deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-2093
Published: 2002-12-31
Description: The Video Control Panel on SGI O2/IRIX 6.5, when the Default Input is set to "Output Video", allows attackers to access a console session by running videoout then videoin.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20020103-01-I; http://www.securityfocus.com/bid/3974; https://exchange.xforce.ibmcloud.com/vulnerabilities/8016
CVE: CVE-2002-2094
Published: 2002-12-31
Description: Joe Testa hellbent 01 allows remote attackers to determine the full path of the web root directory via a GET request with a relative path that includes the root's parent, which generates a 403 error message if the parent is incorrect, but a normal response if the parent is correct.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-203
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0228.html; http://www.iss.net/security_center/static/7930.php; http://www.securityfocus.com/bid/3908
CVE: CVE-2002-2095
Published: 2002-12-31
Description: Joe Testa hellbent 01 webserver allows attackers to read files that are specified in the hellbent.prefs file by creating a file with a similar name in the web root, as demonstrated using (1) index.webroot and (2) index.ipallow.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0228.html; http://www.iss.net/security_center/static/7931.php; http://www.securityfocus.com/bid/3909
CVE: CVE-2002-2096
Published: 2002-12-31
Description: Buffer overflow in Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0001.html; http://archives.neohapsis.com/archives/bugtraq/2002-04/0088.html; http://support.novell.com/servlet/tidfinder/2962026
CVE: CVE-2002-2097
Published: 2002-12-31
Description: The compression code in MaraDNS before 0.9.01 allows remote attackers to cause a denial of service via crafted DNS packets.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1003252; http://www.securityfocus.com/bid/3852; https://exchange.xforce.ibmcloud.com/vulnerabilities/7972
CVE: CVE-2002-2098
Published: 2002-12-31
Description: Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1003242; http://www.dabo.de/software/axspawn.html; http://www.securityfocus.com/bid/3824
CVE: CVE-2002-2099
Published: 2002-12-31
Description: Buffer overflow in the GNU DataDisplay Debugger (DDD) 3.3.1 allows local users to execute arbitrary code and possibly gain privileges via a long HOME environment variable.  NOTE: since DDD is not installed setuid or setgid, perhaps this issue should not be included in CVE.
CVSS Score: 7.2 (HIGH)
References: http://securitytracker.com/id?1003241; https://exchange.xforce.ibmcloud.com/vulnerabilities/7979; http://securitytracker.com/id?1003241
CVE: CVE-2002-2100
Published: 2002-12-31
Description: Microsoft Outlook 2002 allows remote attackers to embed bypass the file download restrictions for attachments via an HTML email message that uses an IFRAME to reference malicious content.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0267.html; http://www.iss.net/security_center/static/8611.php; http://www.securityfocus.com/bid/4334
CVE: CVE-2002-2101
Published: 2002-12-31
Description: Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0267.html; http://www.iss.net/security_center/static/8613.php; http://www.securityfocus.com/bid/4337
CVE: CVE-2002-2102
Published: 2002-12-31
Description: InfBlocks.java in JCraft JZlib before 0.0.7 allow remote attackers to cause a denial of service (NullPointerException) via an invalid block of deflated data.
CVSS Score: 5.0 (MEDIUM)
References: http://www.iss.net/security_center/static/8627.php; http://www.jcraft.com/jzlib/ChangeLog; http://www.securityfocus.com/bid/4359
CVE: CVE-2002-2103
Published: 2002-12-31
Description: Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
CVSS Score: 5.0 (MEDIUM)
References: http://www.apache.org/dist/httpd/CHANGES_1.3; http://www.iss.net/security_center/static/8629.php; http://www.securityfocus.com/bid/4358
CVE: CVE-2002-2104
Published: 2002-12-31
Description: graph.php in Ganglia PHP RRD Web Client 1.0.2 allows remote attackers to execute arbitrary commands via the command parameter, which is provided to the passthru function.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1003376; http://www.securityfocus.com/bid/3962; https://exchange.xforce.ibmcloud.com/vulnerabilities/7999
CVE: CVE-2002-2105
Published: 2002-12-31
Description: Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.
