deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1373
Published: 2002-12-23
Description: Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3961&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1968&w=2
CVE: CVE-2002-1374
Published: 2002-12-23
Description: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3961&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1968&w=2
CVE: CVE-2002-1375
Published: 2002-12-23
Description: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3961&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1968&w=2
CVE: CVE-2002-1376
Published: 2002-12-23
Description: libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3961&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1968&w=2
CVE: CVE-2002-1377
Published: 2002-12-23
Description: vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.
CVSS Score: 4.6 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000812; http://lists.grok.org.uk/pipermail/full-disclosure/2002-December/002948.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8690&w=2
CVE: CVE-2002-1380
Published: 2002-12-23
Description: Linux kernel 2.2.x allows local users to cause a denial of service (crash) by using the mmap() function with a PROT_READ parameter to access non-readable memory pages through the /proc/pid/mem interface.
CVSS Score: 2.1 (LOW)
References: http://www.debian.org/security/2003/dsa-336; http://www.linuxsecurity.com/advisories/engarde_advisory-2976.html; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:039
CVE: CVE-2002-1381
Published: 2002-12-23
Description: Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitrary code by modifying the pid_file_path value.
CVSS Score: 7.2 (HIGH)
References: http://groups.yahoo.com/group/exim-users/message/42358; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7788&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8664&w=2
CVE: CVE-2002-1382
Published: 2002-12-23
Description: Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format (SWF) files, a different issue than CAN-2002-0846.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7109&w=2; http://marc.info/?l=vulnwatch&m=[PII_REDACTED]6670; http://www.macromedia.com/v1/handlers/index.cfm?ID=23569
CVE: CVE-2002-1351
Published: 2002-12-24
Description: Buffer overflow in Melange Chat System 1.10 allows remote attackers to cause a denial of service (chat server crash) and possibly execute arbitrary code via the msgText buffer in the chat_InterpretData function, as demonstrated via a long Nick (nickname) request.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1005831; http://www.idefense.com/application/poi/display?id=33&type=vulnerabilities&flashstatus=false; http://www.securityfocus.com/bid/6477
CVE: CVE-2002-1176
Published: 2002-12-26
Description: Buffer overflow in Winamp 2.81 allows remote attackers to execute arbitrary code via a long Artist ID3v2 tag in an MP3 file.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9567&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9567&w=2
CVE: CVE-2002-1177
Published: 2002-12-26
Description: Multiple buffer overflows in Winamp 3.0, when displaying an MP3 in the Media Library window, allows remote attackers to execute arbitrary code via an MP3 file containing a long (1) Artist or (2) Album ID3v2 tag.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9567&w=2; http://www.securityfocus.com/bid/6429; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9567&w=2
CVE: CVE-2002-1327
Published: 2002-12-26
Description: Buffer overflow in the Windows Shell function in Microsoft Windows XP allows remote attackers to execute arbitrary code via an .MP3 or .WMA audio file with a corrupt custom attribute, aka "Unchecked Buffer in Windows Shell Could Enable System Compromise."
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9384&w=2; http://www.cert.org/advisories/CA-2002-37.html; http://www.kb.cert.org/vuls/id/591890
CVE: CVE-2002-1363
Published: 2002-12-26
Description: Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
CVSS Score: 7.5 (HIGH)
References: http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:008; http://www.debian.org/security/2002/dsa-213; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:063
CVE: CVE-2002-1366
Published: 2002-12-26
Description: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream.
CVSS Score: 6.2 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6670&w=2; http://www.debian.org/security/2003/dsa-232
CVE: CVE-2002-1367
Published: 2002-12-26
Description: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need authorization" page, as demonstrated by new-coke.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6670&w=2
CVE: CVE-2002-1368
Published: 2002-12-26
Description: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing negative arguments to be fed into memcpy() calls via HTTP requests with (1) a negative Content-Length value or (2) a negative length in a chunked transfer encoding.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-004.0.txt; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702
CVE: CVE-2002-1369
Published: 2002-12-26
Description: jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the options string, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6670&w=2
CVE: CVE-2002-1371
Published: 2002-12-26
Description: filters/image-gif.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which allows remote attackers to execute arbitrary code via modified chunk headers, as demonstrated by nogif.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6670&w=2
CVE: CVE-2002-1372
Published: 2002-12-26
Description: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-252
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6670&w=2
CVE: CVE-2002-1383
Published: 2002-12-26
Description: Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via (1) the CUPSd HTTP interface, as demonstrated by vanilla-coke, and (2) the image handling code in CUPS filters, as demonstrated by mksun.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-004.0.txt; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6670&w=2
CVE: CVE-2002-1385
Published: 2002-12-26
Description: openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for  openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0743&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8026&w=2; http://sourceforge.net/forum/forum.php?thread_id=782605&forum_id=108435
CVE: CVE-2002-1584
Published: 2002-12-27
Description: Unknown vulnerability in the AUTH_DES authentication for RPC in Solaris 2.5.1, 2.6, and 7, SGI IRIX 6.5 to 6.5.19f, and possibly other platforms, allows remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20030402-01-P; http://secunia.com/advisories/7899/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-46944-1
CVE: CVE-2002-1571
Published: 2002-12-31
Description: The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on processors that do not clear all relevant SSE registers.
