com/bid/3896
CVE: CVE-2002-0133
Published: 2002-03-25
Description: Buffer overflows in Avirt Gateway Suite 4.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long header fields to the HTTP proxy, or (2) a long string to the telnet proxy.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8092&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2809&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8817&w=2
CVE: CVE-2002-0134
Published: 2002-03-25
Description: Telnet proxy in Avirt Gateway Suite 4.2 does not require authentication for connecting to the proxy system itself, which allows remote attackers to list file contents of the proxy and execute arbitrary commands via a "dos" command.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2843&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8817&w=2; http://www.iss.net/security_center/static/7915.php
CVE: CVE-2002-0135
Published: 2002-03-25
Description: Netopia Timbuktu Pro 6.0.1 and earlier allows remote attackers to cause a denial of service (crash) via a series of connections to one of the ports (1417 - 1420).
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/251582; http://www.iss.net/security_center/static/7935.php; http://www.securityfocus.com/bid/3918
CVE: CVE-2002-0136
Published: 2002-03-25
Description: Microsoft Internet Explorer 5.5 on Windows 98 allows remote web pages to cause a denial of service (hang) via extremely long values for form fields such as INPUT and TEXTAREA, which can be automatically filled via Javascript.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/250592; http://www.securityfocus.com/bid/3892; https://exchange.xforce.ibmcloud.com/vulnerabilities/7938
CVE: CVE-2002-0137
Published: 2002-03-25
Description: CDRDAO 1.1.4 and 1.1.5 allows local users to overwrite arbitrary files via a symlink attack on the $HOME/.cdrdao configuration file.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1000&w=2; http://www.securityfocus.com/bid/3865; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1000&w=2
CVE: CVE-2002-0138
Published: 2002-03-25
Description: CDRDAO 1.1.4 and 1.1.5 allows local users to read arbitrary files via the show-data command.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1000&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9855&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1000&w=2
CVE: CVE-2002-0139
Published: 2002-03-25
Description: Pi-Soft SpoonFTP 1.1 and earlier allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/251422; http://www.iss.net/security_center/static/7943.php; http://www.pi-soft.com/spoonftp/index.shtml
CVE: CVE-2002-0140
Published: 2002-03-25
Description: Domain Name Relay Daemon (dnrd) 2.10 and earlier allows remote malicious DNS sites to cause a denial of service and possibly execute arbitrary code via a long or malformed DNS reply, which is not handled properly by parse_query, get_objectname, and possibly other functions.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/251619; http://www.iss.net/security_center/static/7957.php; http://www.securityfocus.com/bid/3928
CVE: CVE-2002-0141
Published: 2002-03-25
Description: Maelstrom GPL 3.0.1 allows local users to overwrite arbitrary files of other Maelstrom users via a symlink attack on the /tmp/f file.
CVSS Score: 1.2 (LOW)
References: http://online.securityfocus.com/archive/1/251419; http://www.iss.net/security_center/static/7939.php; http://www.securityfocus.com/bid/3911
CVE: CVE-2002-0142
Published: 2002-03-25
Description: CGI handler in John Roy Pi3Web for Windows 2.0 beta 1 and 2 allows remote attackers to cause a denial of service (crash) via a series of requests whose physical path is exactly 260 characters long and ends in a series of . (dot) characters.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8093&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]6307&w=2; http://online.securityfocus.com/archive/1/250126
CVE: CVE-2002-0143
Published: 2002-03-25
Description: Buffer overflow in Eterm of Enlightenment Imlib2 1.0.4 and earlier allows local users to execute arbitrary code via a long HOME environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://online.securityfocus.com/archive/1/250145; http://online.securityfocus.com/archive/1/251597; http://www.iss.net/security_center/static/7896.php
CVE: CVE-2002-0144
Published: 2002-03-25
Description: Directory traversal vulnerability in chuid 1.2 and earlier allows remote attackers to change the ownership of files outside of the upload directory via a .. (dot dot) attack.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/251763; http://www.iss.net/security_center/static/7976.php; http://www.securityfocus.com/bid/3937
CVE: CVE-2002-0145
Published: 2002-03-25
Description: chuid 1.2 and earlier does not properly verify the ownership of files that will be changed, which allows remote attackers to change files owned by other users, such as root.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/251763; http://www.securityfocus.com/bid/3938; https://exchange.xforce.ibmcloud.com/vulnerabilities/7976
CVE: CVE-2002-0163
Published: 2002-03-26
Description: Heap-based buffer overflow in Squid before 2.4 STABLE4, and Squid 2.5 and 2.6 until March 12, 2002 distributions, allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via compressed DNS responses.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-017.1.txt; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:19.squid.asc; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3226&w=2
CVE: CVE-2002-0162
Published: 2002-03-27
Description: LogWatch before 2.5 allows local users to execute arbitrary code via a symlink attack on the logwatch temporary directory.
