deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1518
Published: 2003-04-02
Description: mv in IRIX 6.5 creates a directory with world-writable permissions while moving a directory, which could allow local users to modify files and directories.
CVSS Score: 3.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20020903-01-P; http://www.ciac.org/ciac/bulletins/n-004.shtml; http://www.iss.net/security_center/static/10276.php
CVE: CVE-2002-1519
Published: 2003-04-02
Description: Format string vulnerability in the CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the password parameter.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0325.html; http://archives.neohapsis.com/archives/bugtraq/2002-09/0335.html; http://www.iss.net/security_center/static/10217.php
CVE: CVE-2002-1520
Published: 2003-04-02
Description: The CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, does not properly close the SSH connection when a -N option is provided during authentication, which allows remote attackers to access CLI with administrator privileges.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0325.html; http://archives.neohapsis.com/archives/bugtraq/2002-09/0335.html; http://www.iss.net/security_center/static/10218.php
CVE: CVE-2002-1521
Published: 2003-04-02
Description: Web Server 4D (WS4D) 3.6 stores passwords in plaintext in the Ws4d.4DD file, which allows attackers to gain privileges.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0128.html; http://www.iss.net/security_center/static/10198.php; http://www.securityfocus.com/bid/5803
CVE: CVE-2002-1522
Published: 2003-04-02
Description: Buffer overflow in PowerFTP FTP server 2.24, and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long USER argument.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0075.html; http://archives.neohapsis.com/archives/bugtraq/2002-10/0194.html; http://www.iss.net/security_center/static/10286.php
CVE: CVE-2002-1523
Published: 2003-04-02
Description: Directory traversal vulnerability in Daniel Arenz Mini Server 2.1.6 allows remote attackers to read arbitrary files via (1) ../ (dot-dot slash) or (2) ..\ (dot-dot backslash) sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0181.html; http://www.da-home.de/miniserver/update.html; http://www.iss.net/security_center/static/10366.php
CVE: CVE-2002-1524
Published: 2003-04-02
Description: Buffer overflow in XML parser in wsabi.dll of Winamp 3 (1.0.0.488) allows remote attackers to execute arbitrary code via a skin file (.wal) with a long include file tag.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0346.html; http://www.iss.net/security_center/static/10228.php; http://www.securityfocus.com/bid/5832
CVE: CVE-2002-1525
Published: 2003-04-02
Description: Directory traversal vulnerability in ASTAware SearchDisk engine for Sun ONE Starter Kit 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack on port (1) 6015 or (2) 6016, or (3) an absolute pathname to port 6017.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/293545; http://www.iss.net/security_center/static/10225.php; http://www.securityfocus.com/bid/5828
CVE: CVE-2002-1526
Published: 2003-04-02
Description: Cross-site scripting (XSS) vulnerability in emumail.cgi for EMU Webmail 5.0 allows remote attackers to inject arbitrary HTML or script via the email address field.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0131.html; http://www.iss.net/security_center/static/10205.php; http://www.securityfocus.com/bid/5824
CVE: CVE-2002-1527
Published: 2003-04-02
Description: emumail.cgi in EMU Webmail 5.0 allows remote attackers to determine the full pathname for emumail.cgi via a malformed string containing script, which generates a regular expression matching error that includes the pathname in the resulting error message.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0131.html; http://www.iss.net/security_center/static/10204.php; http://www.iss.net/security_center/static/10205.php
CVE: CVE-2002-1528
Published: 2003-04-02
Description: MsmMask.exe in MondoSearch 4.4 allows remote attackers to obtain the source code of scripts via the mask parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0147.html; http://www.iss.net/security_center/static/10350.php; http://www.securityfocus.com/bid/5941
CVE: CVE-2002-1561
Published: 2003-04-02
Description: The RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/261537; http://www.securityfocus.com/archive/1/296114/2002-10-14/2002-10-20/0; http://www.securityfocus.com/bid/6005
CVE: CVE-2003-0072
Published: 2003-04-02
Description: The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (aka "array overrun").
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-54042-1; http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt; http://www.debian.org/security/2003/dsa-266
CVE: CVE-2003-0082
Published: 2003-04-02
Description: The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-54042-1; http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt; http://www.debian.org/security/2003/dsa-266
CVE: CVE-2003-0083
Published: 2003-04-02
Description: Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_log_config.c?only_with_tag=APACHE_1_3_25; http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/loggers/mod_log_config.c?only_with_tag=APACHE_2_0_BRANCH; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1678&w=2
CVE: CVE-2003-0091
Published: 2003-04-02
Description: Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0162.html; http://packetstormsecurity.org/0304-advisories/sa2003-02.txt; http://sunsolve.sun.com/search/document.do?assetkey=1-26-52443-1
CVE: CVE-2003-0092
Published: 2003-04-02
Description: Heap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0163.html; http://sunsolve.sun.com/search/document.do?assetkey=1-26-52388-1; http://www.securityfocus.com/archive/1/316948/30/25250/threaded
CVE: CVE-2003-0106
Published: 2003-04-02
Description: The HTTP proxy for Symantec Enterprise Firewall (SEF) 7.0 allows proxy users to bypass pattern matching for blocked URLs via requests that are URL-encoded with escapes, Unicode, or UTF-8.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0152.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2233&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]6289&w=2
CVE: CVE-2003-0141
Published: 2003-04-02
Description: The PNG deflate algorithm in RealOne Player 6.0.11.x and earlier, RealPlayer 8/RealPlayer Plus 8 6.0.9.584, and other versions allows remote attackers to corrupt the heap and overwrite arbitrary memory via a PNG graphic file format containing compressed data using fixed trees that contain the length values 286-287, which are treated as a very large length.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0156.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7579&w=2; http://www.coresecurity.com/common/showdoc.php?idx=311&idxseccion=10
CVE: CVE-2003-0152
Published: 2003-04-02
Description: Unknown vulnerability in bonsai Mozilla CVS query tool allows remote attackers to execute arbitrary commands as the www-data user.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2003/dsa-265; http://www.securityfocus.com/bid/7162; http://www.debian.org/security/2003/dsa-265
CVE: CVE-2003-0153
Published: 2003-04-02
Description: bonsai Mozilla CVS query tool leaks the absolute pathname of the tool in certain error messages generated by (1) cvslog.cgi, (2) cvsview2.cgi, or (3) multidiff.cgi.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=187230; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1054&w=2; http://www.debian.org/security/2003/dsa-265
CVE: CVE-2003-0154
Published: 2003-04-02
Description: Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.
CVSS Score: 6.8 (MEDIUM)
References: http://bugzilla.mozilla.org/attachment.cgi?id=95950&action=view; http://bugzilla.mozilla.org/attachment.cgi?id=95985&action=view; http://bugzilla.mozilla.org/show_bug.cgi?id=146244
CVE: CVE-2003-0155
Published: 2003-04-02
Description: bonsai Mozilla CVS query tool allows remote attackers to gain access to the parameters page without authentication.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2003/dsa-265; http://www.securityfocus.com/bid/7163; http://www.debian.org/security/2003/dsa-265
CVE: CVE-2003-0159
Published: 2003-04-02
Description: Heap-based buffer overflow in the NTLMSSP code for Ethereal 0.9.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4709&w=2; http://www.ethereal.com/appnotes/enpa-sa-00008.html; http://www.mandriva.com/security/advisories?name=MDKSA-2003:051
CVE: CVE-2003-0160
Published: 2003-04-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web browser.
CVSS Score: 5.8 (MEDIUM)
References: http://sourceforge.net/mailarchive/forum.php?thread_id=1641953&forum_id=1988; http://www.redhat.com/support/errata/RHSA-2003-112.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A614
CVE: CVE-2003-0161
Published: 2003-04-02
Description: The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-016.0.txt; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:07.sendmail.asc; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt
CVE: CVE-2003-0162
Published: 2003-04-02
Description: Ecartis 1.0.0 (formerly listar) before snapshot 20030227 allows remote attackers to reset passwords of other users and gain privileges by modifying hidden form fields in the HTML page.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4262&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8323&w=2; http://www.debian.org/security/2003/dsa-271
CVE: CVE-2003-0165
Published: 2003-04-02
Description: Format string vulnerability in Eye Of Gnome (EOG) allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0157.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4146&w=2; http://www.coresecurity.com/common/showdoc.php?idx=312&idxseccion=10
CVE: CVE-2003-0166
Published: 2003-04-02
Description: Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly other functions.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000691; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6885&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9467&w=2
CVE: CVE-2003-0167
Published: 2003-04-02
Description: Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than CVE-2003-0140.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2003/dsa-274; http://www.debian.org/security/2003/dsa-300; http://www.securityfocus.com/bid/7229
CVE: CVE-2003-0168
Published: 2003-04-02
Description: Buffer overflow in Apple QuickTime Player 5.x and 6.0 for Windows allows remote attackers to execute arbitrary code via a long QuickTime URL.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0166.html; http://lists.apple.com/mhonarc/security-announce/msg00027.html; http://www.idefense.com/advisory/03.31.03.txt
