deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-2039
Published: 2002-12-31
Description: /bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1726&w=2; http://www.iss.net/security_center/static/9256.php; http://www.securityfocus.com/bid/4914
CVE: CVE-2002-2040
Published: 2002-12-31
Description: The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/275218; http://www.iss.net/security_center/static/9257.php; http://www.securityfocus.com/bid/4915
CVE: CVE-2002-2041
Published: 2002-12-31
Description: Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allows local users to execute arbitrary code via (1) a long ABLANG environment variable in phlocale or (2) a long -u option to pkg-installer.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/275218; http://www.iss.net/security_center/static/9258.php; http://www.iss.net/security_center/static/9259.php
CVE: CVE-2002-2042
Published: 2002-12-31
Description: ptrace in the QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows programs to attach to privileged processes, which could allow local users to execute arbitrary code by modifying running processes.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/275218; http://www.iss.net/security_center/static/9260.php; http://www.securityfocus.com/bid/4919
CVE: CVE-2002-2043
Published: 2002-12-31
Description: SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0020.html; http://www.iss.net/security_center/static/8748.php; http://www.securityfocus.com/bid/4409
CVE: CVE-2002-2044
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in x_stat_admin.php in x-stat 2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the phpinfo action.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/vuln-dev/2002/Mar/0156.html; http://securitytracker.com/id?1003827; http://www.ifrance.com/kitetoua/tuto/x_holes.txt
CVE: CVE-2002-2045
Published: 2002-12-31
Description: x_stat_admin.php in x-stat 2.3 and earlier allows remote attackers to (1) execute PHP commands such as phpinfo or (2) obtain the full path of the web server via an invalid action parameter, which leaks the pathname in an error message.
CVSS Score: 6.4 (MEDIUM)
References: http://seclists.org/lists/vuln-dev/2002/Mar/0156.html; http://securitytracker.com/id?1003827; http://www.ifrance.com/kitetoua/tuto/x_holes.txt
CVE: CVE-2002-2046
Published: 2002-12-31
Description: x_news.php in X-News (x_news) 1.1 and earlier allows remote attackers to gain administrative privileges by stealing and replaying the md5_password cookie.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/lists/vuln-dev/2002/Mar/0156.html; http://www.ifrance.com/kitetoua/tuto/x_holes.txt; http://seclists.org/lists/vuln-dev/2002/Mar/0156.html
CVE: CVE-2002-2047
Published: 2002-12-31
Description: The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1003818; http://sketch.sourceforge.net/oldnews.html#N1; http://www.iss.net/security_center/static/8469.php
CVE: CVE-2002-2048
Published: 2002-12-31
Description: Buffer overflow in PFinger 0.7.8 client allows remote attackers to execute arbitrary code via a long query value passed to the (1) finger program, (2) -l, (3) -d, and (4) -t options.  NOTE: if PFinger is not setuid or setgid, then this issue would not cross privilege boundaries and would not be considered a vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]5055&w=2; http://www.iss.net/security_center/static/9269.php; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]5055&w=2
CVE: CVE-2002-2049
Published: 2002-12-31
Description: configure for Dsniff 2.3, fragroute 1.2, and fragrouter 1.6, when downloaded from monkey.org on May 17, 2002, has been modified to contain a backdoor, which allows remote attackers to access the system.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0281.html; http://www.freebsd.org/cgi/query-pr.cgi?pr=38716; http://www.iss.net/security_center/static/9272.php
CVE: CVE-2002-2050
Published: 2002-12-31
Description: Directory traversal vulnerability in processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a .. (dot dot) in the hostname of a log entry.
CVSS Score: 2.1 (LOW)
References: http://jan.kneschke.de/projects/modlogan/download/ChangeLog; http://www.iss.net/security_center/static/7848.php; http://www.securityfocus.com/bid/3821
CVE: CVE-2002-2051
Published: 2002-12-31
Description: The processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a symlink attack on files specified as hostnames in a log file.
