deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1821
Published: 2002-12-31
Description: Ultimate PHP Board (UPB) 1.0 and 1.0b allows remote authenticated users to gain privileges and perform unauthorized actions via direct requests to (1) admin_members.php, (2) admin_config.php, (3) admin_cat.php, or (4) admin_forum.php.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1005198; http://www.securityfocus.com/bid/5666; http://securitytracker.com/id?1005198
CVE: CVE-2002-1822
Published: 2002-12-31
Description: IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page (JSP).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2411&w=2; http://www.iss.net/security_center/static/10628.php; http://www.securityfocus.com/bid/6181
CVE: CVE-2002-1823
Published: 2002-12-31
Description: Buffer overflow in the HttpGetRequest function in Zeroo HTTP server 1.5 allows remote attackers to execute arbitrary code via a long HTTP request.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/300066; http://www.iss.net/security_center/static/10642.php; http://www.securityfocus.com/bid/6190
CVE: CVE-2002-1824
Published: 2002-12-31
Description: Microsoft Internet Explorer 6.0, when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake, does not prompt the user before searching for and finding a newer certificate, which may allow attackers to perform a man-in-the-middle attack. NOTE: it is not clear whether this poses a vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/292842; http://www.iss.net/security_center/static/10180.php; http://www.securityfocus.com/bid/5778
CVE: CVE-2002-1825
Published: 2002-12-31
Description: Format string vulnerability in PerlRTE_example1.pl in WASD 7.1, 7.2.0 through 7.2.3, and 8.0.0 allows remote attackers to execute arbitrary commands or crash the server via format strings in the $name variable.
CVSS Score: 6.4 (MEDIUM)
References: http://wasd.vsm.com.au/ht_root/doc/misc/wasd_advisory_020925.txt; http://www.iss.net/security_center/static/10213.php; http://www.osvdb.org/21288
CVE: CVE-2002-1826
Published: 2002-12-31
Description: grsecurity 1.9.4 for Linux kernel 2.4.18 allows local users to bypass read-only permissions by using mmap to directly map /dev/mem or /dev/kmem to kernel memory.
CVSS Score: 4.6 (MEDIUM)
References: http://online.securityfocus.com/archive/1/273002; http://www.iss.net/security_center/static/9109.php; http://www.securityfocus.com/bid/4762
CVE: CVE-2002-1827
Published: 2002-12-31
Description: Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock on the (1) alias, (2) map, (3) statistics, and (4) pid files.
CVSS Score: 2.1 (LOW)
References: http://online.securityfocus.com/archive/1/274033; http://www.iss.net/security_center/static/9162.php; http://www.securityfocus.com/bid/4822
CVE: CVE-2002-1828
Published: 2002-12-31
Description: Savant Webserver 3.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request with a negative Content-Length value.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/291791; http://www.iss.net/security_center/static/10103.php; http://www.securityfocus.com/bid/5707
CVE: CVE-2002-1829
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in codeparse.php in Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to inject arbitrary web script or HTML via (1) myhome.php, (2) an onerror attribute in an IMG tag (a variant of CVE-2002-0330), or (3) a glow tag.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]7632&w=2; http://www.securityfocus.com/bid/4819; https://exchange.xforce.ibmcloud.com/vulnerabilities/9160
CVE: CVE-2002-1830
Published: 2002-12-31
Description: Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to bypass authentication and access modifier options via a direct request to moderator.php with the action and ismod parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]7632&w=2; http://www.iss.net/security_center/static/9160.php; http://www.securityfocus.com/bid/4823
CVE: CVE-2002-1831
Published: 2002-12-31
Description: Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-encoded spaces (%20) in the Invitation-Cookie field.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/274086; http://www.iss.net/security_center/static/9161.php; http://www.securityfocus.com/bid/4827
CVE: CVE-2002-1832
Published: 2002-12-31
Description: Unknown vulnerability in the "ipopts decode" functionality in Firestorm IDS 0.4.0 through 0.4.2 allows remote attackers to cause a denial of service (crash) via certain IP options.
