deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-0725
Published: 2002-09-05
Description: NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.atstake.com/research/advisories/2000/a081602-1.txt; http://www.iss.net/security_center/static/9869.php; http://www.securityfocus.com/bid/5484
CVE: CVE-2002-0851
Published: 2002-09-05
Description: Format string vulnerability in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the ISDN4Linux (i4l) package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0068.html; http://www.iss.net/security_center/static/9811.php; http://www.securityfocus.com/bid/5437
CVE: CVE-2002-0852
Published: 2002-09-05
Description: Buffer overflows in Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service via (1) an Internet Key Exchange (IKE) with a large Security Parameter Index (SPI) payload, or (2) an IKE packet with a large number of valid payloads.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml; http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml
CVE: CVE-2002-0853
Published: 2002-09-05
Description: Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/9821.php; http://www.kb.cert.org/vuls/id/287771
CVE: CVE-2002-0854
Published: 2002-09-05
Description: Buffer overflows in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the i4l package on SuSE 7.3, 8.0, and possibly other operating systems, may allow local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: https://lists.opensuse.org/opensuse-security-announce/2002-08/msg00006.html; https://lists.opensuse.org/opensuse-security-announce/2002-08/msg00006.html
CVE: CVE-2002-0855
Published: 2002-09-05
Description: Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0268.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000522; http://mail.python.org/pipermail/mailman-announce/2002-July/000043.html
CVE: CVE-2002-0856
Published: 2002-09-05
Description: SQL*NET listener for Oracle Net Oracle9i 9.0.x and 9.2 allows remote attackers to cause a denial of service (crash) via certain debug requests that are not properly handled by the debugging feature.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0072.html; http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20941; http://otn.oracle.com/deploy/security/pdf/2002alert38rev1.pdf
CVE: CVE-2002-0857
Published: 2002-09-05
Description: Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6634&w=2; http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf; http://securitytracker.com/id?1005037
CVE: CVE-2002-0858
Published: 2002-09-05
Description: catsnmp in Oracle 9i and 8i is installed with a dbsnmp user with a default dbsnmp password, which allows attackers to perform restricted database operations and possibly gain other privileges.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2808&w=2; http://www.iss.net/security_center/static/9932.php; http://www.osvdb.org/9476
CVE: CVE-2002-0859
Published: 2002-09-05
Description: Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0081&w=2; http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ282010; http://www.iss.net/security_center/static/9375.php
CVE: CVE-2002-0870
Published: 2002-09-05
Description: The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through the interface, possibly via a variant of the original attack, as identified by Cisco bug ID CSCdw08549.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/arrowpoint-webmgmt-vuln-pub.shtml; http://www.cisco.com/warp/public/707/arrowpoint-webmgmt-vuln-pub.shtml
CVE: CVE-2002-0871
Published: 2002-09-05
Description: xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6155&w=2; http://www.iss.net/security_center/static/9844.php; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-053.php
CVE: CVE-2002-0872
Published: 2002-09-05
Description: l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2002/dsa-152; http://www.iss.net/security_center/static/9845.php; http://www.securityfocus.com/bid/5451
CVE: CVE-2002-0873
Published: 2002-09-05
Description: Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attribute/value pair, possibly via a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2002/dsa-152; http://www.iss.net/security_center/static/10460.php; http://www.debian.org/security/2002/dsa-152
CVE: CVE-2002-0874
Published: 2002-09-05
Description: Vulnerability in Interchange 4.8.6, 4.8.3, and other versions, when running in INET mode, allows remote attackers to read arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2002/dsa-150; http://www.debian.org/security/2002/dsa-150
CVE: CVE-2002-0875
Published: 2002-09-05
Description: Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to the root group.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc; ftp://patches.sgi.com/support/free/security/advisories/20000301-03-I; http://www.debian.org/security/2002/dsa-154
CVE: CVE-2002-1614
Published: 2002-09-09
Description: Buffer overflow in HP Tru64 UNIX allows local users to execute arbitrary code via a long argument to /usr/bin/at.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html; http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html; http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11
CVE: CVE-2002-1613
Published: 2002-09-10
Description: Buffer overflow in ps in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11; http://www.kb.cert.org/vuls/id/173977; https://exchange.xforce.ibmcloud.com/vulnerabilities/10016
CVE: CVE-2002-1612
Published: 2002-09-13
Description: Buffer overflow in mailcv in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://ftp.support.compaq.com.au/pub/patches/Digital_UNIX/v5.1a/patch_kit/Tru64_UNIX_V5.1A/doc/txt/OSFPAT[PII_REDACTED]0.txt; http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11; http://www.kb.cert.org/vuls/id/408771
CVE: CVE-2002-1615
Published: 2002-09-13
Description: Multiple buffer overflows in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allow local users to execute arbitrary code via (1) msgchk or (2) .upd..loader.