CVSS Score: 6.2 (MEDIUM)
References: http://list.kaybee.org/archives/logwatch-announce/2002-March/000002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6872; http://online.securityfocus.com/archive/82/264233
CVE: CVE-2002-0039
Published: 2002-03-28
Description: rpcbind in SGI IRIX 6.5 through 6.5.15f, and possibly earlier versions, allows remote attackers to cause a denial of service (crash) via malformed RPC packets with invalid lengths.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20020306-01-P; ftp://patches.sgi.com/support/free/security/advisories/20020306-01-P
CVE: CVE-2002-0040
Published: 2002-03-28
Description: Vulnerability in SGI IRIX 6.5.11 through 6.5.15f allows local users to cause privileged applications to dump core via the HOSTALIASES environment variable, which might allow the users to gain privileges.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20020306-01-P; http://www.iss.net/security_center/static/8669.php; http://www.osvdb.org/2058
CVE: CVE-2002-0078
Published: 2002-03-29
Description: The zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the script in a cookie, aka the "Cookie-based Script Execution" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8301&w=2; http://www.iss.net/security_center/static/8701.php; http://www.osvdb.org/3029
CVE: CVE-2001-1165
Published: 2002-04-01
Description: Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which allows local users to gain privileges by decrypting the information, e.g., with the Disengage tool.
CVSS Score: 4.6 (MEDIUM)
References: http://www.iss.net/security_center/static/7018.php; http://www.securemac.com/fileguard.php#disengage; http://www.securityfocus.com/bid/3213
CVE: CVE-2001-1171
Published: 2002-04-01
Description: Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow local users to gain privileges or modify the firewall policy.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2001-09/0046.html; http://archives.neohapsis.com/archives/bugtraq/2001-09/0046.html
CVE: CVE-2001-1174
Published: 2002-04-01
Description: Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header.
CVSS Score: 7.5 (HIGH)
References: http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-067.php; http://www.osvdb.org/5451; http://www.redhat.com/support/errata/RHSA-2001-091.html
CVE: CVE-2001-1175
Published: 2002-04-01
Description: vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing.
CVSS Score: 7.2 (HIGH)
References: http://www.redhat.com/support/errata/RHSA-2001-095.html; http://www.redhat.com/support/errata/RHSA-2001-132.html; http://www.securityfocus.com/bid/3036
CVE: CVE-2002-1620
Published: 2002-04-01
Description: Unknown vulnerability in IBM AIX Parallel Systems Support Programs (PSSP) 3.1.1, 3.2, and 3.4 allows remote attackers to read arbitrary files from a file collection.
CVSS Score: 5.0 (MEDIUM)
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY20699&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY28063&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY28065&apar=only
CVE: CVE-2002-1639
Published: 2002-04-01
Description: Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter set to "version" or "host".
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1003967; http://www.kb.cert.org/vuls/id/158323; http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.html
CVE: CVE-2002-1640
Published: 2002-04-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via (1) Text Features in the DHTML UI or (2) the test parameter to the oracle.apps.cz.servlet.UiServlet servlet.