CVSS Score: 2.1 (LOW)
References: http://securitytracker.com/id?1003308; http://www.securityfocus.com/bid/3942; http://www.supernature-forum.de/vbb/printthread.php?threadid=6458
CVE: CVE-2002-2106
Published: 2002-12-31
Description: PHP remote file inclusion vulnerability in WikkiTikkiTavi before 0.21 allows remote attackers to execute arbitrary PHP code via the TemplateDir variable, as demonstrated using conflict.php.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1003307; http://sourceforge.net/mailarchive/message.php?msg_id=185752; http://www.securityfocus.com/bid/3946
CVE: CVE-2002-2107
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in the lookup script in Veridis OpenKeyServer (OKS) 1.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.iss.net/security_center/static/8651.php; http://www.securiteam.com/securitynews/5BP0R1P6KE.html; http://www.securityfocus.com/bid/4369
CVE: CVE-2002-2108
Published: 2002-12-31
Description: Unknown vulnerability in the "VAIO Manual" software in certain Sony VAIO personal computers sold from November 2001 to January 2002, allows remote attackers to modify data via a web page or HTML e-mail.
CVSS Score: 5.0 (MEDIUM)
References: http://vaio-online.sony.com/announcement/announcement_content.html; http://vaio-online.sony.com/announcement/technical_explain.html; http://www.iss.net/security_center/static/8009.php
CVE: CVE-2002-2109
Published: 2002-12-31
Description: Matt Wright FormMail 1.9 and earlier allows remote attackers to bypass the HTTP_REFERER check and conduct unauthorized activities via (1) a blank referer, (2) a spoofed referer with a trusted domain/URL after the beginning of the referer, or (3) a spoofed referer with a trusted domain/URL in the beginning (hostname) portion of the referer.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0307.html; http://worldwidemart.com/scripts/formmail.shtml; http://www.iss.net/security_center/static/8012.php
CVE: CVE-2002-2110
Published: 2002-12-31
Description: The RCA Digital Cable Modems DCM225 and DCM225E allow remote attackers to cause a denial of service (modem device reset) by connecting to port 80 on the 10.0.0.0/8 device.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0335.html; http://www.iss.net/security_center/static/8661.php; http://www.securityfocus.com/bid/4375
CVE: CVE-2002-2111
Published: 2002-12-31
Description: Fwmon before 1.0.10 allows remote attackers to cause a denial of service (crash) by causing the kernel to return a large packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.scaramanga.co.uk/fwmon/fwmon-1.0.10.tar.gz; http://www.securityfocus.com/bid/3984; https://exchange.xforce.ibmcloud.com/vulnerabilities/8104
CVE: CVE-2002-2112
Published: 2002-12-31
Description: RCA Digital Cable Modem DCM225 and DCM225E, and other modems that must conform to the Data-over-Cable Service Interface Specifications DOCSIS standard, uses the "public" community string for SNMP access, which allows remote attackers to read or write MIB information.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-03/0335.html; http://archives.neohapsis.com/archives/bugtraq/2002-03/0336.html; http://www.iss.net/security_center/static/8662.php
CVE: CVE-2002-2113
Published: 2002-12-31
Description: search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/8032.php; http://www.securiteam.com/securitynews/5WP0R2K60O.html; http://www.securityfocus.com/bid/3985
CVE: CVE-2002-2114
Published: 2002-12-31
Description: Artekopia Netjuke before 1.0 b7 allows remote attackers to execute arbitrary code on the web server, possibly via the section parameter, which is passed to an eval call.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/tracker/index.php?func=detail&aid=507312&group_id=42076&atid=432052; http://www.securityfocus.com/bid/3988; https://exchange.xforce.ibmcloud.com/vulnerabilities/8101
CVE: CVE-2002-2115
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in Hyper NIKKI System (HNS) Lite before 0.9 and HNS before 2.10-pl2 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 4.3 (MEDIUM)
References: http://www.h14m.org/SA/2002/hns-SA-2002-01.txt; http://www.iss.net/security_center/static/8204.php; http://www.securityfocus.com/bid/4102
CVE: CVE-2002-2116
Published: 2002-12-31
Description: Netgear RM-356 and RT-338 series SOHO routers allow remote attackers to cause a denial of service (crash) via a UDP port scan, as demonstrated using nmap.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-02/0162.html; http://archives.neohapsis.com/archives/bugtraq/2002-02/0183.html; http://www.iss.net/security_center/static/8206.php
CVE: CVE-2002-2117
Published: 2002-12-31
Description: Microsoft Windows XP allows remote attackers to cause a denial of service (CPU consumption) by flooding UDP port 500 (ISAKMP).
