deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1931
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in PHP Arena paFileDB 1.1.3 and 2.1.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the search string.
CVSS Score: 4.3 (MEDIUM)
References: http://online.securityfocus.com/archive/1/296387; http://www.iss.net/security_center/static/10451.php; http://www.phparena.net/downloads/pafiledb.php?action=license&id=1&file=16
CVE: CVE-2002-1932
Published: 2002-12-31
Description: Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events (clear log manually)" option is set, does not notify the administrator when the log reaches its maximum size, which allows local users and remote attackers to avoid detection.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/295341; http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3B329350; http://www.iss.net/security_center/static/10377.php
CVE: CVE-2002-1933
Published: 2002-12-31
Description: The terminal services screensaver for Microsoft Windows 2000 does not automatically lock the terminal window if the window is minimized, which could allow local users to gain access to the terminal server window.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/288415; http://www.iss.net/security_center/static/9946.php; http://www.securityfocus.com/bid/5535
CVE: CVE-2002-1934
Published: 2002-12-31
Description: Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 2.0.1 leaks sensitive information during boot-up, which allows attackers to obtain the MD5 hash of the Admin password, MD5 hash of the physical password, and other registration information.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/288383; http://www.iss.net/security_center/static/9948.php; http://www.securityfocus.com/bid/5534
CVE: CVE-2002-1935
Published: 2002-12-31
Description: Pingtel Xpressa 1.2.5 through 2.0.1 uses predictable (1) Call-ID, (2) CSeq, and (3) "To" and "From" SIP URL values in a Session Identification Protocol (SIP) request, which allows remote attackers to avoid registering with the SIP registrar.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/288383; http://www.iss.net/security_center/static/9949.php; http://www.securityfocus.com/bid/5537
CVE: CVE-2002-1936
Published: 2002-12-31
Description: UTStarcom BAS 1000 3.1.10 creates several default or back door accounts and passwords, which allows remote attackers to gain access via (1) field account with a password of "*field", (2) guru account with a password of "*3noguru", (3) snmp account with a password of "snmp", or (4) dbase account with a password of "dbase".
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/288866; http://www.iss.net/security_center/static/9951.php; http://www.securityfocus.com/bid/5564
CVE: CVE-2002-1937
Published: 2002-12-31
Description: Symantec Firewall/VPN Appliance 100 through 200R hardcodes the administrator's MAC address inside the firewall's configuration, which allows remote attackers to spoof the administrator's MAC address and perform an ARP poisoning man-in-the-middle attack to obtain the administrator's password.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0314.html; http://archives.neohapsis.com/archives/bugtraq/2002-10/0329.html; http://www.iss.net/security_center/static/10442.php
CVE: CVE-2002-1938
Published: 2002-12-31
Description: Virgil CGI Scanner 0.9 allows remote attackers to execute arbitrary commands via the (1) tar (TARGET) or (2) zielport (ZIELPORT) parameters.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/296635; http://www.iss.net/security_center/static/10444.php; http://www.securityfocus.com/bid/6031
CVE: CVE-2002-1939
Published: 2002-12-31
Description: FlashFXP 1.4 prints FTP passwords in plaintext when there are transfers in the queue, which allows attackers to obtain FTP passwords of other users by editing the queue properties.
CVSS Score: 2.1 (LOW)
References: http://online.securityfocus.com/archive/1/296658; http://www.iss.net/security_center/static/10445.php; http://www.securityfocus.com/bid/6032
CVE: CVE-2002-1940
Published: 2002-12-31
Description: LCC-Win32 3.2 compiler, when running on Windows 95, 98, or ME, writes portions of previously used memory after the import table, which could allow attackers to gain sensitive information.  NOTE: it has been reported that this problem is due to the OS and not the application.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0504.html; http://www.iss.net/security_center/static/9749.php; http://www.securityfocus.com/bid/5391
CVE: CVE-2002-1941
Published: 2002-12-31
Description: Buffer overflow in RadioBird WebServer 4 Everyone 1.28 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request with the Host header set.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/296759; http://www.iss.net/security_center/static/10447.php; http://www.securityfocus.com/bid/6034
CVE: CVE-2002-1942
Published: 2002-12-31
Description: Imatix Xitami 2.5 b5 does not properly terminate certain Keep-Alive connections that have been broken or closed early, which allows remote attackers to cause a denial of service (crash) via a large number of concurrent sessions.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0507.html; http://archives.neohapsis.com/archives/bugtraq/2002-07/0516.html; http://www.iss.net/security_center/static/9751.php
CVE: CVE-2002-1943
Published: 2002-12-31
Description: SafeTP 1.46, when network address translation (NAT) is being used, leaks the internal IP address of the FTP server in a response to a passive mode (PASV) file transfer request.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/293443; http://www.iss.net/security_center/static/10210.php; http://www.securityfocus.com/bid/5822
CVE: CVE-2002-1944
Published: 2002-12-31
Description: Motorola Surfboard 4200 cable modem allows remote attackers to cause a denial of service (crash) by performing a SYN scan using a tool such as nmap.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0429.html; http://www.iss.net/security_center/static/10513.php; http://archives.neohapsis.com/archives/bugtraq/2002-10/0429.html
CVE: CVE-2002-1945
Published: 2002-12-31
Description: Buffer overflow in SmartMail Server 1.0 Beta 10 allows remote attackers to cause a denial of service (crash) via a long request to (1) TCP port 25 (SMTP) or (2) TCP port 110 (POP3).
