deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1093
Published: 2002-10-04
Description: HTML interface for Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.0.3(B) allows remote attackers to cause a denial of service (CPU consumption) via a long URL request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10018.php; http://www.securityfocus.com/bid/5615
CVE: CVE-2002-1094
Published: 2002-10-04
Description: Information leaks in Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.5.4 allow remote attackers to obtain potentially sensitive information via the (1) SSH banner, (2) FTP banner, or (3) an incorrect HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10020.php; http://www.securityfocus.com/bid/5621
CVE: CVE-2002-1095
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator before 2.5.2(F), with encryption enabled, allows remote attackers to cause a denial of service (reload) via a Windows-based PPTP client with the "No Encryption" option set.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10021.php; http://www.securityfocus.com/bid/5625
CVE: CVE-2002-1096
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.1, allows restricted administrators to obtain user passwords that are stored in plaintext in HTML source code.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10019.php; http://www.securityfocus.com/bid/5611
CVE: CVE-2002-1097
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.2, allows restricted administrators to obtain certificate passwords that are stored in plaintext in the HTML source code for Certificate Management pages.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10022.php; http://www.securityfocus.com/bid/5612
CVE: CVE-2002-1098
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, adds an "HTTPS on Public Inbound (XML-Auto)(forward/in)" rule but sets the protocol to "ANY" when the XML filter configuration is enabled, which ultimately allows arbitrary traffic to pass through the concentrator.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10023.php; http://www.securityfocus.com/bid/5614
CVE: CVE-2002-1099
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to obtain potentially sensitive information without authentication by directly accessing certain HTML pages.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10024.php; http://www.securityfocus.com/bid/5616
CVE: CVE-2002-1100
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to cause a denial of service (crash) via a long (1) username or (2) password to the HTML login interface.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10025.php; http://www.securityfocus.com/bid/5617
CVE: CVE-2002-1101
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via a long user name.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml
CVE: CVE-2002-1102
Published: 2002-10-04
Description: The LAN-to-LAN IPSEC capability for Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.4, allows remote attackers to cause a denial of service via an incoming LAN-to-LAN connection with an existing security association with another device on the remote network, which causes the concentrator to remove the previous connection.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.securityfocus.com/bid/5622; https://exchange.xforce.ibmcloud.com/vulnerabilities/10027
CVE: CVE-2002-1103
Published: 2002-10-04
Description: Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via (1) malformed or (2) large ISAKMP packets.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml; http://www.kb.cert.org/vuls/id/761651; http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml
CVE: CVE-2002-1104
Published: 2002-10-04
Description: Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.0.5 allows remote attackers to cause a denial of service (crash) via TCP packets with source and destination ports of 137 (NETBIOS).
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml; http://www.securityfocus.com/bid/5649; https://exchange.xforce.ibmcloud.com/vulnerabilities/10042
CVE: CVE-2002-1105
Published: 2002-10-04
Description: Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, allows local users to use a utility program to obtain the group password.
CVSS Score: 4.6 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml; http://www.securityfocus.com/bid/5650; https://exchange.xforce.ibmcloud.com/vulnerabilities/10044
CVE: CVE-2002-1106
Published: 2002-10-04
Description: Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml; http://www.securityfocus.com/bid/5652; https://exchange.xforce.ibmcloud.com/vulnerabilities/10045
CVE: CVE-2002-1107
Published: 2002-10-04
Description: Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.2B, does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml; http://www.securityfocus.com/bid/5653; https://exchange.xforce.ibmcloud.com/vulnerabilities/10046
CVE: CVE-2002-1108
Published: 2002-10-04
Description: Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.6(Rel), when configured with all tunnel mode, can be forced into acknowledging a TCP packet from outside the tunnel.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml; http://www.securityfocus.com/bid/5651; https://exchange.xforce.ibmcloud.com/vulnerabilities/10047
CVE: CVE-2002-1109
Published: 2002-10-04
Description: securetar, as used in AMaViS shell script 0.2.1 and earlier, allows users to cause a denial of service (CPU consumption) via a malformed TAR file, possibly via an incorrect file size parameter.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=amavis-announce&m=[PII_REDACTED]2242&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1404&w=2; http://www.iss.net/security_center/static/10056.php
CVE: CVE-2002-1110
Published: 2002-10-04
Description: Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to account_update.php.