CVSS Score: 5.0 (MEDIUM)
References: http://www.iss.net/security_center/static/8207.php; http://www.safehack.com/Advisory/sh_XPDOS500.txt; http://www.iss.net/security_center/static/8207.php
CVE: CVE-2002-2118
Published: 2002-12-31
Description: Buffer overflow in Blue World Lasso Web Data Engine 3.6.5 allows remote attackers to cause a denial of service via a long URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]4099&w=2; http://www.iss.net/security_center/static/8208.php; http://www.securiteam.com/windowsntfocus/5NP0B2A6AQ.html
CVE: CVE-2002-2119
Published: 2002-12-31
Description: Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-178
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0273.html; http://www.iss.net/security_center/static/9229.php; http://www.securityfocus.com/bid/4893
CVE: CVE-2002-2120
Published: 2002-12-31
Description: Multiple buffer overflows in QNX RTOS 4.25 may allow attackers to execute arbitrary code via long filename arguments to (1) Watcom or (2) int10.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0292.html; http://archives.neohapsis.com/archives/bugtraq/2002-05/0293.html; http://www.iss.net/security_center/static/9235.php
CVE: CVE-2002-2121
Published: 2002-12-31
Description: SurfControl SuperScout Email filter for SMTP 3.5.1 allows remote attackers to cause a denial of service (crash) via a long SMTP (1) HELO or (2) RCPT TO command, possibly due to a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]8410&w=2; http://www.iss.net/security_center/static/8424.php; http://www.securityfocus.com/bid/4257
CVE: CVE-2002-2122
Published: 2002-12-31
Description: Pointsec before 1.2 for PalmOS stores a user's PIN number in memory in plaintext, which allows a local attacker who steals an unlocked Palm to retrieve the PIN by dumping memory.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0035.html; http://www.iss.net/security_center/static/9021.php; http://www.securityfocus.com/bid/4681
CVE: CVE-2002-2123
Published: 2002-12-31
Description: PHP remote file inclusion vulnerability in publish_xp_docs.php for Gallery 1.3.2 allows remote attackers to inject arbitrary PHP code by specifying a URL to an init.php file in the GALLERY_BASEDIR parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/304611; http://www.securityfocus.com/bid/6489; https://exchange.xforce.ibmcloud.com/vulnerabilities/10943
CVE: CVE-2002-2124
Published: 2002-12-31
Description: The recvn and sendn functions in nylon 0.2 do not check when the recv function call returns 0, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) by closing the connection while recv is executing.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/7281; http://www.security-express.com/archives/bugtraq/2002-10/0146.html; http://www.securityfocus.com/bid/5938
CVE: CVE-2002-2125
Published: 2002-12-31
Description: Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM) attack.