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0418.html; http://www.iss.net/security_center/static/10512.php; http://www.securityfocus.com/bid/6075
CVE: CVE-2002-1946
Published: 2002-12-31
Description: Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software 1.2.000, when the "Save Password" option is used, stores the password with a weak encryption scheme (one-to-one mapping) in a registry key, which allows local users to obtain and decrypt the password.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-326
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0438.html; http://www.iss.net/security_center/static/10517.php; http://archives.neohapsis.com/archives/bugtraq/2002-10/0438.html
CVE: CVE-2002-1947
Published: 2002-12-31
Description: Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session.
CVSS Score: 6.4 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc; http://www.iss.net/security_center/static/10381.php; http://www.securityfocus.com/bid/5936
CVE: CVE-2002-1948
Published: 2002-12-31
Description: Multiple buffer overflows in Gringotts 0.5.9 allows local users to execute arbitrary commands via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://www.iss.net/security_center/static/9882.php; http://www.securityfocus.com/bid/5488; http://www.iss.net/security_center/static/9882.php
CVE: CVE-2002-1949
Published: 2002-12-31
Description: The Network Attached Storage (NAS) Administration Web Page for Iomega NAS A300U transmits passwords in cleartext, which allows remote attackers to sniff the administrative password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0440.html; http://www.iss.net/security_center/static/10521.php; http://www.securityfocus.com/bid/6092
CVE: CVE-2002-1950
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML via the (1) the email parameter of add.php or (2) the banner URL (banurl parameter) in the main list.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0148.html; http://www.iss.net/security_center/static/10351.php; http://www.securityfocus.com/bid/5946
CVE: CVE-2002-1951
Published: 2002-12-31
Description: Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirectories.
CVSS Score: 7.5 (HIGH)
References: http://freecode.com/projects/embedthis-goahead-webserver/releases/343539; http://osvdb.org/81099; http://www.iss.net/security_center/static/9884.php
CVE: CVE-2002-1952
Published: 2002-12-31
Description: phpRank 1.8 does not properly check the return codes for MySQL operations when authenticating users, which could allow remote attackers to authenticate using a NULL password when database errors occur or if the database is unavailable.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0148.html; http://www.iss.net/security_center/static/10353.php; http://www.securityfocus.com/bid/5948
CVE: CVE-2002-1953
Published: 2002-12-31
Description: Heap-based buffer overflow in the goim handler of AOL Instant Messenger (AIM) 4.4 through 4.8.2616 allows remote attackers to cause a denial of service (crash) via escaping of the screen name parameter, which triggers the overflow when the user selects "Get Info" on the buddy.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/288980; http://www.iss.net/security_center/static/9950.php; http://www.securityfocus.com/bid/5492
CVE: CVE-2002-1954
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the query string argument, as demonstrated using soinfo.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2003-06/0027.html; http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0021.html; http://www.iss.net/security_center/static/10355.php
CVE: CVE-2002-1955
Published: 2002-12-31
Description: Iomega NAS A300U uses cleartext LANMAN authentication when mounting CIFS/SMB drives, which allows remote attackers to perform a man-in-the-middle attack.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0440.html; http://www.iss.net/security_center/static/10523.php; http://www.securityfocus.com/bid/6093
CVE: CVE-2002-1956
Published: 2002-12-31
Description: ROX Filer 1.1.9 and 1.2 is installed with world writable permissions, which allows local users to write to arbitrary files.
CVSS Score: 2.1 (LOW)
References: http://www.iss.net/security_center/static/9504.php; http://www.securityfocus.com/bid/5172; http://www.iss.net/security_center/static/9504.php
CVE: CVE-2002-1957
Published: 2002-12-31
Description: Buffer overflow in the netlog function in pen.c for Pen 0.9.1 and 0.9.2 allows remote attackers to execute arbitrary commands via malformed log messages.
