deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1277
Published: 2002-11-12
Description: Buffer overflow in Window Maker (wmaker) 0.80.0 and earlier may allow remote attackers to execute arbitrary code via a certain image file that is not properly handled when Window Maker uses width and height information to allocate a buffer.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000548; http://www.debian.org/security/2002/dsa-190; http://www.iss.net/security_center/static/10560.php
CVE: CVE-2002-1278
Published: 2002-11-12
Description: The mailconf module in Linuxconf 1.24, and other versions before 1.28, on Conectiva Linux 6.0 through 8, and possibly other distributions, generates the Sendmail configuration file (sendmail.cf) in a way that configures Sendmail to run as an open mail relay, which allows remote attackers to send Spam email.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000544; http://www.iss.net/security_center/static/10554.php; http://www.osvdb.org/6066
CVE: CVE-2002-1312
Published: 2002-11-20
Description: Buffer overflow in the Web management interface in Linksys BEFW11S4 wireless access point router 2 and BEFSR11, BEFSR41, and BEFSRU31 EtherFast Cable/DSL routers with firmware before 1.43.3 with remote management enabled allows remote attackers to cause a denial of service (router crash) via a long password.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0022.html; http://www.idefense.com/application/poi/display?id=36&type=vulnerabilities&flashstatus=true; http://www.securityfocus.com/bid/6208
CVE: CVE-2002-1644
Published: 2002-11-25
Description: SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the parent process, which allows attackers to gain certain privileges.
CVSS Score: 7.2 (HIGH)
References: http://www.kb.cert.org/vuls/id/740619; http://www.securityfocus.com/bid/6247; http://www.ssh.com/company/newsroom/article/286/
CVE: CVE-2002-1645
Published: 2002-11-25
Description: Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/140977; http://www.securityfocus.com/bid/6263; http://www.ssh.com/company/newsroom/article/287/
CVE: CVE-2002-0029
Published: 2002-11-29
Description: Buffer overflows in the DNS stub resolver library in ISC BIND 4.9.2 through 4.9.10, and other derived libraries such as BSD libc and GNU glibc, allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the (1) getnetbyname, or (2) getnetbyaddr functions, aka "LIBRESOLV: buffer overrun" and a different vulnerability than CVE-2002-0684.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-028.txt.asc; ftp://patches.sgi.com/support/free/security/advisories/20021201-01-P; http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html
CVE: CVE-2002-1142
Published: 2002-11-29
Description: Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0082.html; http://www.cert.org/advisories/CA-2002-33.html; http://www.foundstone.com/knowledge/randd-advisories-display.html?id=337
CVE: CVE-2002-1204
Published: 2002-11-29
Description: Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail address, and possibly the e-mail password, by redefining the user_pref() function and accessing the prefs.js file, which is stored in a directory with a predictable name.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0081.html; http://www.idefense.com/advisory/11.19.02c.txt; http://www.iss.net/security_center/static/10655.php
CVE: CVE-2002-1210
Published: 2002-11-29
Description: Qualcomm Eudora 5.1.1, 5.2, and possibly other versions stores email attachments in a predictable location, which allows remote attackers to read arbitrary files via a link that loads an attachment with malicious script into a frame, which then executes the script in the local browser context.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0079.html; http://www.idefense.com/advisory/11.19.02b.txt; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0079.html
CVE: CVE-2002-1219
Published: 2002-11-29
Description: Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20021201-01-P; http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21469; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000546
CVE: CVE-2002-1220
Published: 2002-11-29
Description: BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.
CVSS Score: 5.0 (MEDIUM)
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21469; http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2842&w=2
CVE: CVE-2002-1221
Published: 2002-11-29
Description: BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21469; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000546; http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html
CVE: CVE-2002-1247
Published: 2002-11-29
Description: Buffer overflow in LISa allows local users to gain access to a raw socket via a long LOGNAME environment variable for the resLISa daemon.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0068.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1757&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2632&w=2
CVE: CVE-2002-1276
Published: 2002-11-29
Description: An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=167471; http://secunia.com/advisories/8220; http://www.debian.org/security/2002/dsa-191
CVE: CVE-2002-1279
Published: 2002-11-29
Description: Multiple buffer overflows in conf.c for Masqmail 0.1.x before 0.1.17, and 0.2.x before 0.2.15, allow local users to gain privileges via certain entries in the configuration file (-C option).