CVSS Score: 6.4 (MEDIUM)
References: http://www.iss.net/security_center/static/10180.php; http://www.securityfocus.com/archive/1/292842; http://www.securityfocus.com/bid/5778
CVE: CVE-2002-2126
Published: 2002-12-31
Description: restrictEnabled in Integrity Protection Driver (IPD) 1.2 delays driver installation for 20 minutes, which allows local users to insert malicious code by setting system clock to an earlier time.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0021.html; http://archives.neohapsis.com/archives/ntbugtraq/2002-q4/0087.html; http://www.iss.net/security_center/static/10745.php
CVE: CVE-2002-2127
Published: 2002-12-31
Description: Integrity Protection Driver (IPD) 1.2 and earlier blocks access to \Device\PhysicalMemory by its name, which could allow local privileged processes to overwrite kernel memory by accessing the device through a symlink.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/ntbugtraq/2002-q4/0087.html; http://www.phrack.org/show.php?p=59&a=16; https://exchange.xforce.ibmcloud.com/vulnerabilities/10747
CVE: CVE-2002-2128
Published: 2002-12-31
Description: editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. (dot dot) sequences in the file parameter.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0222.html; http://archives.neohapsis.com/archives/bugtraq/2002-12/0225.html; http://www.iss.net/security_center/static/10919.php
CVE: CVE-2002-2129
Published: 2002-12-31
Description: Cross-site scripting vulnerability (XSS) in editform.php for w-Agora 4.1.5 allows remote attackers to execute arbitrary web script via an arbitrary form field name containing the script, which is echoed back to the user when displaying the form.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0222.html; http://archives.neohapsis.com/archives/bugtraq/2002-12/0225.html; http://www.securityfocus.com/bid/6464
CVE: CVE-2002-2130
Published: 2002-12-31
Description: publish_xp_docs.php in Gallery 1.3.2 allows remote attackers to execute arbitrary PHP code by modifying the GALLERY_BASEDIR parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0260.html; http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=64&mode=thread&order=0&thold=0; http://www.iss.net/security_center/static/10943.php
CVE: CVE-2002-2131
Published: 2002-12-31
Description: Directory traversal vulnerability in Perl-HTTPd before 1.0.2 allows remote attackers to view arbitrary files via a .. (dot dot) in an unknown argument.
CVSS Score: 5.0 (MEDIUM)
References: http://citrustech.net/~chrisj/perl-httpd/INFO.txt; http://www.iss.net/security_center/static/10992.php; http://www.securityfocus.com/bid/6497
CVE: CVE-2002-2132
Published: 2002-12-31
Description: Windows File Protection (WFP) in Windows 2000 and XP does not remove old security catalog .CAT files, which could allow local users to replace new files with vulnerable old files that have valid hash codes.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0250.html; http://www.iss.net/security_center/static/10957.php; http://www.securityfocus.com/bid/6483
CVE: CVE-2002-2133
Published: 2002-12-31
Description: Telindus 1100 ASDL router running firmware 6.0.x uses weak encryption for UDP session traffic, which allows remote attackers to gain unauthorized access by sniffing and decrypting the administrative password.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0262.html; http://archives.neohapsis.com/archives/bugtraq/2003-02/0277.html; http://www.iss.net/security_center/static/10951.php
CVE: CVE-2002-2134
Published: 2002-12-31
Description: haut.php in PEEL 1.0b allows remote attackers to execute arbitrary PHP code by modifying the dirroot parameter to reference a URL on a remote web server that contains the code in a lang.php file.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/7797; http://www.iss.net/security_center/static/10960.php; http://www.securityfocus.com/archive/1/304779
CVE: CVE-2002-2135
Published: 2002-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-1618.  Reason: This candidate is a duplicate of CVE-2002-1618.  Notes: All CVE users should reference CVE-2002-1618 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2002-2136