CVSS Score: 5.0 (MEDIUM)
References: http://www.iss.net/security_center/static/9192.php; http://www.scaramanga.co.uk/firestorm/NEWS; http://www.securityfocus.com/bid/4871
CVE: CVE-2002-1833
Published: 2002-12-31
Description: The default configurations for DocuTech 6110 and DocuTech 6115 have a default administrative password of (1) "service!" on Solaris 8.0 or (2) "administ" on Windows NT, which allows remote attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/273029; http://online.securityfocus.com/archive/1/273078; http://online.securityfocus.com/archive/1/273079
CVE: CVE-2002-1834
Published: 2002-12-31
Description: The default configuration of Xerox DocuTech 6110 and DocuTech 6115 allows remote attackers to connect to the web server and (1) submit print jobs directly into the "print now" queue or (2) read the scanner job history.
CVSS Score: 6.4 (MEDIUM)
References: http://online.securityfocus.com/archive/1/273029; http://online.securityfocus.com/archive/1/273078; http://www.iss.net/security_center/static/9108.php
CVE: CVE-2002-1835
Published: 2002-12-31
Description: The default configuration of Xerox DocuTech 6110 and DocuTech 6115 running Solaris 8.0 has a large number of unnecessary services enabled such as RPC and sprayd, which could allow remote attackers to obtain access to the device.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/273029; http://totally.righteous.net/jedgar/overview_of_security.pdf; http://www.iss.net/security_center/static/9108.php
CVE: CVE-2002-1836
Published: 2002-12-31
Description: The default configuration of Xerox DocuTech 6110 and DocuTech 6115 exports certain NFS shares to the world with world writable permissions, which may allow remote attackers to modify sensitive files.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/273029; http://online.securityfocus.com/archive/1/273089; http://totally.righteous.net/jedgar/overview_of_security.pdf
CVE: CVE-2002-1837
Published: 2002-12-31
Description: The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album parameter, which generates different error messages depending on whether the directory exists or not.
CVSS Score: 5.0 (MEDIUM)
References: http://ids.sourceforge.net/ChangeLog.html; http://online.securityfocus.com/archive/1/274433; http://www.iss.net/security_center/static/9201.php
CVE: CVE-2002-1838
Published: 2002-12-31
Description: Charities.cron 1.0.2 through 1.6.0 allows local users to write to arbitrary files via a symlink attack on temporary files.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/4869; http://www.stevesachs.com/charities.cron_CHANGELOG; http://www.securityfocus.com/bid/4869
CVE: CVE-2002-1839
Published: 2002-12-31
Description: Trend Micro InterScan VirusWall for Windows NT 3.52 does not record the sender's IP address in the headers for a mail message when it is passed from VirusWall to the MTA, which allows remote attackers to hide the origin of the message.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/274144; http://www.iss.net/security_center/static/9168.php; http://www.securityfocus.com/bid/4830
CVE: CVE-2002-1840
Published: 2002-12-31
Description: irssi IRC client 0.8.4, when downloaded after 14-March-2002, could contain a backdoor in the configuration file, which allows remote attackers to access the system.
CVSS Score: 10.0 (HIGH)
References: http://online.securityfocus.com/archive/1/274132; http://real.irssi.org/?page=backdoor; http://www.iss.net/security_center/static/9176.php
CVE: CVE-2002-1841
Published: 2002-12-31
Description: The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and execute arbitrary PHP files with extensions such as .php4.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-434
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]1370&w=2; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]8208&w=2; http://online.securityfocus.com/archive/1/280340
CVE: CVE-2002-1842
Published: 2002-12-31
Description: Perlbot 1.0 beta allows remote attackers to execute arbitrary commands via shell metacharacters in (1) a word that is being spell checked or (2) an e-mail address.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/296073; http://www.iss.net/security_center/static/10401.php; http://www.iss.net/security_center/static/10402.php
CVE: CVE-2002-1843
Published: 2002-12-31
Description: Perlbot 1.9.2 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the $text variable in SpelCheck.pm or (2) the $filename variable in HTMLPlog.pm.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/296134; http://www.iss.net/security_center/static/10403.php; http://www.iss.net/security_center/static/10404.php
CVE: CVE-2002-1844
Published: 2002-12-31
Description: Microsoft Windows Media Player (WMP) 6.3, when installed on Solaris, installs executables with world-writable permissions, which allows local users to delete or modify the executables to gain privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0260.html; http://www.iss.net/security_center/static/10398.php; http://www.securityfocus.com/bid/6003
CVE: CVE-2002-1845
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in index.php in Yet Another Bulletin Board (YaBB) 1.40 and 1.41 allows remote attackers to inject arbitrary web script or HTML via the password (passwrd) parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://online.securityfocus.com/archive/1/296121; http://www.iss.net/security_center/static/10406.php; http://www.securityfocus.com/bid/6004
CVE: CVE-2002-1846
Published: 2002-12-31
Description: Yet Another Bulletin Board (YaBB) 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by stealing the cookie of another user, modifying the expiretime setting, and submitting the change in a profile2 action to index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/296121; http://online.securityfocus.com/archive/1/296121
CVE: CVE-2002-1847
Published: 2002-12-31
Description: Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. NOTE: since the only known attack vector requires command line access, this may not be a vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/285082; http://www.iss.net/security_center/static/9727.php; http://www.securityfocus.com/bid/5357
CVE: CVE-2002-1848
Published: 2002-12-31
Description: TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which could allow local users to access passwords.
