deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-0568
Published: 2002-07-03
Description: Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7562&w=2; http://www.cert.org/advisories/CA-2002-08.html; http://www.kb.cert.org/vuls/id/476619
CVE: CVE-2002-0569
Published: 2002-07-03
Description: Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet (XSQLServlet).
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7562&w=2; http://www.cert.org/advisories/CA-2002-08.html; http://www.iss.net/security_center/static/8453.php
CVE: CVE-2002-0570
Published: 2002-07-03
Description: The encrypted loop device in Linux kernel 2.4.10 and earlier does not authenticate the entity that is encrypting data, which allows local users to modify encrypted data without knowing the key.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0010.html; http://www.securityfocus.com/bid/3775; https://exchange.xforce.ibmcloud.com/vulnerabilities/7769
CVE: CVE-2002-0571
Published: 2002-07-03
Description: Oracle Oracle9i database server 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0175.html; http://otn.oracle.com/deploy/security/pdf/sql_joins_alert.pdf; http://www.ciac.org/ciac/bulletins/m-071.shtml
CVE: CVE-2002-0572
Published: 2002-07-03
Description: FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the file descriptors 0 (standard input), 1 (standard output), or 2 (standard error), which may then be reused by a called setuid process that intended to perform I/O on normal files.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc; http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0033.html; http://online.securityfocus.com/archive/1/268970
CVE: CVE-2002-0573
Published: 2002-07-03
Description: Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0049.html; http://online.securityfocus.com/archive/1/270268; http://www.cert.org/advisories/CA-2002-10.html
CVE: CVE-2002-0574
Published: 2002-07-03
Description: Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that trigger a bug in ip_output() in which the reference count for a routing table entry is not decremented, which prevents the entry from being removed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-401
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:21.tcpip.asc; http://www.iss.net/security_center/static/8893.php; http://www.osvdb.org/5232
CVE: CVE-2002-0615
Published: 2002-07-03
Description: The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well known location on the local file system, allowing attackers to execute HTML scripts in the Local Computer zone, aka "Media Playback Script Invocation".
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9422.php; http://www.securityfocus.com/bid/5110; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-032
CVE: CVE-2002-0620
Published: 2002-07-03
Description: Buffer overflow in the Profile Service of Microsoft Commerce Server 2000 allows remote attackers to cause the server to fail or run arbitrary code in the LocalSystem security context via an input field using an affected API.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/4853; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-033; http://www.securityfocus.com/bid/4853
CVE: CVE-2002-0621
Published: 2002-07-03
Description: Buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000 allows remote attackers to cause the process to fail or run arbitrary code in the LocalSystem security context via certain input to the OWC package installer.
CVSS Score: 5.0 (MEDIUM)
References: http://www.iss.net/security_center/static/9424.php; http://www.osvdb.org/5172; http://www.securityfocus.com/bid/5108
CVE: CVE-2002-0622
Published: 2002-07-03
Description: The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer, aka "OWC Package Command Execution".
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9425.php; http://www.osvdb.org/5170; http://www.securityfocus.com/bid/5111
CVE: CVE-2002-0623
Published: 2002-07-03
Description: Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via long authentication data, aka "New Variant of the ISAPI Filter Buffer Overrun".
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9426.php; http://www.osvdb.org/5163; http://www.securityfocus.com/bid/5112
CVE: CVE-2002-0631
Published: 2002-07-03
Description: Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges.
CVSS Score: 7.2 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20020607-02-I; http://www.iss.net/security_center/static/9418.php; http://www.securityfocus.com/bid/5092
CVE: CVE-2002-0639
Published: 2002-07-03
Description: Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt; http://archives.neohapsis.com/archives/bugtraq/2002-06/0335.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502
CVE: CVE-2002-0640
Published: 2002-07-03
Description: Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2793&w=2
CVE: CVE-2002-0651
Published: 2002-07-03
Description: Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.NetBSD.ORG/pub/NetBSD/security/advisories/NetBSD-SA2002-006.txt.asc; ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.39; ftp://ftp.caldera.com/pub/updates/UnixWare/CSSA-2002-SCO.37
CVE: CVE-2002-0652
Published: 2002-07-03
Description: xfsmd for IRIX 6.5 through 6.5.16 allows remote attackers to execute arbitrary code via shell metacharacters that are not properly filtered from several calls to the popen() function, such as export_fs().