CVSS Score: 7.2 (HIGH)
References: http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?source=SRB0039W.xml&dt=11; http://www.kb.cert.org/vuls/id/506441; https://exchange.xforce.ibmcloud.com/vulnerabilities/10016
CVE: CVE-2002-0376
Published: 2002-09-24
Description: Buffer overflow in Apple QuickTime 5.0 ActiveX component allows remote attackers to execute arbitrary code via a long pluginspage field.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/293095; http://www.atstake.com/research/advisories/2002/a091002-1.txt; http://www.iss.net/security_center/static/10077.php
CVE: CVE-2002-0647
Published: 2002-09-24
Description: Buffer overflow in a legacy ActiveX control used to display specially formatted text in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code, aka "Buffer Overrun in Legacy Text Formatting ActiveX Control".
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9935.php; http://www.securityfocus.com/bid/5558; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-047
CVE: CVE-2002-0648
Published: 2002-09-24
Description: The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4314&w=2; http://www.iss.net/security_center/static/9936.php; http://www.securityfocus.com/bid/5560
CVE: CVE-2002-0691
Published: 2002-09-24
Description: Microsoft Internet Explorer 5.01 and 5.5 allows remote attackers to execute scripts in the Local Computer zone via a URL that references a local HTML resource file, a variant of "Cross-Site Scripting in Local HTML Resource" as identified by CAN-2002-0189.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9938.php; http://www.securityfocus.com/bid/5561; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-047
CVE: CVE-2002-0722
Published: 2002-09-24
Description: Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to misrepresent the source of a file in the File Download dialogue box to trick users into thinking that the file type is safe to download, aka "File Origin Spoofing."
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3380&w=2; http://www.iss.net/security_center/static/9937.php; http://www.osvdb.org/5129
CVE: CVE-2002-0723
Published: 2002-09-24
Description: Microsoft Internet Explorer 5.5 and 6.0 does not properly verify the domain of a frame within a browser window, which allows remote attackers to read client files or invoke executable objects via the Object tag, aka "Cross Domain Verification in Object Tag."
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9537.php; http://www.securityfocus.com/bid/5196; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-047
CVE: CVE-2002-0724
Published: 2002-09-24
Description: Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka "Unchecked Buffer in Network Share Provider Can Lead to Denial of Service".
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3184&w=2; http://www.kb.cert.org/vuls/id/250635; http://www.kb.cert.org/vuls/id/311619
CVE: CVE-2002-0726
Published: 2002-09-24
Description: Buffer overflow in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to execute arbitrary code via a long server name field.
CVSS Score: 7.5 (HIGH)
References: http://www.atstake.com/research/advisories/2002/a082802-1.txt; http://www.iss.net/security_center/static/9934.php; http://www.securityfocus.com/bid/5554
CVE: CVE-2002-0727
Published: 2002-09-24
Description: The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via the setTimeout method.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5486&w=2; http://www.iss.net/security_center/static/8777.php; http://www.osvdb.org/3006
CVE: CVE-2002-0834
Published: 2002-09-24
Description: Buffer overflow in the ISIS dissector for Ethereal 0.9.5 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via malformed packets.