CVSS Score: 7.5 (HIGH)
References: http://siag.nu/pen/news-0.9.3.shtml; http://www.iss.net/security_center/static/9505.php; http://www.securityfocus.com/bid/5152
CVE: CVE-2002-1958
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in kmMail 1.0, 1.0a, and 1.0b allows remote attackers to inject arbitrary web script or HTML via (1) javascript in onmouseover or other attributes in "safe" HTML tags such as the "b" tag, or (2) the Subject field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html; http://sourceforge.net/forum/forum.php?forum_id=191501; http://www.iss.net/security_center/static/9507.php
CVE: CVE-2002-1959
Published: 2002-12-31
Description: Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.
CVSS Score: 10.0 (HIGH)
References: http://www.iss.net/security_center/static/9508.php; http://www.nagios.org/changelog.php; http://www.securityfocus.com/bid/5174
CVE: CVE-2002-1960
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in Cybozu Share360 1.1 allows remote attackers to inject arbitrary web script or HTML via an HTML link.
CVSS Score: 4.3 (MEDIUM)
References: http://www.iss.net/security_center/static/9510.php; http://www.securityfocus.com/bid/5151; http://www.share360.com/products/s360/Release_Notes.html
CVE: CVE-2002-1961
Published: 2002-12-31
Description: Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL whose hostname portion uses a fully qualified domain name (FQDN) that ends in a "." (dot).
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0032.html; http://archives.neohapsis.com/archives/bugtraq/2002-09/0043.html; http://www.iss.net/security_center/static/10037.php
CVE: CVE-2002-1962
Published: 2002-12-31
Description: Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL with an IP address instead of a hostname.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0032.html; http://archives.neohapsis.com/archives/bugtraq/2002-09/0043.html; http://www.iss.net/security_center/static/10038.php
CVE: CVE-2002-1963
Published: 2002-12-31
Description: Linux kernel 2.4.1 through 2.4.19 sets root's NR_RESERVED_FILES limit to 10 files, which allows local users to cause a denial of service (resource exhaustion) by opening 10 setuid binaries.
CVSS Score: 2.1 (LOW)
References: http://online.securityfocus.com/archive/1/281100; http://www.iss.net/security_center/static/9515.php; http://www.securityfocus.com/archive/1/281359
CVE: CVE-2002-1964
Published: 2002-12-31
Description: Unknown vulnerability in WesMo phpEventCalendar 1.1 allows remote attackers to execute arbitrary commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/5021; http://www.securityfocus.com/bid/5021
CVE: CVE-2002-1965
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to inject arbitrary web script or HTML via the (1) Javascript events, as demonstrated via an onerror event in an IMG SRC tag or (2) User-Agent field in an HTTP GET request.
CVSS Score: 4.3 (MEDIUM)
References: http://online.securityfocus.com/archive/1/277058; http://online.securityfocus.com/archive/1/279269; http://www.securityfocus.com/bid/5025
CVE: CVE-2002-1966
Published: 2002-12-31
Description: Directory traversal vulnerability in magiccard.cgi in My Postcards Platinum 5.0 and 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://packetstormsecurity.nl/0206-exploits/magiccard_vuln.txt; http://www.securiteam.com/unixfocus/5IP0G2K7FQ.html; http://www.securityfocus.com/bid/5029
CVE: CVE-2002-1967
Published: 2002-12-31
Description: Buffer overflow in XiRCON 1.0 Beta 4 allows remote attackers to cause a denial of service (disconnect) via a long (1) ctcp, (2) primsg, (3) msg, or (4) notice command.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0005.html; http://www.iss.net/security_center/static/9516.php; http://www.securityfocus.com/bid/5185
CVE: CVE-2002-1968
Published: 2002-12-31
Description: Com21 DOXport 1100 series cable modem running firmware 2.1.1.106, and possibly other versions before 2.1.1.108.003, downloads a DOCSIS configuration file from a TFTP server running on the internal network, which allows local users to modify configuration of the modem via a malicious TFTP server.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-12/0017.html; http://securitytracker.com/id?1005524; http://www.iss.net/security_center/static/10543.php
CVE: CVE-2002-1969
Published: 2002-12-31
Description: Magic Notebook 1.0b and 1.1b allows remote attackers to cause a denial of service (crash) via an invalid username during login.
CVSS Score: 5.0 (MEDIUM)
References: http://www.iss.net/security_center/static/10562.php; http://www.securityfocus.com/bid/6106; http://www.iss.net/security_center/static/10562.php
CVE: CVE-2002-1970
Published: 2002-12-31
Description: SnortCenter 0.9.5, when configured to push Snort rules, stores the rules in a temporary file with world-readable and world-writable permissions, which allows local users to obtain usernames and passwords for the alert database servers.