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I; ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9825&w=2
CVE: CVE-2002-1448
Published: 2002-07-08
Description: An undocumented SNMP read/write community string ('NoGaH$@!') in Avaya P330, P130, and M770-ATM Cajun products allows remote attackers to gain administrative privileges.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0519.html; http://support.avaya.com/security/Unauthorized_SNMP/index.jhtml; http://www.iss.net/security_center/static/9769.php
CVE: CVE-2002-0637
Published: 2002-07-11
Description: InterScan VirusWall 3.52 build 1462 allows remote attackers to bypass virus protection via e-mail messages with headers that violate RFC specifications by having (or missing) space characters in unexpected places (aka "space gap"), such as (1) Content-Type :", (2) "Content-Transfer-Encoding :", (3) no space before a boundary declaration, or (4) "boundary= ", which is processed by Outlook Express.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9464.php; http://www.securiteam.com/securitynews/5KP000A7QE.html; http://www.iss.net/security_center/static/9464.php
CVE: CVE-2002-0653
Published: 2002-07-11
Description: Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-031.0.txt; http://archives.neohapsis.com/archives/bugtraq/2002-06/0350.html; http://archives.neohapsis.com/archives/hp/2002-q3/0018.html
CVE: CVE-2002-0665
Published: 2002-07-11
Description: Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0133.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7195&w=2; http://www.iss.net/security_center/static/9450.php
CVE: CVE-2002-0676
Published: 2002-07-11
Description: SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning, and supplying Trojan Horse updates.
CVSS Score: 7.5 (HIGH)
References: http://www.cunap.com/~hardingr/projects/osx/exploit.html; http://www.iss.net/security_center/static/9502.php; http://www.osvdb.org/5137
CVE: CVE-2002-0624
Published: 2002-07-23
Description: Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication, aka "Unchecked Buffer in Password Encryption Procedure."
CVSS Score: 7.5 (HIGH)
References: http://www.cert.org/advisories/CA-2002-22.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A291
CVE: CVE-2002-0641
Published: 2002-07-23
Description: Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3746&w=2; http://www.kb.cert.org/vuls/id/682620; http://www.ngssoftware.com/advisories/ms-sqlbi.txt
CVE: CVE-2002-0642
Published: 2002-07-23
Description: The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."
CVSS Score: 7.2 (HIGH)
References: http://www.cert.org/advisories/CA-2002-22.html; http://www.iss.net/security_center/static/9523.php; http://www.kb.cert.org/vuls/id/796313
CVE: CVE-2002-0643
Published: 2002-07-23
Description: The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6731&w=2; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]1103&w=2; http://www.kb.cert.org/vuls/id/338195
CVE: CVE-2002-0667
Published: 2002-07-23
Description: Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain access to the phone.
CVSS Score: 10.0 (HIGH)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.iss.net/security_center/static/9562.php; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE: CVE-2002-0668
Published: 2002-07-23
Description: The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to modify the Call Forwarding settings and hijack calls.
CVSS Score: 7.5 (HIGH)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.osvdb.org/5144; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE: CVE-2002-0670
Published: 2002-07-23
Description: The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, which allows remote attackers to steal and easily decode the passwords via sniffing.
CVSS Score: 7.5 (HIGH)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.iss.net/security_center/static/9565.php; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE: CVE-2002-0671
Published: 2002-07-23
Description: Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.iss.net/security_center/static/9566.php; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE: CVE-2002-0672
Published: 2002-07-23
Description: Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to restore the phone to factory defaults without authentication via a menu option, which sets the administrator password to null.
CVSS Score: 4.6 (MEDIUM)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.iss.net/security_center/static/9567.php; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE: CVE-2002-0673
Published: 2002-07-23
Description: The enrollment process for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to the phone to log out the current user and re-register the phone using MyPingtel Sign-In to gain remote access and perform unauthorized actions.
CVSS Score: 4.6 (MEDIUM)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.iss.net/security_center/static/9568.php; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE: CVE-2002-0674
Published: 2002-07-23
Description: Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not "time out" an inactive administrator session, which could allow other users to perform administrator actions if the administrator does not explicitly end the authentication.
CVSS Score: 7.2 (HIGH)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp; http://www.securityfocus.com/bid/5221
CVE: CVE-2002-0675
Published: 2002-07-23
Description: Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not require administrative privileges to perform a firmware upgrade, which allows unauthorized users to upgrade the phone.