CVSS Score: 6.8 (MEDIUM)
References: http://securitytracker.com/id?1003967; http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.html; http://www.securityfocus.com/bid/4430
CVE: CVE-2002-0158
Published: 2002-04-02
Description: Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0652&w=2; http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doc=fpatches%2F108652
CVE: CVE-2002-0017
Published: 2002-04-03
Description: Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20020201-01-P; http://www.iss.net/security_center/alerts/advise113.php; http://www.iss.net/security_center/static/7846.php
CVE: CVE-2002-0165
Published: 2002-04-03
Description: LogWatch 2.5 allows local users to gain root privileges via a symlink attack, a different vulnerability than CVE-2002-0162.
CVSS Score: 7.2 (HIGH)
References: http://list.kaybee.org/archives/logwatch-announce/2002-March/000003.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3000&w=2; http://www.iss.net/security_center/static/8652.php
CVE: CVE-2002-0051
Published: 2002-04-04
Description: Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-667, CWE-667
References: http://online.securityfocus.com/archive/1/244329; http://www.securityfocus.com/bid/4438; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-016
CVE: CVE-2002-0151
Published: 2002-04-04
Description: Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6282&w=2; http://www.iss.net/security_center/static/8752.php; http://www.securityfocus.com/bid/4426
CVE: CVE-2002-1598
Published: 2002-04-05
Description: Buffer overflows in Computer Associates MLink (CA-MLink) 6.5 and earlier may allow local users to execute arbitrary code via long command line arguments to (1) mlclear or (2) mllock.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.ca.com/pub/unicenter/mlink/mlink.13/MLINK13.README; http://www.kb.cert.org/vuls/id/544995; http://www.kb.cert.org/vuls/id/772915
CVE: CVE-2002-1591
Published: 2002-04-08
Description: AOL Instant Messenger (AIM) 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
References: http://www.informationweek.com/story/IWK20010927S0021; http://www.instantmessagingplanet.com/security/article.php/10818_1014151; http://www.kb.cert.org/vuls/id/744139
CVE: CVE-2002-0037
Published: 2002-04-22
Description: Lotus Domino Servers 5.x, 4.6x, and 4.5x allows attackers to bypass the intended Reader and Author access list for a document's object via a Notes API call (NSFDbReadObject) that directly accesses the object.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2001-09/0147.html; http://archives.neohapsis.com/archives/bugtraq/2001-09/0150.html; http://www.iss.net/security_center/static/10095.php
CVE: CVE-2002-0041
Published: 2002-04-22
Description: Unknown vulnerability in Mail for SGI IRIX 6.5 through 6.5.15f, and possibly earlier versions, when running with the -R option, allows local and remote attackers to cause a core dump.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20020401-01-P; http://www.ciac.org/ciac/bulletins/m-067.shtml; http://www.iss.net/security_center/static/8835.php
CVE: CVE-2002-0064
Published: 2002-04-22
Description: Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.
CVSS Score: 7.2 (HIGH)
References: http://razor.bindview.com/publish/advisories/adv_FunkProxy.html; http://www.iss.net/security_center/static/8791.php; http://www.securityfocus.com/bid/4458
CVE: CVE-2002-0065
Published: 2002-04-22
Description: Funk Software Proxy Host 3.x uses weak encryption for the Proxy Host password, which allows local users to gain privileges by recovering the passwords from the PHOST.INI file or the Windows registry.
CVSS Score: 7.2 (HIGH)
References: http://razor.bindview.com/publish/advisories/adv_FunkProxy.html; http://www.iss.net/security_center/static/8792.php; http://www.securityfocus.com/bid/4459
CVE: CVE-2002-0066
Published: 2002-04-22
Description: Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control, which allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://razor.bindview.com/publish/advisories/adv_FunkProxy.html; http://www.iss.net/security_center/static/8793.php; http://www.securityfocus.com/bid/4460