Published: 2002-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-1590.  Reason: This candidate is a duplicate of CVE-2002-1590.  Notes: All CVE users should reference CVE-2002-1590 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2002-2137
Published: 2002-12-31
Description: GlobalSunTech Wireless Access Points (1) WISECOM GL2422AP-0T, and possibly OEM products such as (2) D-Link DWL-900AP+ B1 2.1 and 2.2, (3) ALLOY GL-2422AP-S, (4) EUSSO GL2422-AP, and (5) LINKSYS WAP11-V2.2, allow remote attackers to obtain sensitive information like WEP keys, the administrator password, and the MAC filter via a "getsearch" request to UDP port 27155.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/298432; http://www.iss.net/security_center/static/10536.php; http://www.securityfocus.com/bid/6100
CVE: CVE-2002-2138
Published: 2002-12-31
Description: RFC-NETBIOS in HP Advanced Server/9000 B.04.05 through B.04.09, when running HP-UX 11.00 or 11.11, allows remote attackers to cause a denial of service (panic) via a malformed UDP packet on port 139.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/advisories/4268; http://www.iss.net/security_center/static/9536.php; http://www.securityfocus.com/bid/5195
CVE: CVE-2002-2139
Published: 2002-12-31
Description: Cisco PIX Firewall 6.0.3 and earlier, and 6.1.x to 6.1.3, do not delete the duplicate ISAKMP SAs for a user's VPN session, which allows local users to hijack a session via a man-in-the-middle attack.
CVSS Score: 6.4 (MEDIUM)
References: http://www.ciac.org/ciac/bulletins/n-017.shtml; http://www.cisco.com/warp/public/707/pix-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10660.php
CVE: CVE-2002-2140
Published: 2002-12-31
Description: Buffer overflow in Cisco PIX Firewall 5.2.x to 5.2.8, 6.0.x to 6.0.3, 6.1.x to 6.1.3, and 6.2.x to 6.2.1 allows remote attackers to cause a denial of service via HTTP traffic authentication using (1) TACACS+ or (2) RADIUS.
CVSS Score: 5.0 (MEDIUM)
References: http://www.ciac.org/ciac/bulletins/n-017.shtml; http://www.cisco.com/warp/public/707/pix-multiple-vuln-pub.shtml; http://www.iss.net/security_center/static/10661.php
CVE: CVE-2002-2141
Published: 2002-12-31
Description: BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions.
CVSS Score: 7.5 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/39; http://www.iss.net/security_center/static/10291.php; http://www.securityfocus.com/bid/5846
CVE: CVE-2002-2142
Published: 2002-12-31
Description: An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension.
CVSS Score: 7.5 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/3; http://www.iss.net/security_center/static/10392.php; http://www.securityfocus.com/bid/5971
CVE: CVE-2002-2143
Published: 2002-12-31
Description: The admin.html file in MySimple News 1.0 stores its administrative password in plaintext, which allows remote attackers to gain unauthorized access to the web server by viewing the source of admin.html.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/10298.php; http://www.securityfocus.com/archive/1/293871; http://www.securityfocus.com/bid/5866
CVE: CVE-2002-2144
Published: 2002-12-31
Description: Directory traversal vulnerability in BearShare 4.0.5 and 4.0.6 allows remote attackers to read files outside of the web root by hex-encoding the "/" (forward slash) or "." (dot) characters.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/294078; http://www.iss.net/security_center/static/10240.php; http://www.securityfocus.com/bid/5888
CVE: CVE-2002-2145
Published: 2002-12-31
Description: Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/291791; http://www.iss.net/security_center/static/10104.php; http://www.securityfocus.com/bid/5709
CVE: CVE-2002-2146
Published: 2002-12-31
Description: cgitest.exe in Savant Web Server 3.1 and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0151.html; http://www.iss.net/security_center/static/10102.php; http://www.securityfocus.com/bid/5706
CVE: CVE-2002-2147
Published: 2002-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-1828.  Reason: This candidate is a duplicate of CVE-2002-1828.  Notes: All CVE users should reference CVE-2002-1828 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage