deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-0077
Published: 2002-01-13
Description: Microsoft Internet Explorer 5.01, 5.5 and 6.0 treats objects invoked on an HTML page with the codebase property as part of Local Computer zone, which allows remote attackers to invoke executables present on the local system through objects such as the popup object, aka the "Local Executable Invocation via Object tag" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1920&w=2; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-015; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1920&w=2
CVE: CVE-1999-1081
Published: 2002-01-15
Description: Vulnerability in files.pl script in Novell WebServer Examples Toolkit 2 allows remote attackers to read arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://www.roxanne.org/faqs/www-secure/wwwsf4.html#Q35; http://www.w3.org/Security/Faq/wwwsf8.html#Q87; https://exchange.xforce.ibmcloud.com/vulnerabilities/2054
CVE: CVE-1999-1091
Published: 2002-01-15
Description: UNIX news readers tin and rtin create the /tmp/.tin_log file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of files writable by the user via a symlink attack.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9835&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9839&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0726&w=2
CVE: CVE-2001-0887
Published: 2002-01-15
Description: xSANE 0.81 and earlier allows local users to modify files of other xSANE users via a symlink attack on temporary files.
CVSS Score: 1.2 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2001-171.html; http://www.redhat.com/support/errata/RHSA-2001-172.html; http://www.securityfocus.com/advisories/3734
CVE: CVE-2001-1457
Published: 2002-01-30
Description: Buffer overflow in CrazyWWWBoard 2000p4 and 2000LEp5 allows remote attackers to execute arbitrary code via a long HTTP_USER_AGENT CGI environment variable.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/229955; http://www.securityfocus.com/archive/1/173050; https://exchange.xforce.ibmcloud.com/vulnerabilities/10110
CVE: CVE-2001-0891
Published: 2002-01-31
Description: Format string vulnerability in NQS daemon (nqsdaemon) in NQE 3.3.0.16 for CRAY UNICOS and SGI IRIX allows a local user to gain root privileges by using qsub to submit a batch job whose name contains formatting characters.
CVSS Score: 7.2 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20020101-01-I; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3924&w=2; http://www.osvdb.org/3275
CVE: CVE-2002-0002
Published: 2002-01-31
Description: Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=stunnel-users&m=[PII_REDACTED]8705&w=2; http://online.securityfocus.com/archive/1/247427; http://online.securityfocus.com/archive/1/248149
CVE: CVE-2002-0005
Published: 2002-01-31
Description: Buffer overflow in AOL Instant Messenger (AIM) 4.7.2480, 4.8.2616, and other versions allows remote attackers to execute arbitrary code via a long argument in a game request (AddGame).
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]2885&w=2; http://www.kb.cert.org/vuls/id/907819; http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0201&L=ntbugtraq&F=P&S=&P=198
CVE: CVE-2002-0007
Published: 2002-01-31
Description: CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which causes a null password to be sent to the LDAP server.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html; http://bugzilla.mozilla.org/show_bug.cgi?id=54901; http://rhn.redhat.com/errata/RHSA-2002-001.html
CVE: CVE-2002-0008
Published: 2002-01-31
Description: Bugzilla before 2.14.1 allows remote attackers to (1) spoof a user comment via an HTTP request to process_bug.cgi using the "who" parameter, instead of the Bugzilla_login cookie, or (2) post a bug as another user by modifying the reporter parameter to enter_bug.cgi, which is passed to post_bug.cgi.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html; http://bugzilla.mozilla.org/show_bug.cgi?id=108385; http://bugzilla.mozilla.org/show_bug.cgi?id=108516
CVE: CVE-2002-0009
Published: 2002-01-31
Description: show_bug.cgi in Bugzilla before 2.14.1 allows a user with "Bugs Access" privileges to see other products that are not accessible to the user, by submitting a bug and reading the resulting Product pulldown menu.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html; http://bugzilla.mozilla.org/show_bug.cgi?id=102141; http://rhn.redhat.com/errata/RHSA-2002-001.html
CVE: CVE-2002-0010
Published: 2002-01-31
Description: Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html; http://archives.neohapsis.com/archives/bugtraq/2002-01/0052.html; http://bugzilla.mozilla.org/show_bug.cgi?id=108812
CVE: CVE-2002-0011
Published: 2002-01-31
Description: Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html; http://bugzilla.mozilla.org/show_bug.cgi?id=98146; http://rhn.redhat.com/errata/RHSA-2002-001.html
CVE: CVE-2002-0038
Published: 2002-01-31
Description: Vulnerability in the cache-limiting function of the unified name service daemon (nsd) in IRIX 6.5.4 through 6.5.11 allows remote attackers to cause a denial of service by forcing the cache to fill the disk.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20020102-01-I; ftp://patches.sgi.com/support/free/security/advisories/20020102-02-I; ftp://patches.sgi.com/support/free/security/advisories/20020102-03-P
CVE: CVE-2002-0043
Published: 2002-01-31
Description: sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000451; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:003
CVE: CVE-2002-0044
Published: 2002-01-31
Description: GNU Enscript 1.6.1 and earlier allows local users to overwrite arbitrary files of the Enscript user via a symlink attack on temporary files.