CVSS Score: 7.2 (HIGH)
References: http://lists.masqmail.cx/pipermail/masqmail/2002-November/000040.html; http://lists.masqmail.cx/pipermail/masqmail/2002-November/000041.html; http://www.debian.org/security/2002/dsa-194
CVE: CVE-2002-1281
Published: 2002-11-29
Description: Unknown vulnerability in the rlogin KIO subsystem (rlogin.protocol) of KDE 2.x 2.1 and later, and KDE 3.x 3.0.4 and earlier, allows local and remote attackers to execute arbitrary code via a certain URL.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-012.0.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5730&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9342&w=2
CVE: CVE-2002-1282
Published: 2002-11-29
Description: Unknown vulnerability in the telnet KIO subsystem (telnet.protocol) of KDE 2.x 2.1 and later allows local and remote attackers to execute arbitrary code via a certain URL.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-012.0.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5730&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9342&w=2
CVE: CVE-2002-1283
Published: 2002-11-29
Description: Buffer overflow in Novell iManager (eMFrame) before 1.5 allows remote attackers to cause a denial of service via an authentication request with a long Distinguished Name (DN) attribute.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1408&w=2; http://support.novell.com/servlet/tidfinder/2963651; http://www.securityfocus.com/bid/6154
CVE: CVE-2002-1284
Published: 2002-11-29
Description: The wizard in KGPG 0.6 through 0.8.2 does not properly provide the passphrase to gpg when creating new keys, which causes secret keys to be created with an empty passphrase and allows local attackers to steal the keys if they can be read.
CVSS Score: 4.6 (MEDIUM)
References: http://devel-home.kde.org/~kgpg/bug.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1286&w=2; http://www.securityfocus.com/bid/6152
CVE: CVE-2002-1285
Published: 2002-11-29
Description: runlpr in the LPRng package allows the local lp user to gain root privileges via certain command line arguments.
CVSS Score: 7.2 (HIGH)
References: http://www.iss.net/security_center/static/10525.php; http://www.novell.com/linux/security/advisories/2002_040_lprng_html2ps.html; http://www.securityfocus.com/bid/6077
CVE: CVE-2002-1286
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context via a URL that contains a colon in the domain portion, which is not properly parsed and loads an applet from a malicious site within the security context of the site that is being visited by the user.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.kb.cert.org/vuls/id/657625
CVE: CVE-2002-1287
Published: 2002-11-29
Description: Stack-based buffer overflow in the Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service via a long class name through (1) Class.forName or (2) ClassLoader.loadClass.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.iss.net/security_center/static/10580.php
CVE: CVE-2002-1288
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to determine the current directory of the Internet Explorer process via the getAbsolutePath() method in a File() call.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.securityfocus.com/bid/6139
CVE: CVE-2002-1289
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code via the getNativeServices function, which creates an instance of the com.ms.awt.peer.INativeServices (INativeServices) class, whose methods do not verify the memory addresses that are passed as parameters.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.iss.net/security_center/static/10582.php
CVE: CVE-2002-1290
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read and modify the contents of the Clipboard via an applet that accesses the (1) ClipBoardGetText and (2) ClipBoardSetText methods of the INativeServices class.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.iss.net/security_center/static/10583.php
CVE: CVE-2002-1291
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares via an applet tag with a codebase set to a "file://%00" (null character) URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.iss.net/security_center/static/10584.php
CVE: CVE-2002-1292
Published: 2002-11-29
Description: The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security Manager (SSM) class (com.ms.security.StandardSecurityManager) and bypass intended StandardSecurityManager restrictions by modifying the (1) deniedDefinitionPackages or (2) deniedAccessPackages settings, causing a denial of service by adding Java applets to the list of applets that are prevented from running.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.kb.cert.org/vuls/id/237777
CVE: CVE-2002-1293
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loader.CabCracker), which allows remote attackers to bypass the security checks that are performed by the load() method.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.iss.net/security_center/static/10586.php
CVE: CVE-2002-1294
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities via an applet that uses those references to access proprietary Microsoft methods.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.iss.net/security_center/static/10587.php
CVE: CVE-2002-1295
Published: 2002-11-29
Description: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions (such as private constructors) by providing the class name in the code parameter, aka "Incomplete Java Object Instantiation Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3080&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]1565&w=2; http://www.iss.net/security_center/static/10588.php
CVE: CVE-2002-1306
Published: 2002-11-29
Description: Multiple buffer overflows in LISa on KDE 2.x for 2.1 and later, and KDE 3.x before 3.0.4, allow (1) local and possibly remote attackers to execute arbitrary code via the "lisa" daemon, and (2) remote attackers to execute arbitrary code via a certain "lan://" URL.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2632&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9342&w=2; http://www.ciac.org/ciac/bulletins/n-020.shtml
CVE: CVE-2002-1307
Published: 2002-11-29
Description: Cross-site scripting vulnerability (XSS) in MHonArc 2.5.12 and earlier allows remote attackers to insert script or HTML via an email message with the script in a MIME header name.
