deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-0353
Published: 2002-06-25
Description: The ASN.1 parser in Ethereal 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a certain malformed packet, which causes Ethereal to allocate memory incorrectly, possibly due to zero-length fields.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000474; http://www.debian.org/security/2002/dsa-130; http://www.ethereal.com/appnotes/enpa-sa-00003.html
CVE: CVE-2002-0354
Published: 2002-06-25
Description: The XMLHttpRequest object (XMLHTTP) in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories on a client system by opening a URL that redirects the browser to the file on the client, then reading the result using the responseText property.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4097&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]8766&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4097&w=2
CVE: CVE-2002-0360
Published: 2002-06-25
Description: Buffer overflow in Sun AnswerBook2 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5064&w=2; http://marc.info/?l=vulnwatch&m=[PII_REDACTED]9450&w=2; http://www.eSecurityOnline.com/advisories/eSO5063.asp
CVE: CVE-2002-0367
Published: 2002-06-25
Description: smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]2695&w=2; http://www.iss.net/security_center/static/8462.php; http://www.securityfocus.com/archive/1/262074
CVE: CVE-2002-0379
Published: 2002-06-25
Description: Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 support, and imapd 2000.287 and earlier, allows remote authenticated users to execute arbitrary code via a long BODY request.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-021.0.txt; http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000487; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0529&w=2
CVE: CVE-2002-0381
Published: 2002-06-25
Description: The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20030604-01-I; http://cvsweb.netbsd.org/bsdweb.cgi/syssrc/sys/netinet/tcp_input.c.diff?r1=1.136&r2=1.137; http://online.securityfocus.com/archive/1/262733
CVE: CVE-2002-0382
Published: 2002-06-25
Description: XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000526; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5490&w=2; http://www.iss.net/security_center/static/8704.php
CVE: CVE-2002-0186
Published: 2002-07-03
Description: Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension."
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0100.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0856&w=2; http://www.iss.net/security_center/static/9328.php
CVE: CVE-2002-0187
Published: 2002-07-03
Description: Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query, aka "Script Injection via XML Tag."
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0100.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0856&w=2; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-030
CVE: CVE-2002-0359
Published: 2002-07-03
Description: xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, which allows remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems, to gain root privileges.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9825&w=2; http://www.iss.net/security_center/static/9401.php
CVE: CVE-2002-0364
Published: 2002-07-03
Description: Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0099.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5962&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]8100&w=2
CVE: CVE-2002-0366
Published: 2002-07-03
Description: Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/276776; http://online.securityfocus.com/archive/1/278145; http://www.nextgenss.com/vna/ms-ras.txt
CVE: CVE-2002-0371
Published: 2002-07-03
Description: Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7940&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7618&w=2; http://online.securityfocus.com/archive/1/276848
CVE: CVE-2002-0372
Published: 2002-07-03
Description: Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player".
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9420.php; http://www.securityfocus.com/bid/5107; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-032
CVE: CVE-2002-0373
Published: 2002-07-03
Description: The Windows Media Device Manager (WMDM) Service in Microsoft Windows Media Player 7.1 on Windows 2000 systems allows local users to obtain LocalSystem rights via a program that calls the WMDM service to connect to an invalid local storage device, aka "Privilege Elevation through Windows Media Device Manager Service".