CVSS Score: 4.6 (MEDIUM)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.iss.net/security_center/static/9570.php; http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp
CVE: CVE-2002-0677
Published: 2002-07-23
Description: CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.28/CSSA-2002-SCO.28.txt; ftp://patches.sgi.com/support/free/security/advisories/20021102-02-P; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3617&w=2
CVE: CVE-2002-0678
Published: 2002-07-23
Description: CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.28/CSSA-2002-SCO.28.txt; ftp://patches.sgi.com/support/free/security/advisories/20021101-01-P; http://archives.neohapsis.com/archives/aix/2002-q3/0002.html
CVE: CVE-2002-0680
Published: 2002-07-23
Description: Directory traversal vulnerability in GoAhead Web Server 2.1 allows remote attackers to read arbitrary files via a URL with an encoded / (%5C) in a .. (dot dot) sequence.  NOTE: it is highly likely that this candidate will be REJECTED because it has been reported to be a duplicate of CVE-2001-0228.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0013.html; http://freecode.com/projects/embedthis-goahead-webserver/releases/343539; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1795&w=2
CVE: CVE-2002-0681
Published: 2002-07-23
Description: Cross-site scripting vulnerability in GoAhead Web Server 2.1 allows remote attackers to execute script as other web users via script in a URL that generates a "404 not found" message, which does not quote the script.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0013.html; http://freecode.com/projects/embedthis-goahead-webserver/releases/343539; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1795&w=2
CVE: CVE-2002-0682
Published: 2002-07-23
Description: Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0014.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1297&w=2; http://www.osvdb.org/4973
CVE: CVE-2002-0683
Published: 2002-07-23
Description: Directory traversal vulnerability in Carello 1.3 allows remote attackers to execute programs on the server via a .. (dot dot) in the VBEXE parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0015.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2876&w=2; http://www.iss.net/security_center/static/9521.php
CVE: CVE-2002-0685
Published: 2002-07-23
Description: Heap-based buffer overflow in the message decoding functionality for PGP Outlook Encryption Plug-In, as used in NAI PGP Desktop Security 7.0.4, Personal Security 7.0.3, and Freeware 7.0.3, allows remote attackers to modify the heap and gain privileges via a large, malformed mail message.
CVSS Score: 7.5 (HIGH)
References: http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.04/hotfix/ReadMe.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5773&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]8942&w=2
CVE: CVE-2002-0686
Published: 2002-07-23
Description: Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a long argument to the NS-rel-doc-name parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6889&w=2; http://www.iss.net/security_center/static/9506.php; http://www.kb.cert.org/vuls/id/612843
CVE: CVE-2002-0687
Published: 2002-07-23
Description: The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.
CVSS Score: 5.0 (MEDIUM)
References: http://www.iss.net/security_center/static/9621.php; http://www.osvdb.org/5166; http://www.redhat.com/support/errata/RHSA-2002-060.html
CVE: CVE-2002-0688
Published: 2002-07-23
Description: ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2004/dsa-490; http://www.iss.net/security_center/static/9610.php; http://www.redhat.com/support/errata/RHSA-2002-060.html
CVE: CVE-2002-0701
Published: 2002-07-23
Description: ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4351&w=2; http://www.iss.net/security_center/static/9474.php; http://www.openbsd.org/errata.html#ktrace
CVE: CVE-2002-1599
Published: 2002-07-23
Description: DansGuardian before 2.4.5-1 allows remote attackers to bypass content filtering rules via hex-encoded URLs.
CVSS Score: 7.5 (HIGH)
References: http://dansguardian.org/?page=history; http://dansguardian.org/?page=knownbugs; http://www.kb.cert.org/vuls/id/940203
CVE: CVE-2002-0014
Published: 2002-07-26
Description: URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&).
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000460; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5918&w=2; http://rhn.redhat.com/errata/RHSA-2002-009.html
CVE: CVE-2002-0031
Published: 2002-07-26
Description: Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long arguments to (1) call, (2) sendim, (3) getimv, (4) chat, (5) addview, or (6) addfriend.
CVSS Score: 4.6 (MEDIUM)
References: http://online.securityfocus.com/archive/1/274223; http://www.cert.org/advisories/CA-2002-16.html; http://www.kb.cert.org/vuls/id/137115
CVE: CVE-2002-0032
Published: 2002-07-26
Description: Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/274223; http://www.cert.org/advisories/CA-2002-16.html; http://www.iss.net/security_center/static/9184.php
CVE: CVE-2002-0358
Published: 2002-07-26
Description: MediaMail and MediaMail Pro in SGI IRIX 6.5.16 and earlier allows local users to force the program to dump core via certain arguments, which could allow the users to read sensitive data or gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20020602-01-I; http://www.iss.net/security_center/static/9292.php; http://www.securityfocus.com/bid/4959