CVSS Score: 2.1 (LOW)
References: http://jan.kneschke.de/projects/modlogan/download/ChangeLog; http://www.iss.net/security_center/static/7848.php; http://www.securityfocus.com/bid/3821
CVE: CVE-2002-2052
Published: 2002-12-31
Description: Cisco 2611 router running IOS 12.1(6.5), possibly an interim release, allows remote attackers to cause a denial of service via port scans such as (1) scanning all ports on a single host and (2) scanning a network of hosts for a single open port through the router.  NOTE: the vendor could not reproduce this issue, saying that the original reporter was using an interim release of the software.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0027.html; http://archives.neohapsis.com/archives/bugtraq/2002-06/0050.html; http://www.iss.net/security_center/static/9281.php
CVE: CVE-2002-2053
Published: 2002-12-31
Description: The design of the Hot Standby Routing Protocol (HSRP), as implemented on Cisco IOS 12.1, when using IRPAS, allows remote attackers to cause a denial of service (CPU consumption) via a router with the same IP address as the interface on which HSRP is running, which causes a loop.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0027.html; http://archives.neohapsis.com/archives/bugtraq/2002-06/0050.html; http://www.iss.net/security_center/static/9283.php
CVE: CVE-2002-2054
Published: 2002-12-31
Description: TeeKai Forum 1.2 allows remote attackers to authenticate as the administrator and and gain privileged web forum access by setting the valid_level cookie to admin.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]3798&w=2; http://www.ifrance.com/kitetoua/tuto/Teekai.txt; http://www.iss.net/security_center/static/9285.php
CVE: CVE-2002-2055
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]3798&w=2; http://www.ifrance.com/kitetoua/tuto/Teekai.txt; http://www.iss.net/security_center/static/9284.php
CVE: CVE-2002-2056
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in TeeKai Forum 1.2 allows remote attackers to inject arbitrary web script or HTML via the valid_username_online cookie.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]3798&w=2; http://www.ifrance.com/kitetoua/tuto/Teekai.txt; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]3798&w=2
CVE: CVE-2002-2057
Published: 2002-12-31
Description: TeeKai Forum 1.2 uses weak encryption of web usage statistics in data/member_log.txt, which is stored under the web document root with insufficient access control, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]3798&w=2; http://www.ifrance.com/kitetoua/tuto/Teekai.txt; http://www.iss.net/security_center/static/9286.php
CVE: CVE-2002-2058
Published: 2002-12-31
Description: TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://online.securityfocus.com/archive/82/275246; http://www.iss.net/security_center/static/9286.php; http://www.securityfocus.com/bid/4926
CVE: CVE-2002-2059
Published: 2002-12-31
Description: BIOS D845BG, D845HV, D845PT and D845WN on Intel motherboards does not properly restrict access to configuration information when BIOS passwords are enabled, which could allow local users to change the default boot device via the F8 key.
CVSS Score: 4.6 (MEDIUM)
References: ftp://download.intel.com/design/motherbd/bg/P06-0027.pdf; ftp://download.intel.com/design/motherbd/hv/P12-0041d.pdf; ftp://download.intel.com/design/motherbd/pt/P06-0027.pdf
CVE: CVE-2002-2060
Published: 2002-12-31
Description: Buffer overflow in Links 2.0 pre4 allows remote attackers to crash client browsers and possibly execute arbitrary code via gamma tables in large 16-bit PNG images.
CVSS Score: 7.5 (HIGH)
References: http://atrey.karlin.mff.cuni.cz/~clock/twibright/links/download/ChangeLog; http://www.iss.net/security_center/static/9287.php; http://www.securityfocus.com/bid/4921
CVE: CVE-2002-2061
Published: 2002-12-31
Description: Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG image with large width and height values and an 8-bit or 16-bit alpha channel.
CVSS Score: 7.5 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=157202; http://www.iss.net/security_center/static/9287.php; http://www.mandriva.com/security/advisories?name=MDKSA-2002:074
CVE: CVE-2002-2062
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP URL.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0037.html; http://www.geocities.co.jp/SiliconValley/1667/advisory02e.html; http://www.iss.net/security_center/static/9290.php
CVE: CVE-2002-2063
Published: 2002-12-31
Description: AtGuard 3.2 allows remote attackers to bypass firwall filters and execute prohibited programs by changing the filenames to permitted filenames.