CVSS Score: 7.2 (HIGH)
References: http://www.iss.net/security_center/static/9421.php; http://www.securityfocus.com/bid/5109; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-032
CVE: CVE-2002-0378
Published: 2002-07-03
Description: The default configuration of LPRng print spooler in Red Hat Linux 7.0 through 7.3, Mandrake 8.1 and 8.2, and other operating systems, accepts print jobs from arbitrary remote hosts.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/advisories/4205; http://www.iss.net/security_center/static/9322.php; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-042.php
CVE: CVE-2002-0392
Published: 2002-07-03
Description: Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt; ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32; ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31
CVE: CVE-2002-0535
Published: 2002-07-03
Description: Cross-site scripting vulnerabilities in PostBoard 2.0.1 and earlier allows remote attackers to execute script as other users via (1) an [IMG] tag when BBCode is enabled, or (2) in a topic title.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/267936; http://www.iss.net/security_center/static/8881.php; http://www.securityfocus.com/bid/4559
CVE: CVE-2002-0536
Published: 2002-07-03
Description: PHPGroupware 0.9.12 and earlier, when running with the magic_quotes_gpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0036.html; http://archives.neohapsis.com/archives/bugtraq/2002-04/0143.html; http://www.iss.net/security_center/static/8755.php
CVE: CVE-2002-0537
Published: 2002-07-03
Description: The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, which allows remote attackers who can access the admin.html file to gain administrative privileges to SWS.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0148.html; http://www.iss.net/security_center/static/8849.php; http://www.securityfocus.com/bid/4503
CVE: CVE-2002-0538
Published: 2002-07-03
Description: FTP proxy in Symantec Raptor Firewall 6.5.3 and Enterprise 7.0 rewrites an FTP server's "FTP PORT" responses in a way that allows remote attackers to redirect FTP data connections to arbitrary ports, a variant of the "FTP bounce" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0166.html; http://archives.neohapsis.com/archives/bugtraq/2002-04/0224.html; http://securityresponse.symantec.com/avcenter/security/Content/2002.04.17.html
CVE: CVE-2002-0539
Published: 2002-07-03
Description: Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the s_key cookie.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0168.html; http://online.securityfocus.com/archive/1/267941; http://www.iss.net/security_center/static/8854.php
CVE: CVE-2002-0540
Published: 2002-07-03
Description: Nortel CVX 1800 is installed with a default "public" community string, which allows remote attackers to read usernames and passwords and modify the CVX configuration.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0272.html; http://online.securityfocus.com/archive/1/267627; http://www.iss.net/security_center/static/8848.php
CVE: CVE-2002-0541
Published: 2002-07-03
Description: Buffer overflow in Tivoli Storage Manager TSM (1) Server or Storage Agents 3.1 through 5.1, and (2) the TSM Client Acceptor Service 4.2 and 5.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 1580 or port 1581.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0126.html; http://online.securityfocus.com/archive/1/267143; http://www.iss.net/security_center/static/8817.php
CVE: CVE-2002-0542
Published: 2002-07-03
Description: mail in OpenBSD 2.9 and 3.0 processes a tilde (~) escape character in a message even when it is not in interactive mode, which could allow local users to gain root privileges via calls to mail in cron.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1695&w=2; http://online.securityfocus.com/archive/1/267089; http://www.iss.net/security_center/static/8818.php
CVE: CVE-2002-0543
Published: 2002-07-03
Description: Directory traversal vulnerability in Aprelium Abyss Web Server (abyssws) before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. (dot dot) sequences in the HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0110.html; http://www.aprelium.com/forum/viewtopic.php?t=24; http://www.iss.net/security_center/static/8805.php
CVE: CVE-2002-0544
Published: 2002-07-03
Description: Aprelium Abyss Web Server (abyssws) before 1.0.3 stores the administrative console password in plaintext in the abyss.conf file, which allows local users with access to the file to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://www.aprelium.com/news/abws103.html; http://www.securityfocus.com/bid/4467; http://www.aprelium.com/news/abws103.html
CVE: CVE-2002-0545
Published: 2002-07-03
Description: Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts with invalid usernames and passwords.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/Aironet-Telnet.shtml; http://www.iss.net/security_center/static/8788.php; http://www.securityfocus.com/bid/4461
CVE: CVE-2002-0546
Published: 2002-07-03
Description: Cross-site scripting vulnerability in the mini-browser for Winamp 2.78 and 2.79 allows remote attackers to execute script via an ID3v1 or ID3v2 tag in an MP3 file.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0026.html; http://archives.neohapsis.com/archives/bugtraq/2002-04/0049.html; http://www.iss.net/security_center/static/8753.php
CVE: CVE-2002-0547
Published: 2002-07-03
Description: Buffer overflow in the mini-browser for Winamp 2.79 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the title field of an ID3v2 tag.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0373.html; http://www.iss.net/security_center/static/8946.php; http://www.securityfocus.com/bid/4609
CVE: CVE-2002-0548
Published: 2002-07-03
Description: Anthill allows remote attackers to bypass authentication and file bug reports by directly accessing the postbug.php program instead of enterbug.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0089.html; http://www.iss.net/security_center/static/8771.php; http://www.securityfocus.com/bid/4443