CVSS Score: 10.0 (HIGH)
References: http://mantisbt.sourceforge.net/advisories/2002/2002-01.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8851&w=2; http://www.debian.org/security/2002/dsa-153
CVE: CVE-2002-1111
Published: 2002-10-04
Description: print_all_bug_page.php in Mantis 0.17.3 and earlier does not verify the limit_reporters option, which allows remote attackers to view bug summaries for bugs that would otherwise be restricted.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://mantisbt.sourceforge.net/advisories/2002/2002-02.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0491&w=2; http://www.debian.org/security/2002/dsa-153
CVE: CVE-2002-1112
Published: 2002-10-04
Description: Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page.
CVSS Score: 5.0 (MEDIUM)
References: http://mantisbt.sourceforge.net/advisories/2002/2002-03.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8271&w=2; http://www.debian.org/security/2002/dsa-153
CVE: CVE-2002-1113
Published: 2002-10-04
Description: summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location of the PHP code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1965&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1040&w=2; http://www.debian.org/security/2002/dsa-153
CVE: CVE-2002-1114
Published: 2002-10-04
Description: config_inc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) g_bottom_include_page, (2) g_top_include_page, (3) g_css_include_file, (4) g_meta_include_file, or (5) a cookie.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8648&w=2; http://www.debian.org/security/2002/dsa-153; http://www.iss.net/security_center/static/9900.php
CVE: CVE-2002-1115
Published: 2002-10-04
Description: Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter to (1) bug_update_advanced_page.php, (2) bug_update_page.php, (3) view_bug_advanced_page.php, or (4) view_bug_page.php.
CVSS Score: 5.0 (MEDIUM)
References: http://mantisbt.sourceforge.net/advisories/2002/2002-06.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1164&w=2; http://www.debian.org/security/2002/dsa-161
CVE: CVE-2002-1116
Published: 2002-10-04
Description: The "View Bugs" page (view_all_bug_page.php) in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have access to any projects.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0112&w=2; http://www.debian.org/security/2002/dsa-161; http://www.securityfocus.com/bid/5565
CVE: CVE-2002-1117
Published: 2002-10-04
Description: Veritas Backup Exec 8.5 and earlier requires that the "RestrictAnonymous" registry key for Microsoft Exchange 2000 must be set to 0, which enables anonymous listing of the SAM database and shares.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4579&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9683&w=2; http://seer.support.veritas.com/docs/238618.htm
CVE: CVE-2002-1119
Published: 2002-10-04
Description: os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute arbitrary code via a symlink attack.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-045.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000527; http://mail.python.org/pipermail/python-dev/2002-August/027229.html
CVE: CVE-2002-1127
Published: 2002-10-04
Description: Buffer overflow in uucp in Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long source (-s) command line parameter.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0122.html; http://www.iss.net/security_center/static/10146.php; http://www.securityfocus.com/bid/5745
CVE: CVE-2002-1128
Published: 2002-10-04
Description: Buffer overflow in inc mail utility for Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long MH environment variable.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0122.html; http://www.iss.net/security_center/static/10147.php; http://www.securityfocus.com/bid/5747
CVE: CVE-2002-1129
Published: 2002-10-04
Description: Buffer overflow in dxterm allows local users to execute arbitrary code via a long -xrm argument.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0122.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6294&w=2; http://www.iss.net/security_center/static/10148.php
CVE: CVE-2002-1131
Published: 2002-10-04
Description: Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0246.html; http://sourceforge.net/project/shownotes.php?group_id=311&release_id=110774; http://www.debian.org/security/2002/dsa-191
CVE: CVE-2002-1132
Published: 2002-10-04
Description: SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0246.html; http://www.debian.org/security/2002/dsa-191; http://www.iss.net/security_center/static/10345.php
CVE: CVE-2002-1133
Published: 2002-10-04
Description: Encoded directory traversal vulnerability in Dino's web server 2.1 allows remote attackers to read arbitrary files via ".." (dot dot) sequences with URL-encoded (1) "/" (%2f") or (2) "\" (%5c) characters.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0127.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4285&w=2; http://www.iss.net/security_center/static/10168.php
CVE: CVE-2002-1134
Published: 2002-10-04
Description: Unknown vulnerability in Compaq WEBES Service Tools 2.0 through WEBES 4.0 (Service Pack 5) allows local users to read privileged files.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8587&w=2; http://online.securityfocus.com/advisories/4497; http://www.iss.net/security_center/static/10167.php
CVE: CVE-2002-1135
Published: 2002-10-04
Description: modsecurity.php 1.10 and earlier, in phpWebSite 0.8.2 and earlier, allows remote attackers to execute arbitrary PHP source code via an inc_prefix parameter that points to the malicious code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6880&w=2; http://phpwebsite.appstate.edu/article.php?sid=400; http://www.iss.net/security_center/static/10164.php
CVE: CVE-2002-0370
Published: 2002-10-10
Description: Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0009.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9223&w=2; http://securityreason.com/securityalert/587
CVE: CVE-2002-0399
Published: 2002-10-10
Description: Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000538; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9680&w=2; http://secunia.com/advisories/19130
CVE: CVE-2002-0692
Published: 2002-10-10
Description: Buffer overflow in SmartHTML Interpreter (shtml.dll) in Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to cause a denial of service (CPU consumption) or run arbitrary code, respectively, via a certain type of web file request.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/10194.php; http://www.iss.net/security_center/static/10195.php; http://www.kb.cert.org/vuls/id/723537
CVE: CVE-2002-0693
Published: 2002-10-10
Description: Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5409&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7344&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4182&w=2
CVE: CVE-2002-0694
Published: 2002-10-10
Description: The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File."