CVSS Score: 2.1 (LOW)
References: http://www.securityfocus.com/bid/4835; http://www.tightvnc.com/changelog-win32.html; http://www.securityfocus.com/bid/4835
CVE: CVE-2002-1849
Published: 2002-12-31
Description: ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back button, then logging into the same chat room as a different user, which fills the chat room with invalid users.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0427.html; http://www.iss.net/security_center/static/9735.php; http://www.securityfocus.com/bid/5370
CVE: CVE-2002-1850
Published: 2002-12-31
Description: mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/generators/mod_cgi.c?r1=1.148.2.7&r2=1.148.2.8; http://issues.apache.org/bugzilla/show_bug.cgi?id=10515; http://issues.apache.org/bugzilla/show_bug.cgi?id=22030
CVE: CVE-2002-1851
Published: 2002-12-31
Description: Buffer overflow in WS_FTP Pro 7.5 allows remote attackers to execute code on a client system via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/10185.php; http://www.nextgenss.com/vna/ips-wsftp.txt; http://www.securityfocus.com/bid/4850
CVE: CVE-2002-1852
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in Monkey 0.5.0 allows remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) a parameter to test2.pl.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0344.html; http://www.iss.net/security_center/static/10226.php; http://www.iss.net/security_center/static/10229.php
CVE: CVE-2002-1853
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in MyNewsGroups 0.4 and 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the subject of a newsgroup post, which is not properly handled by (1) myarticles.php, (2) search.php, (3) stats.php, or (4) standard.lib.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/7177; http://www.iss.net/security_center/static/10238.php; http://www.securityfocus.com/archive/1/293564
CVE: CVE-2002-1854
Published: 2002-12-31
Description: Rlaj whois CGI script (whois.cgi) 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field.
CVSS Score: 10.0 (HIGH)
References: http://online.securityfocus.com/archive/1/279268; http://www.iss.net/security_center/static/9439.php; http://www.securityfocus.com/bid/5113
CVE: CVE-2002-1855
Published: 2002-12-31
Description: Macromedia JRun 3.0 through 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/279582; http://www.iss.net/security_center/static/9446.php; http://www.macromedia.com/v1/handlers/index.cfm?ID=23164
CVE: CVE-2002-1856
Published: 2002-12-31
Description: HP Application Server 8.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/279582; http://www.iss.net/security_center/static/9446.php; http://www.securityfocus.com/bid/5119
CVE: CVE-2002-1857
Published: 2002-12-31
Description: jo! jo Webserver 1.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/279582; http://www.iss.net/security_center/static/9446.php; http://www.securityfocus.com/bid/5119
CVE: CVE-2002-1858
Published: 2002-12-31
Description: Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/279582; http://otn.oracle.com/deploy/security/pdf/2002alert47rev1.pdf; http://www.iss.net/security_center/static/9446.php
CVE: CVE-2002-1859
Published: 2002-12-31
Description: Orion Application Server 1.5.3, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/279582; http://www.iss.net/security_center/static/9446.php; http://www.securityfocus.com/bid/5119
CVE: CVE-2002-1860
Published: 2002-12-31
Description: Pramati Server 3.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/279582; http://www.iss.net/security_center/static/9446.php; http://www.securityfocus.com/bid/5119
CVE: CVE-2002-1861
Published: 2002-12-31
Description: Sybase Enterprise Application Server 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/279582; http://www.iss.net/security_center/static/9446.php; http://www.securityfocus.com/bid/5119
CVE: CVE-2002-1862
Published: 2002-12-31
Description: SmartMail Server 2.0 allows remote attackers to cause a denial of service (crash) by sending data and closing the connection before all the data has been sent.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0418.html; http://www.iss.net/security_center/static/10533.php; http://www.securityfocus.com/bid/6074