CVSS Score: 2.1 (LOW)
References: http://online.securityfocus.com/archive/1/298587; http://www.iss.net/security_center/static/10540.php; http://www.securityfocus.com/bid/6109
CVE: CVE-2002-1971
Published: 2002-12-31
Description: The ping utility in networking_utils.php in Sourcecraft Networking_Utils 1.0 allows remote attackers to read arbitrary files via shell metacharacters in the Domain name or IP address argument.
CVSS Score: 10.0 (HIGH)
References: http://online.securityfocus.com/archive/1/298588; http://securitytracker.com/id?1005543; http://www.iss.net/security_center/static/10541.php
CVE: CVE-2002-1972
Published: 2002-12-31
Description: Unknown vulnerability in Parallel port powerSwitch (aka pp_powerSwitch) 0.1 does not properly enforce access controls, which allows local users to access arbitrary ports.
CVSS Score: 4.6 (MEDIUM)
References: http://freshmeat.net/releases/101529/; http://securitytracker.com/id?1005534; http://www.iss.net/security_center/static/10552.php
CVE: CVE-2002-1973
Published: 2002-12-31
Description: Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0, and 6.0 before SP3, as used in multiple products including BadBlue, allows remote attackers to cause a denial of service (access violation and crash) and possibly execute arbitrary code via a long query string that causes a parsing error.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0082.html; http://archives.neohapsis.com/archives/bugtraq/2002-07/0135.html; http://archives.neohapsis.com/archives/bugtraq/2002-07/0144.html
CVE: CVE-2002-1974
Published: 2002-12-31
Description: The FTP service in Zaurus PDAs SL-5000D and SL-5500 does not require authentication, which allows remote attackers to access the file system as root.
CVSS Score: 10.0 (HIGH)
References: http://online.securityfocus.com/archive/1/281437; http://www.iss.net/security_center/static/9534.php; http://www.securityfocus.com/archive/1/281549
CVE: CVE-2002-1975
Published: 2002-12-31
Description: Sharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password as stored in the Security.conf file, which makes it easier for local users to guess the password via brute force methods.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: http://online.securityfocus.com/archive/1/281437; http://www.iss.net/security_center/static/9535.php; http://www.securityfocus.com/bid/5201
CVE: CVE-2002-1976
Published: 2002-12-31
Description: ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKET_MR_PROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0279.html; http://online.securityfocus.com/archive/1/284142; http://online.securityfocus.com/archive/1/284257
CVE: CVE-2002-1977
Published: 2002-12-31
Description: Network Associates PGP 7.0.4 and 7.1 does not time out according to the value set in the "Passphrase Cache" option, which could allow attackers to open encrypted files without providing a passphrase.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0313.html; http://archives.neohapsis.com/archives/bugtraq/2002-07/0322.html; http://www.iss.net/security_center/static/9690.php
CVE: CVE-2002-1978
Published: 2002-12-31
Description: IPFilter 3.1.1 through 3.4.28 allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-024.txt.asc; http://securitytracker.com/id?1005442; http://www.iss.net/security_center/static/10409.php
CVE: CVE-2002-1979
Published: 2002-12-31
Description: WatchGuard SOHO products running firmware 5.1.6 and earlier, and Vclass/RSSA using 3.2 SP1 and earlier, allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/328867; http://www.kb.cert.org/vuls/id/AAMN-5EQR65; http://www.kb.cert.org/vuls/id/328867
CVE: CVE-2002-1980
Published: 2002-12-31
Description: Buffer overflow in Volume Manager daemon (vold) of Sun Solaris 2.5.1 through 8 allows local users to execute arbitrary code via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F45707; http://www.iss.net/security_center/static/9545.php; http://www.securityfocus.com/bid/5207
CVE: CVE-2002-1981
Published: 2002-12-31
Description: Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2002/Sep/0009.html; http://www.iss.net/security_center/static/10012.php; http://www.ngssoftware.com/advisories/mssql-sp_MSSetServerProperties.txt
CVE: CVE-2002-1982
Published: 2002-12-31
Description: Directory traversal vulnerability in the list_directory function in Icecast 1.3.12 allows remote attackers to determine if a directory exists via a .. (dot dot) in the GET request, which returns different error messages depending on whether the directory exists or not.
CVSS Score: 5.0 (MEDIUM)
References: http://www.iss.net/security_center/static/9530.php; http://www.securityfocus.com/archive/82/281274; http://www.securityfocus.com/bid/5189
CVE: CVE-2002-1983
Published: 2002-12-31
Description: The timer implementation in QNX RTOS 6.1.0 allows local users to cause a denial of service (hang) and possibly execute arbitrary code by creating multiple timers with a 1-ms tick.
CVSS Score: 2.1 (LOW)
References: http://online.securityfocus.com/archive/1/298689; http://www.securityfocus.com/bid/6114; https://exchange.xforce.ibmcloud.com/vulnerabilities/10550