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/10254.php; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A403
CVE: CVE-2002-0705
Published: 2002-10-10
Description: The Web Reports Server for SurfControl SuperScout WebFilter stores the "scwebusers" username and password file in a web-accessible directory, which allows remote attackers to obtain valid usernames and crack the passwords.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4103&w=2; http://www.iss.net/security_center/static/10248.php; http://www.osvdb.org/3489
CVE: CVE-2002-0706
Published: 2002-10-10
Description: UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, which allows remote attackers to decrypt the administrative password using a hard-coded key in a Javascript function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4103&w=2; http://www.iss.net/security_center/static/10247.php; http://www.osvdb.org/3491
CVE: CVE-2002-0707
Published: 2002-10-10
Description: The Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to cause a denial of service (CPU consumption) via large GET requests, possibly due to a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4103&w=2; http://www.iss.net/security_center/static/10242.php; http://www.securityfocus.com/bid/5854
CVE: CVE-2002-0708
Published: 2002-10-10
Description: Directory traversal vulnerability in the Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to read arbitrary files via an HTTP request containing ... (triple dot) sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4103&w=2; http://www.iss.net/security_center/static/10244.php; http://www.securityfocus.com/bid/5857
CVE: CVE-2002-0709
Published: 2002-10-10
Description: SQL injection vulnerabilities in the Web Reports Server for SurfControl SuperScout WebFilter allow remote attackers to execute arbitrary SQL queries via the RunReport option to SimpleBar.dll, and possibly other DLLs.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4103&w=2; http://www.iss.net/security_center/static/10245.php; http://www.securityfocus.com/bid/5859
CVE: CVE-2002-0838
Published: 2002-10-10
Description: Buffer overflow in (1) gv 3.5.8 and earlier, (2) gvv 1.0.2 and earlier, (3) ggv 1.99.90 and earlier, (4) gnome-gv, and (5) kghostview in kdegraphics 2.2.2 and earlier, allows attackers to execute arbitrary code via a malformed (a) PDF or (b) PostScript file, which is processed by an unsafe call to sscanf.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-053.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000542; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3319&w=2
CVE: CVE-2002-0839
Published: 2002-10-11
Description: The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
CVSS Score: 7.2 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20021105-01-I; http://archives.neohapsis.com/archives/bugtraq/2002-10/0195.html; http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html
CVE: CVE-2002-0840
Published: 2002-10-11
Description: Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I; http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0003.html
CVE: CVE-2002-0843
Published: 2002-10-11
Description: Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20021105-01-I; http://archives.neohapsis.com/archives/bugtraq/2002-10/0229.html; http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html
CVE: CVE-2002-0863
Published: 2002-10-11
Description: Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol."
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9404&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2; http://www.iss.net/security_center/static/10121.php
CVE: CVE-2002-0864
Published: 2002-10-11
Description: The Remote Data Protocol (RDP) version 5.1 in Microsoft Windows XP allows remote attackers to cause a denial of service (crash) when Remote Desktop is enabled via a PDU Confirm Active data packet that does not set the Pattern BLT command, aka "Denial of Service in Remote Desktop."
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6592&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2; http://www.iss.net/security_center/static/10120.php