CVSS Score: 7.5 (HIGH)
References: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-04/0412.html; http://www.iss.net/security_center/static/8962.php; http://www.securityfocus.com/bid/4620
CVE: CVE-2002-2064
Published: 2002-12-31
Description: isadmin.php in PhpWebGallery 1.0 allows remote attackers to gain administrative access via by setting the photo_login cookie to pseudo.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/lists/vuln-dev/2002/Apr/0270.html; http://www.ifrance.com/kitetoua/tuto/PWG.txt; http://www.securityfocus.com/bid/4622
CVE: CVE-2002-2065
Published: 2002-12-31
Description: WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?group_id=3870&release_id=93295; http://www.iss.net/security_center/static/9296.php; http://www.securityfocus.com/bid/4961
CVE: CVE-2002-2066
Published: 2002-12-31
Description: BestCrypt BCWipe 1.0.7 and 2.0 through 2.35.1 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: http://www.bcwipe.com/; http://www.ciac.org/ciac/bulletins/m-034.shtml; http://www.iss.net/security_center/static/7953.php
CVE: CVE-2002-2067
Published: 2002-12-31
Description: East-Tec Eraser 2002 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: http://www.ciac.org/ciac/bulletins/m-034.shtml; http://www.east-tec.com/eraser/faq.htm; http://www.iss.net/security_center/static/7953.php
CVE: CVE-2002-2068
Published: 2002-12-31
Description: Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: http://www.ciac.org/ciac/bulletins/m-034.shtml; http://www.iss.net/security_center/static/7953.php; http://www.securityfocus.com/archive/1/251565
CVE: CVE-2002-2069
Published: 2002-12-31
Description: PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: http://www.ciac.org/ciac/bulletins/m-034.shtml; http://www.iss.net/security_center/static/7953.php; http://www.securityfocus.com/archive/1/251565
CVE: CVE-2002-2070
Published: 2002-12-31
Description: SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: http://www.ciac.org/ciac/bulletins/m-034.shtml; http://www.iss.net/security_center/static/7953.php; http://www.securityfocus.com/archive/1/251565
CVE: CVE-2002-2071
Published: 2002-12-31
Description: Compaq Tru64 4.0 d allows remote attackers to cause a denial of service in (1) telnet, (2) FTP, (3) ypbind, (4) rpc.lockd, (5) snmp, (6) ttdbserverd, and possibly other services via a TCP SYN scan, as demonstrated using nmap.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0357.html; http://www.iss.net/security_center/static/8040.php; http://www.securityfocus.com/bid/4011
CVE: CVE-2002-2072
Published: 2002-12-31
Description: java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.
CVSS Score: 5.0 (MEDIUM)
References: http://ohhara.sarang.net/security/jvmcrash.txt; http://securitytracker.com/id?1003418; http://www.iss.net/security_center/static/8042.php
CVE: CVE-2002-2073
Published: 2002-12-31
Description: Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=vulnwatch&m=[PII_REDACTED]4716&w=2; http://www.iss.net/security_center/static/8050.php; http://www.securityfocus.com/bid/3999
CVE: CVE-2002-2074
Published: 2002-12-31
Description: SQL injection vulnerability in Mailidx before 20020105 allows remote attackers to execute arbitrary SQL commands via the search web page.
CVSS Score: 7.5 (HIGH)
References: http://dl.droso.net/mailidx-20020105.tar.gz; http://securitytracker.com/id?1003269; http://www.iss.net/security_center/static/7965.php
CVE: CVE-2002-2075
Published: 2002-12-31
Description: ICQ 2001a and 2002b allows remote attackers to cause a denial of service (memory consumption and hang) via a contact message with a large contacts number.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0295.html; http://www.iss.net/security_center/static/8909.php; http://archives.neohapsis.com/archives/bugtraq/2002-04/0295.html
CVE: CVE-2002-2076
Published: 2002-12-31
Description: Directory traversal vulnerability in Lil' HTTP server 2.1 and 2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0316.html; http://www.iss.net/security_center/static/8913.php; http://www.securityfocus.com/bid/4576
CVE: CVE-2002-2077
Published: 2002-12-31
Description: The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
CVSS Score: 5.0 (MEDIUM)
References: http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq300367; http://www.bindview.com/Services/razor/Advisories/2002/adv_dcom.cfm; http://www.iss.net/security_center/static/8739.php
CVE: CVE-2002-2078
Published: 2002-12-31
Description: Heap-based buffer overflow in Floositek (1) FTGate Pro 1.05 and (2) FTGate Office 1.05 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0053.html; http://www.ftgate.com/knwldgbs/hotfix.htm; http://www.iss.net/security_center/static/8749.php
CVE: CVE-2002-2079
Published: 2002-12-31