CVSS Score: 2.1 (LOW)
References: http://linux.bkbits.net:8080/linux-2.4/diffs/arch/i386/kernel/i387.c%401.6; http://search.luky.org/linux-kernel.2002/msg24003.html; http://search.luky.org/linux-kernel.2002/msg24992.html
CVE: CVE-2002-1572
Published: 2002-12-31
Description: Signed integer overflow in the bttv_read function in the bttv driver (bttv-driver.c) in Linux kernel before 2.4.20 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://linux.bkbits.net:8080/linux-2.4/cset%403d6badc0mxsPaOTT_GuPVxCp1_ormw; http://www.redhat.com/support/errata/RHSA-2002-205.html; http://www.redhat.com/support/errata/RHSA-2002-206.html
CVE: CVE-2002-1573
Published: 2002-12-31
Description: Unspecified vulnerability in the pcilynx ieee1394 firewire driver (pcilynx.c) in Linux kernel before 2.4.20 has unknown impact and attack vectors, related to "wrap handling."
CVSS Score: 10.0 (HIGH)
References: http://linux.bkbits.net:8080/linux-2.4/cset%403d6aadcbBIDX67Zl6zZnVKRcsilCVQ; http://www.redhat.com/support/errata/RHSA-2002-205.html; http://www.redhat.com/support/errata/RHSA-2002-206.html
CVE: CVE-2002-1617
Published: 2002-12-31
Description: Multiple buffer overflows in HP Tru64 UNIX 5.x allow local users to execute arbitrary code via (1) a long -contextDir argument to dtaction, (2) a long -p argument to dtprintinfo, (3) a long -customization argument to dxterm, or (4) a long DISPLAY environment variable to dtterm.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html; http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html; http://www.blacksheepnetworks.com/security/hack/tru64/TRU64_dtaction.txt
CVE: CVE-2002-1622
Published: 2002-12-31
Description: Buffer overflow in certain RPC routines in IBM AIX 4.3 may allow attackers to execute arbitrary code, related to a "variable data type."
CVSS Score: 7.5 (HIGH)
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY28706&apar=only; http://www.kb.cert.org/vuls/id/273779; https://exchange.xforce.ibmcloud.com/vulnerabilities/10112
CVE: CVE-2002-1623
Published: 2002-12-31
Description: The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses before the password is supplied or (2) sniffing, as originally reported for FireWall-1 SecuRemote.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001223.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9621&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9351&w=2
CVE: CVE-2002-1624
Published: 2002-12-31
Description: Buffer overflow in Lotus Domino web server before R5.0.10, when logging to DOMLOG.NSF, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP Authenticate header containing certain non-ASCII characters.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1004052; http://www.kb.cert.org/vuls/id/772563; http://www.securityfocus.com/bid/6646
CVE: CVE-2002-1625
Published: 2002-12-31
Description: Macromedia Flash Player 6 does not terminate connections when the user leaves the web page, which allows remote attackers to cause a denial of service (bandwidth, resource, and CPU consumption) via the (1) loadMovie or (2) loadSound commands, which continue to execute until the browser is closed.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/128491; http://www.macromedia.com/v1/handlers/index.cfm?ID=22796&Method=Full&Title=Macromedia%20Flash%20Player%206%20Streaming%20Issue&Cache=False; http://www.securityfocus.com/bid/4567
CVE: CVE-2002-1626
Published: 2002-12-31
Description: Directory traversal vulnerability in Mike Spice My Calendar before 1.5 allows remote attackers to write arbitrary files via .. (dot dot) sequences in a URL.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1003256; http://www.kb.cert.org/vuls/id/806091; http://www.securityfocus.com/bid/3856
CVE: CVE-2002-1627
Published: 2002-12-31
Description: Directory traversal vulnerability in quiz.cgi for Mike Spice Quiz Me! before 0.6 allows remote attackers to write arbitrary files via .. (dot dot) sequences in the quiz parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1003254; http://www.kb.cert.org/vuls/id/318835; http://www.securityfocus.com/bid/3857
CVE: CVE-2002-1628
Published: 2002-12-31
Description: Directory traversal vulnerability in vote.cgi for Mike Spice Mike's Vote CGI before 1.3 allows remote attackers to write arbitrary files via .. (dot dot) sequences in the type parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/250107; http://www.securityfocus.com/bid/3854; https://exchange.xforce.ibmcloud.com/vulnerabilities/7971
CVE: CVE-2002-1629
Published: 2002-12-31
Description: Multi-Tech ProxyServer products MTPSR1-100, MTPSR1-120, MTPSR1-202ST, MTPSR2-201, and MTPSR3-200 ship with a null password, which allows remote attackers to gain administrative privileges via Telnet or HTTP.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0105.html; http://www.kb.cert.org/vuls/id/495705; http://www.securityfocus.com/bid/7203
CVE: CVE-2002-1630
Published: 2002-12-31
Description: The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/717827; http://www.kb.cert.org/vuls/id/SVIM-576QLZ; http://www.nextgenss.com/papers/hpoas.pdf
CVE: CVE-2002-1631
Published: 2002-12-31
Description: SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/717827; http://www.kb.cert.org/vuls/id/SVIM-576QLZ; http://www.nextgenss.com/papers/hpoas.pdf
CVE: CVE-2002-1632
Published: 2002-12-31
Description: Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.