CVSS Score: 7.5 (HIGH)
References: http://www.ethereal.com/appnotes/enpa-sa-00006.html; http://www.ethereal.com/appnotes/enpa-sa-00006.html
CVE: CVE-2002-0860
Published: 2002-09-24
Description: The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that redirects to the target file.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8463&w=2; http://www.iss.net/security_center/static/8778.php; http://www.osvdb.org/3007
CVE: CVE-2002-0861
Published: 2002-09-24
Description: Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6346&w=2; http://www.iss.net/security_center/static/8779.php; http://www.securityfocus.com/bid/4457
CVE: CVE-2002-0970
Published: 2002-09-24
Description: The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-047.0.txt; http://archives.neohapsis.com/archives/bugtraq/2002-08/0170.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000519
CVE: CVE-2002-0971
Published: 2002-09-24
Description: Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3085&w=2; http://www.iss.net/security_center/static/9979.php; http://www.securityfocus.com/bid/5530
CVE: CVE-2002-0972
Published: 2002-09-24
Description: Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to the functions (1) lpad or (2) rpad.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0785&w=2; http://secunia.com/advisories/8034; http://www.redhat.com/support/errata/RHSA-2003-001.html
CVE: CVE-2002-0973
Published: 2002-09-24
Description: Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel memory via large negative values to the (1) accept, (2) getsockname, and (3) getpeername system calls, and the (4) vesa FBIO_GETPALETTE ioctl.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8706&w=2; http://www.iss.net/security_center/static/9903.php; http://www.securityfocus.com/bid/5493
CVE: CVE-2002-0974
Published: 2002-09-24
Description: Help and Support Center for Windows XP allows remote attackers to delete arbitrary files via a link to the hcp: protocol that accesses uplddrvinfo.htm.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2077&w=2; http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ328940; http://www.iss.net/security_center/static/9878.php
CVE: CVE-2002-0975
Published: 2002-09-24
Description: Buffer overflow in Microsoft DirectX Files Viewer ActiveX control (xweb.ocx) 2.0.6.15 and earlier allows remote attackers to execute arbitrary via a long File parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5859&w=2; http://www.iss.net/security_center/static/9877.php; http://www.securityfocus.com/bid/5489
CVE: CVE-2002-0976
Published: 2002-09-24
Description: Internet Explorer 4.0 and later allows remote attackers to read arbitrary files via a web page that accesses a legacy XML Datasource applet (com.ms.xml.dso.XMLDSO.class) and modifies the base URL to point to the local system, which is trusted by the applet.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5373&w=2; http://www.iss.net/security_center/static/9885.php; http://www.securityfocus.com/bid/5490
CVE: CVE-2002-0977
Published: 2002-09-24
Description: Buffer overflow in Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to execute arbitrary code via a long TS value.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0189.html; http://archives.neohapsis.com/archives/bugtraq/2002-08/0189.html
CVE: CVE-2002-0978
Published: 2002-09-24
Description: Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to upload or download arbitrary files to arbitrary locations via a man-in-the-middle attack with modified TGT and TGN parameters in a call to the "Persist" function.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0189.html; http://archives.neohapsis.com/archives/bugtraq/2002-08/0189.html
CVE: CVE-2002-0979
Published: 2002-09-24
Description: The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a known pathname, which can be used to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7261&w=2; http://www.iss.net/security_center/static/9886.php; http://www.securityfocus.com/bid/5491
CVE: CVE-2002-0980
Published: 2002-09-24
Description: The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message file via a mhtml: URL.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7691&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]7922&w=2; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]1091&w=2
CVE: CVE-2002-0981
Published: 2002-09-24
Description: Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.36/CSSA-2002-SCO.36.txt; http://www.iss.net/security_center/static/9945.php; http://www.securityfocus.com/bid/5551
CVE: CVE-2002-0982
Published: 2002-09-24
Description: Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7360&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7360&w=2
CVE: CVE-2002-0983
Published: 2002-09-24
Description: IRC client irssi in irssi-text before 0.8.4 allows remote attackers to cause a denial of service (crash) via an IRC channel that has a long topic followed by a certain string, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A05.asc; http://www.debian.org/security/2002/dsa-157; http://www.securityfocus.com/bid/5055
CVE: CVE-2002-0984
Published: 2002-09-24
Description: The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0231.html; http://www.debian.org/security/2002/dsa-156; http://www.iss.net/security_center/static/9943.php
CVE: CVE-2002-0985
Published: 2002-09-24
Description: Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-88
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8204&w=2
CVE: CVE-2002-0986
Published: 2002-09-24
Description: The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8204&w=2
CVE: CVE-2002-0987
Published: 2002-09-24
Description: X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which could allow local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.38; http://www.iss.net/security_center/static/9976.php; http://www.osvdb.org/5044
CVE: CVE-2002-0988
Published: 2002-09-24
Description: Buffer overflow in X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1, possibly related to XBM/xkbcomp capabilities.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.38; http://www.iss.net/security_center/static/9977.php; http://www.securityfocus.com/bid/5577
CVE: CVE-2002-0989
Published: 2002-09-24
Description: The URL handler in the manual browser option for Gaim before 0.59.1 allows remote attackers to execute arbitrary script via shell metacharacters in a link.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:06.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=72728; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000521
CVE: CVE-2002-1120
Published: 2002-09-24
Description: Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0112.html; http://www.iss.net/security_center/static/10076.php; http://www.securityfocus.com/bid/5686