CVSS Score: 3.6 (LOW)
References: http://www.debian.org/security/2002/dsa-105; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-010.php3; http://www.redhat.com/support/errata/RHSA-2002-012.html
CVE: CVE-2002-0045
Published: 2002-01-31
Description: slapd in OpenLDAP 2.0 through 2.0.19 allows local users, and anonymous users before 2.0.8, to conduct a "replace" action on access controls without any values, which causes OpenLDAP to delete non-mandatory attributes that would otherwise be protected by ACLs.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-001.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000459; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:013
CVE: CVE-2002-0046
Published: 2002-01-31
Description: Linux kernel, and possibly other operating systems, allows remote attackers to read portions of memory via a series of fragmented ICMP packets that generate an ICMP TTL Exceeded response, which includes portions of the memory in the response packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/5394; http://www.redhat.com/support/errata/RHSA-2002-007.html; http://www.securityfocus.com/archive/1/251418
CVE: CVE-2002-0047
Published: 2002-01-31
Description: CIPE VPN package before 1.3.0-3 allows remote attackers to cause a denial of service (crash) via a short malformed packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2002/dsa-104; http://www.redhat.com/support/errata/RHSA-2002-007.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/7883
CVE: CVE-2001-1371
Published: 2002-02-06
Description: The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7562&w=2; http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html
CVE: CVE-2001-1372
Published: 2002-02-06
Description: Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4021&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5473&w=2; http://otn.oracle.com/deploy/security/pdf/jspexecute_alert.pdf
CVE: CVE-2002-1601
Published: 2002-02-09
Description: The Connectables feature in Adobe PhotoDeluxe 3.1 prepends the Adobe directory to the CLASSPATH environment variable, which allows applets to run with higher privileges and remote attackers to gain privileges via an HTML e-mail message or a web page.
CVSS Score: 5.1 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/116875; http://www.kb.cert.org/vuls/id/AAMN-56LQ2J; http://www.securityfocus.com/bid/4106
CVE: CVE-2001-1058
Published: 2002-02-13
Description: The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to bypass access control (specified by the -restrict argument) and steal a license via a client request that includes the name of a host that is allowed to obtain the license.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/200462; http://www.securityfocus.com/bid/3118; https://exchange.xforce.ibmcloud.com/vulnerabilities/6927
CVE: CVE-2001-1079
Published: 2002-02-13
Description: create_keyfiles in PSSP 3.2 with DCE 3.1 authentication on AIX creates keyfile directories with world-writable permissions, which could allow a local user to delete key files and cause a denial of service.
CVSS Score: 3.6 (LOW)
References: http://archives.neohapsis.com/archives/aix/2001-q3/0000.html; http://www.osvdb.org/5473; https://exchange.xforce.ibmcloud.com/vulnerabilities/8923
CVE: CVE-2002-0012
Published: 2002-02-13
Description: Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite.  NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor.  This and other SNMP-related candidates will be updated when more accurate information is available.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: ftp://patches.sgi.com/support/free/security/advisories/20020201-01-A; http://www.cert.org/advisories/CA-2002-03.html; http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html
CVE: CVE-2002-0013
Published: 2002-02-13
Description: Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite.  NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor.  This and other SNMP-related candidates will be updated when more accurate information is available.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: ftp://patches.sgi.com/support/free/security/advisories/20020201-01-A; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57404-1; http://www.cert.org/advisories/CA-2002-03.html
CVE: CVE-2002-1603
Published: 2002-02-13
Description: GoAhead Web Server 2.1.7 and earlier allows remote attackers to obtain the source code of ASP files via a URL terminated with a /, \, %2f (encoded /), %20 (encoded space), or %00 (encoded null) character, which returns the ASP source code unparsed.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/goahead-adv3.txt; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#bug-with-urls-like-asp; http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729
CVE: CVE-2001-1465
Published: 2002-02-26
Description: SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filtering by fragmenting packets so that no packet contains both data elements.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1001801; http://www.kb.cert.org/vuls/id/139315; http://securitytracker.com/id?1001801
CVE: CVE-2002-1637
Published: 2002-02-26
Description: Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/712723; http://www.nextgenss.com/papers/hpoas.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/968
CVE: CVE-2002-0001
Published: 2002-02-27
Description: Vulnerability in RFC822 address parser in mutt before 1.2.5.1 and mutt 1.3.x before 1.3.25 allows remote attackers to execute arbitrary commands via an improperly terminated comment or phrase in the address list.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-002.0.txt; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:04.mutt.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000449
CVE: CVE-2002-0003
Published: 2002-02-27
Description: Buffer overflow in the preprocessor in groff 1.16 and earlier allows remote attackers to gain privileges via lpd in the LPRng printing system.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/advisories/3793; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-012.php; http://www.redhat.com/support/errata/RHSA-2002-004.html