CVE: CVE-2002-0549
Published: 2002-07-03
Description: Cross-site scripting vulnerabilities in Anthill allow remote attackers to execute script as other Anthill users.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0089.html; http://www.iss.net/security_center/static/8770.php; http://www.securityfocus.com/bid/4442
CVE: CVE-2002-0550
Published: 2002-07-03
Description: Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0052.html; http://www.iss.net/security_center/static/8762.php; http://www.securityfocus.com/bid/4423
CVE: CVE-2002-0551
Published: 2002-07-03
Description: Cross-site scripting vulnerability in Dynamic Guestbook 3.0 allows remote attackers to execute code in clients who access guestbook pages via the parameters (1) name, (2) mail, or (3) kommentar.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0052.html; http://www.iss.net/security_center/static/8763.php; http://www.securityfocus.com/bid/4422
CVE: CVE-2002-0552
Published: 2002-07-03
Description: Multiple buffer overflows in Melange Chat server 2.02 allow remote or local attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a long argument in the /yell command, (2) long lines in the /etc/melange.conf configuration file, (3) long file names, or possibly other attacks.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0157.html; http://online.securityfocus.com/archive/1/267932; http://www.iss.net/security_center/static/8842.php
CVE: CVE-2002-0553
Published: 2002-07-03
Description: Cross-site scripting vulnerability in SunShop 2.5 and earlier allows remote attackers to gain administrative privileges to SunShop by injecting the script into fields during new customer registration.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0154.html; http://www.iss.net/security_center/static/8840.php; http://www.securityfocus.com/bid/4506
CVE: CVE-2002-0554
Published: 2002-07-03
Description: webdriver in IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injection attack in an HTTP request.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0135.html; http://www.iss.net/security_center/static/8826.php; http://www.securityfocus.com/bid/4496
CVE: CVE-2002-0555
Published: 2002-07-03
Description: IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQL code in a web form even when the developer has attempted to escape it.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0137.html; http://www.iss.net/security_center/static/8827.php; http://www.securityfocus.com/bid/4498
CVE: CVE-2002-0556
Published: 2002-07-03
Description: Directory traversal vulnerability in Quik-Serv HTTP server 1.1B allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0051.html; http://www.iss.net/security_center/static/8754.php; http://www.securityfocus.com/bid/4425
CVE: CVE-2002-0557
Published: 2002-07-03
Description: Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes (1) rexec or (2) rsh to run another user's shell, or (3) atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to auth_approval().
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/8625.php; http://www.openbsd.org/errata30.html#approval; http://www.securityfocus.com/bid/4338
CVE: CVE-2002-0558
Published: 2002-07-03
Description: Directory traversal vulnerability in TYPSoft FTP server 0.97.1 and earlier allows a remote authenticated user (possibly anonymous) to list arbitrary directories via a .. in a LIST (ls) command ending in wildcard *.* characters.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0090.html; http://www.iss.net/security_center/static/6165.php; http://www.securityfocus.com/bid/2489
CVE: CVE-2002-0559
Published: 2002-07-03
Description: Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which overflows the resulting HTTP Location header, (2) a long HTTP request to the plsql module, (3) a long password in the HTTP Authorization, (4) a long Access Descriptor (DAD) password in the addadd form, or (5) a long cache directory name.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/254426; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html
CVE: CVE-2002-0560
Published: 2002-07-03
Description: PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA_UTIL stored procedures (1) OWA_UTIL.signature, (2) OWA_UTIL.listprint, or (3) OWA_UTIL.show_query_columns.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7562&w=2; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html
CVE: CVE-2002-0561
Published: 2002-07-03
Description: The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7562&w=2; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html
CVE: CVE-2002-0562
Published: 2002-07-03
Description: The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5580&w=2; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html
CVE: CVE-2002-0563
Published: 2002-07-03
Description: The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7562&w=2; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://securitytracker.com/id?1009167
CVE: CVE-2002-0564
Published: 2002-07-03
Description: PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to reference an alternate DAD that already has valid credentials.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7562&w=2; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html
CVE: CVE-2002-0565
Published: 2002-07-03
Description: Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5580&w=2; http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html
CVE: CVE-2002-0566
Published: 2002-07-03
Description: PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Authorization header without an authentication type.
CVSS Score: 5.0 (MEDIUM)
References: http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html; http://www.kb.cert.org/vuls/id/805915
CVE: CVE-2002-0567
Published: 2002-07-03
Description: Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrary functions by using the TNS Listener to directly connect to the EXTPROC process.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2079&w=2; http://otn.oracle.com/deploy/security/pdf/plsextproc_alert.pdf; http://www.cert.org/advisories/CA-2002-08.html