CVE: CVE-2002-1863
Published: 2002-12-31
Description: Iomega Network Attached Storage (NAS) A300U, and possibly other models, does not allow the FTP service to be disabled, which allows local users to access home directories via FTP even when access to all shared directories have been disabled.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0440.html; http://www.iss.net/security_center/static/10530.php; http://archives.neohapsis.com/archives/bugtraq/2002-10/0440.html
CVE: CVE-2002-1864
Published: 2002-12-31
Description: Directory traversal vulnerability in Simple Web Server (SWS) 0.0.4 through 0.1.0 allows remote attackers to read arbitrary files via a ".." (dot dot) in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0047.html; http://www.iss.net/security_center/static/10070.php; http://www.securityfocus.com/bid/5662
CVE: CVE-2002-1865
Published: 2002-12-31
Description: Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.56b5 and (2) Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 through 1.42.7 and Linksys WAP11 1.3 and 1.4, allows remote attackers to cause a denial of service (crash) via a long header, as demonstrated using the Host header.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0052.html; http://www.iss.net/security_center/static/10537.php; http://www.securityfocus.com/bid/6090
CVE: CVE-2002-1866
Published: 2002-12-31
Description: Simple Web Server (SWS) 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages, which could allow remote attackers to cause a denial of service (file descriptor exhaustion) via multiple requests for pages that do not exist.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0047.html; http://www.iss.net/security_center/static/10071.php; http://www.securityfocus.com/bid/5659
CVE: CVE-2002-1867
Published: 2002-12-31
Description: The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an administrative account, or (2) admin/nph-build.cgi, which allows remote attackers to cause a denial of service (CPU consumption).
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9427&w=2; http://www.iss.net/security_center/static/9308.php; http://www.securityfocus.com/bid/4975
CVE: CVE-2002-1868
Published: 2002-12-31
Description: Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields.
CVSS Score: 10.0 (HIGH)
References: http://www.contactor.se/~dast/dispair/dispair.cgi?file=dispair-0.3.tar.gz&dir=&view=CHANGES; http://www.iss.net/security_center/static/9787.php; http://www.securityfocus.com/bid/5392
CVE: CVE-2002-1869
Published: 2002-12-31
Description: Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.
CVSS Score: 3.3 (LOW)
CWE: CWE-667
References: http://securitytracker.com/id?1005517; http://www.heysoft.de/nt/eventlog/hsb01e.htm; http://www.iss.net/security_center/static/10535.php
CVE: CVE-2002-1870
Published: 2002-12-31
Description: Simple Web Server (SWS) 0.0.4 through 0.1.0 does not properly handle when the recv function call fails, which may allow remote attackers to overwrite program data or perform actions on an uninitialized heap, leading to a denial of service and possibly code execution.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0047.html; http://www.iss.net/security_center/static/10072.php; http://www.securityfocus.com/bid/5660
CVE: CVE-2002-1871
Published: 2002-12-31
Description: pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" (question mark) in the (1) mode, (2) owner, or (3) group fields, which allows attackers to elevate privileges.
CVSS Score: 7.2 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-45693-1; http://www.iss.net/security_center/static/9544.php; http://www.securityfocus.com/bid/5208
CVE: CVE-2002-1872
Published: 2002-12-31
Description: Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://online.securityfocus.com/archive/1/298361; http://www.iss.net/security_center/static/10542.php; http://www.nextgenss.com/papers/tp-SQL2000.pdf
CVE: CVE-2002-1873
Published: 2002-12-31
Description: Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://online.securityfocus.com/archive/1/286220; http://www.iss.net/security_center/static/9789.php; http://www.securityfocus.com/bid/5412