CVSS Score: 6.4 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/717827; http://www.kb.cert.org/vuls/id/SVIM-576QLZ; http://www.nextgenss.com/papers/hpoas.pdf
CVE: CVE-2002-1633
Published: 2002-12-31
Description: Multiple buffer overflows in QNX 4.25 may allow local users to execute arbitrary code via long command line arguments to (1) sample, (2) ex, (3) du, (4) find, (5) lex, (6) mkdir, (7) rm, (8) serserv, (9) tcpserv, (10) termdef, (11) time, (12) unzip, (13) use, (14) wcc, (15) wcc386, (16) wd, (17) wdisasm, (18) which, (19) wlib, (20) wlink, (21) wpp, (22) wpp386, (23) wprof, (24) write, or (25) wstrip.
CVSS Score: 4.6 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/879386; http://www.securityfocus.com/archive/1/276553; http://www.securityfocus.com/bid/5000
CVE: CVE-2002-1634
Published: 2002-12-31
Description: Novell NetWare 5.1 installs sample applications that allow remote attackers to obtain sensitive information via (1) ndsobj.nlm, (2) allfield.jse, (3) websinfo.bas, (4) ndslogin.pl, (5) volscgi.pl, (6) lancgi.pl, (7) test.jse, or (8) env.pl.
CVSS Score: 5.0 (MEDIUM)
References: http://support.novell.com/cgi-bin/search/searchtid.cgi?/10064452.htm; http://www.kb.cert.org/vuls/id/159203; http://www.osvdb.org/17461
CVE: CVE-2002-1635
Published: 2002-12-31
Description: The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/936507; http://www.nextgenss.com/papers/hpoas.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/10716
CVE: CVE-2002-1636
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web script or HTML via the cbuf parameter to htp.print.
CVSS Score: 4.3 (MEDIUM)
References: http://www.nextgenss.com/papers/hpoas.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/10687; http://www.nextgenss.com/papers/hpoas.pdf
CVE: CVE-2002-1646
Published: 2002-12-31
Description: SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0204.html; http://www.ciac.org/ciac/bulletins/m-081.shtml; http://www.kb.cert.org/vuls/id/341187
CVE: CVE-2002-1647
Published: 2002-12-31
Description: The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3241&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7930&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0237&w=2
CVE: CVE-2002-1648
Published: 2002-12-31
Description: Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified send_to and subject parameters.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0310.html; http://www.kb.cert.org/vuls/id/153043; http://www.securityfocus.com/bid/3956
CVE: CVE-2002-1649
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0310.html; http://www.kb.cert.org/vuls/id/153043; http://www.securityfocus.com/bid/3956
CVE: CVE-2002-1650
Published: 2002-12-31
Description: The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0296.html; http://archives.neohapsis.com/archives/bugtraq/2002-01/0306.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/7990
CVE: CVE-2002-1651
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients, possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/636431; http://www.securityfocus.com/bid/5102; https://exchange.xforce.ibmcloud.com/vulnerabilities/9441
CVE: CVE-2002-1652
Published: 2002-12-31
Description: Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long query parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1002395; http://www.kb.cert.org/vuls/id/185251; http://www.securiteam.com/exploits/5TP0W005FE.html
CVE: CVE-2002-1653
Published: 2002-12-31
Description: Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encryption despite intended configuration, and may allow remote attackers to sniff sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/165099; http://www.securityfocus.com/bid/8431; https://exchange.xforce.ibmcloud.com/vulnerabilities/10618
CVE: CVE-2002-1654
Published: 2002-12-31
Description: iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection.
CVSS Score: 7.5 (HIGH)
References: http://lists.virus.org/vulnwatch-0201/msg00008.html; http://securitytracker.com/id?1003157; http://www.kb.cert.org/vuls/id/985347