CVE: CVE-2002-0004
Published: 2002-02-27
Description: Heap corruption vulnerability in the "at" program allows local users to execute arbitrary code via a malformed execution time, which causes at to free the same memory twice.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2088&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1031&w=2; http://online.securityfocus.com/advisories/3833
CVE: CVE-2002-0028
Published: 2002-02-27
Description: Buffer overflow in ICQ before 2001B Beta v5.18 Build #3659 allows remote attackers to execute arbitrary code via a Voice Video & Games request.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7851&w=2; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]6401&w=2; http://www.cert.org/advisories/CA-2002-02.html
CVE: CVE-2002-0048
Published: 2002-02-27
Description: Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:10.rsync.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000458; http://lists.suse.com/archives/suse-security-announce/2002-Jan/0003.html
CVE: CVE-2001-1376
Published: 2002-03-04
Description: Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1792&w=2
CVE: CVE-2001-1377
Published: 2002-03-04
Description: Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:02.asc; http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466
CVE: CVE-2002-0018
Published: 2002-03-08
Description: In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/bid/3997; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-001; https://exchange.xforce.ibmcloud.com/vulnerabilities/8023
CVE: CVE-2002-0020
Published: 2002-03-08
Description: Buffer overflow in telnet server in Windows 2000 and Interix 2.2 allows remote attackers to execute arbitrary code via malformed protocol options.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/8094.php; http://www.securityfocus.com/bid/4061; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-004
CVE: CVE-2002-0021
Published: 2002-03-08
Description: Network Product Identification (PID) Checker in Microsoft Office v. X for Mac allows remote attackers to cause a denial of service (crash) via a malformed product announcement.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/2041; http://www.securityfocus.com/bid/4045; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-002
CVE: CVE-2002-0022
Published: 2002-03-08
Description: Buffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0597&w=2; http://online.securityfocus.com/archive/1/258614; http://www.cert.org/advisories/CA-2002-04.html
CVE: CVE-2002-0023
Published: 2002-03-08
Description: Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0000.html; http://www.osvdb.org/3030; http://www.securityfocus.com/bid/3767
CVE: CVE-2002-0024
Published: 2002-03-08
Description: File Download box in Internet Explorer 5.01, 5.5 and 6.0 allows an attacker to use the Content-Disposition and Content-Type HTML header fields to modify how the name of the file is displayed, which could trick a user into believing that a file is safe to download.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/4087; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-005; http://www.securityfocus.com/bid/4087
CVE: CVE-2002-0025
Published: 2002-03-08
Description: Internet Explorer 5.01, 5.5 and 6.0 does not properly handle the Content-Type HTML header field, which allows remote attackers to modify which application is used to process a document.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/255767; http://www.securityfocus.com/bid/4085; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-005
CVE: CVE-2002-0026
Published: 2002-03-08
Description: Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/4082; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-005; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12
CVE: CVE-2002-0027
Published: 2002-03-08
Description: Internet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the address bar by using the Document.open function to pass information between two frames from different domains, a new variant of the "Frame Domain Verification" vulnerability described in MS:MS01-058/CAN-2001-0874.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/3031; http://www.securityfocus.com/archive/1/246522; http://www.securityfocus.com/bid/3721
CVE: CVE-2002-0049
Published: 2002-03-08
Description: Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269
References: http://www.osvdb.org/2042; http://www.securityfocus.com/bid/4053; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-003
CVE: CVE-2002-0050
Published: 2002-03-08
Description: Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 allows remote attackers to execute arbitrary code via long authentication data.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/4157; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-010; http://www.securityfocus.com/bid/4157
CVE: CVE-2002-0052
Published: 2002-03-08
Description: Internet Explorer 6.0 and earlier does not properly handle VBScript in certain domain security checks, which allows remote attackers to read arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1003630; http://www.osvdb.org/763; http://www.securityfocus.com/bid/4158
CVE: CVE-2002-0053
Published: 2002-03-08
Description: Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request.  NOTE: this candidate may be split or merged with other candidates.  This and other PROTOS-related candidates, especially CVE-2002-0012 and CVE-2002-0013, will be updated when more accurate information is available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0012; http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0013; http://www.cert.org/advisories/CA-2002-03.html
CVE: CVE-2002-0054
Published: 2002-03-08
Description: SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9373&w=2; http://www.securityfocus.com/bid/4205; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-011