Description: mosix-protocol-stack in Multicomputer Operating System for UnIX (MOSIX) 1.5.7 allows remote attackers to cause a denial of service via malformed packets.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0327.html; http://www.iss.net/security_center/static/8927.php; http://www.securityfocus.com/bid/4580
CVE: CVE-2002-2080
Published: 2002-12-31
Description: Floositek FTGate PRO 1.05 allows remote attackers to cause a denial of service (memory and CPU consumption) via a large number of RCPT TO: messages during an SMTP session.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0053.html; http://www.ftgate.com/knwldgbs/hotfix.htm; http://www.iss.net/security_center/static/8750.php
CVE: CVE-2002-2081
Published: 2002-12-31
Description: cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html; http://www.iss.net/security_center/static/8053.php; http://www.securityfocus.com/bid/4002
CVE: CVE-2002-2082
Published: 2002-12-31
Description: FTGate and FTGate Pro 1.05 lock user mailboxes before authentication succeeds, which allows remote attackers to lock the mailboxes of other users.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0053.html; http://www.iss.net/security_center/static/8751.php; http://www.securityfocus.com/bid/4429
CVE: CVE-2002-2083
Published: 2002-12-31
Description: The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help feature, which can be launched from the Novell Netware login screen.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-01/0151.html; http://archives.neohapsis.com/archives/bugtraq/2002-01/0151.html
CVE: CVE-2002-2084
Published: 2002-12-31
Description: Directory traversal vulnerability in index.php of Portix 0.4.02 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) l and (2) topic parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vuln-dev/2002-q1/0279.html; http://securitytracker.com/id?1003430; http://www.securityfocus.com/bid/4038
CVE: CVE-2002-2085
Published: 2002-12-31
Description: Directory traversal vulnerability in page.cgi of WWWeBBB Forum 3.82 beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vuln-dev/2002-q1/0369.html; http://securitytracker.com/id?1003456; http://archives.neohapsis.com/archives/vuln-dev/2002-q1/0369.html
CVE: CVE-2002-2086
Published: 2002-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via (1) "<<script" in unspecified input fields or (2) a javascript: URL in the src attribute of an IMG tag.
CVSS Score: 4.3 (MEDIUM)
References: http://sourceforge.net/tracker/index.php?func=detail&aid=544658&group_id=311&atid=100311; http://sourceforge.net/tracker/index.php?func=detail&aid=545933&group_id=311&atid=100311; http://www.securityfocus.com/bid/4666
CVE: CVE-2002-2087
Published: 2002-12-31
Description: Buffer overflow in Borland InterBase 6.0 allows local users to execute arbitrary code via a long INTERBASE environment variable when calling (1) gds_drop, (2) gds_lock_mgr, or (3) gds_inet_server.
CVSS Score: 4.6 (MEDIUM)
References: http://cert.uni-stuttgart.de/archive/bugtraq/2002/06/msg00222.html; http://www.iss.net/security_center/static/9392.php; http://www.securityfocus.com/bid/5044
CVE: CVE-2002-2088
Published: 2002-12-31
Description: The MOSIX Project clump/os 5.4 creates a default VNC account without a password, which allows remote attackers to gain root access.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-04/0327.html; http://www.iss.net/security_center/static/8928.php; http://www.securityfocus.com/bid/4581
CVE: CVE-2002-2089
Published: 2002-12-31
Description: Buffer overflow in rcp in Solaris 9.0 allows local users to execute arbitrary code via a long command line argument.
CVSS Score: 4.6 (MEDIUM)
References: http://cert.uni-stuttgart.de/archive/vuln-dev/2002/06/msg00262.html; http://www.iss.net/security_center/static/9411.php; http://www.securityfocus.com/bid/5085
CVE: CVE-2002-2090
Published: 2002-12-31
Description: Caucho Technology Resin server 2.1.1 to 2.1.2 allows remote attackers to obtain server's root path via requests for MS-DOS device names such as lpt9.xtp.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/bugtraq/2002/Jul/0186.html; http://www.securityfocus.com/bid/5252; http://seclists.org/bugtraq/2002/Jul/0186.html
CVE: CVE-2002-2091
Published: 2002-12-31
Description: Format string vulnerability in Deception Finger Daemon, decfingerd, 0.7 may allow remote attackers to execute arbitrary code via the username of a finger request.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0314.html; http://www.iss.net/security_center/static/9434.php; http://www.securityfocus.com/bid/5105
CVE: CVE-2002-2092
Published: 2002-12-31
Description: Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.
CVSS Score: 3.7 (LOW)
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:08.exec.asc; ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-001.txt.asc; http://www.osvdb.org/19475