CVSS Score: 6.8 (MEDIUM)
References: http://www.debian.org/security/2002/dsa-199; http://www.mhonarc.org/archive/cgi-bin/mesg.cgi?a=mhonarc-users&i=[PII_REDACTED]13.g9LHDXE02256%40mcguire.earlhood.com; http://www.osvdb.org/7353
CVE: CVE-2002-1308
Published: 2002-11-29
Description: Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression.
CVSS Score: 7.5 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=157646; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3075&w=2; http://www.redhat.com/support/errata/RHSA-2003-162.html
CVE: CVE-2002-1309
Published: 2002-11-29
Description: Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary via an HTTP GET request with a long .cfm file name.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0149.html; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0080.html; http://marc.info/?l=bugtraq&r=1&b=200211&w=2
CVE: CVE-2002-1310
Published: 2002-11-29
Description: Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia JRun 4.0 and earlier allows remote attackers to execute arbitrary via an HTTP GET request with a long .jsp file name.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-11/0149.html; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0080.html; http://marc.info/?l=bugtraq&r=1&b=200211&w=2
CVE: CVE-2002-1311
Published: 2002-11-29
Description: Courier sqwebmail before 0.40.0 does not quickly drop privileges after startup in certain cases, which could allow local users to read arbitrary files.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3436&w=2; http://www.debian.org/security/2002/dsa-197; http://www.iss.net/security_center/static/10643.php
CVE: CVE-2002-1313
Published: 2002-11-29
Description: nullmailer 1.00RC5 and earlier allows local users to cause a denial of service via an email to a local user that does not exist, which generates an error that causes nullmailer to stop sending mail to all users.
CVSS Score: 2.1 (LOW)
References: http://www.debian.org/security/2002/dsa-198; http://www.securityfocus.com/bid/6193; https://exchange.xforce.ibmcloud.com/vulnerabilities/10649
CVE: CVE-2002-1315
Published: 2002-11-29
Description: Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows remote attackers to execute web script or HTML as the iPlanet administrator by injecting the desired script into error logs, and possibly escalating privileges by using the XSS vulnerability in conjunction with another issue (CVE-2002-1316).
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0269&w=2; http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1
CVE: CVE-2002-1316
Published: 2002-11-29
Description: importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315).
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0269&w=2; http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1
CVE: CVE-2002-1588
Published: 2002-11-29
Description: Mailtool for OpenWindows 3.6, 3.6.1, and 3.6.2 allows remote attackers to cause a denial of service (mailtool segmentation violation and crash) via a malformed mail attachment.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-48216-1; http://www.securityfocus.com/bid/6279; https://exchange.xforce.ibmcloud.com/vulnerabilities/10732
CVE: CVE-2002-1586
Published: 2002-12-03
Description: Solaris 2.5.1 through 9 allows local users to cause a denial of service (kernel panic) by setting the sd_struiowrq variable in the struioget function to null, which triggers a null dereference.
CVSS Score: 2.1 (LOW)
References: http://securitytracker.com/id?1005742; http://sunsolve.sun.com/search/document.do?assetkey=1-26-48267-1; http://www.securityfocus.com/bid/6309
CVE: CVE-2002-1587
Published: 2002-12-04
Description: The libthread library (libthread.so.1) for Solaris 2.5.1 through 8 allows local users to cause a denial of service (hang) of an application that uses libthread by causing the application to wait for a certain mutex.
CVSS Score: 2.1 (LOW)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-46867-1; http://www.securityfocus.com/bid/6318; https://exchange.xforce.ibmcloud.com/vulnerabilities/11146
CVE: CVE-2002-1183
Published: 2002-12-11
Description: Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/5410; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050; https://exchange.xforce.ibmcloud.com/vulnerabilities/9776
CVE: CVE-2002-1185
Published: 2002-12-11
Description: Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure."
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0105.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5091&w=2; http://www.eeye.com/html/Research/Advisories/AD20021211.html
CVE: CVE-2002-1186
Published: 2002-12-11
Description: Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0018.html; http://archives.neohapsis.com/archives/bugtraq/2002-09/0030.html; http://www.iss.net/security_center/static/10039.php
CVE: CVE-2002-1187
Published: 2002-12-11
Description: Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1054&w=2; http://www.iss.net/security_center/static/10066.php; http://www.osvdb.org/2998
CVE: CVE-2002-1188
Published: 2002-12-11
Description: Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading."
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7193&w=2; http://www.ciac.org/ciac/bulletins/n-018.shtml; http://www.iss.net/security_center/static/10665.php