CVE: CVE-2003-0172
Published: 2003-04-02
Description: Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, allows remote attackers to cause a crash and possibly execute arbitrary code via a long filename argument.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0152&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7111&w=2; http://www.osvdb.org/2113
CVE: CVE-2003-0178
Published: 2003-04-02
Description: Multiple buffer overflows in Lotus Domino Web Server before 6.0.1 allow remote attackers to cause a denial of service or execute arbitrary code via (1) the s_ViewName option in the PresetFields parameter for iNotes, (2) the Foldername option in the PresetFields parameter for iNotes, or (3) a long Host header, which is inserted into a long Location header and used during a redirect operation.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0080.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0081.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0082.html
CVE: CVE-2003-0179
Published: 2003-04-02
Description: Buffer overflow in the COM Object Control Handler for Lotus Domino 6.0.1 and earlier allows remote attackers to execute arbitrary code via multiple attack vectors, as demonstrated using the InitializeUsingNotesUserName method in the iNotes ActiveX control.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0082.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2513&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3136&w=2
CVE: CVE-2003-0180
Published: 2003-04-02
Description: Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via an incomplete POST request, as demonstrated using the h_PageUI form.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0086.html; http://www-1.ibm.com/support/docview.wss?uid=swg21104528; http://www.cert.org/advisories/CA-2003-11.html
CVE: CVE-2003-0181
Published: 2003-04-02
Description: Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via a "Fictionary Value Field POST request" as demonstrated using the s_Validation form with a long, unknown parameter name.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0086.html; http://www-1.ibm.com/support/docview.wss?uid=swg21104528; http://www.cert.org/advisories/CA-2003-11.html
CVE: CVE-2002-0690
Published: 2003-04-11
Description: Format string vulnerability in McAfee Security ePolicy Orchestrator (ePO) 2.5.1 allows remote attackers to execute arbitrary code via an HTTP GET request with a URI containing format strings.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/8311; http://www.atstake.com/research/advisories/2003/a031703-1.txt; http://www.osvdb.org/4375
CVE: CVE-2002-1143
Published: 2003-04-11
Description: Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4999&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6401&w=2; http://www.iss.net/security_center/static/10008.php
CVE: CVE-2002-1406
Published: 2003-04-11
Description: Unknown vulnerability in passwd for VVOS HP-UX 11.04, with unknown impact, related to "Unexpected behavior."
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/hp/2002-q3/0049.html; http://www.iss.net/security_center/static/9847.php; http://www.securityfocus.com/bid/5454
CVE: CVE-2002-1407
Published: 2003-04-11
Description: TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0096.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1995&w=2; http://www.securityfocus.com/bid/5410
CVE: CVE-2002-1408
Published: 2003-04-11
Description: Unknown vulnerability or vulnerabilities in HP OpenView EMANATE 14.2 snmpModules allow the SNMP read-write community name to be exposed, related to (1) "'read-only' community access," and/or (2) an easily guessable community name.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/advisories/4360; http://www.iss.net/security_center/static/9814.php; http://www.securityfocus.com/bid/5428
CVE: CVE-2002-1409
Published: 2003-04-11
Description: ptrace on HP-UX 11.00 through 11.11 allows local users to cause a denial of service (data page fault panic) via "an incorrect reference to thread register state."
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/hp/2002-q3/0041.html; http://www.iss.net/security_center/static/9818.php; http://www.securityfocus.com/bid/5425
CVE: CVE-2002-1410
Published: 2003-04-11
Description: Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of admin.cgi, or (2) reconfigure Guestbook via direct access of config.cgi.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0356.html; http://www.iss.net/security_center/static/9697.php; http://www.securityfocus.com/bid/5341
CVE: CVE-2002-1411
Published: 2003-04-11
Description: Directory traversal vulnerability in update.dpgs in Duma Photo Gallery System (DPGS) 0.99.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0265.html; http://www.iss.net/security_center/static/9414.php; http://www.securityfocus.com/bid/5081
CVE: CVE-2002-1412
Published: 2003-04-11
Description: Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0471.html; http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=50&mode=thread&order=0&thold=0; http://www.debian.org/security/2002/dsa-138
CVE: CVE-2002-1413
Published: 2003-04-11
Description: RCONAG6 for Novell Netware SP2, while running RconJ in secure mode, allows remote attackers to bypass authentication using the RconJ "Secure IP" (SSL) option during a connection.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0216.html; http://support.novell.com/servlet/tidfinder/2963349; http://www.iss.net/security_center/static/9928.php
CVE: CVE-2002-1414
Published: 2003-04-11
Description: Buffer overflow in qmailadmin allows local users to gain privileges via a long QMAILADMIN_TEMPLATEDIR environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0016.html; http://marc.info/?l=vuln-dev&m=[PII_REDACTED]9424&w=2; http://www.inter7.com/qmailadmin/ChangeLog
CVE: CVE-2002-1415
Published: 2003-04-11
Description: Format string vulnerability in SMTP service for WebEasyMail 3.4.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in SMTP requests.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/288222; http://www.iss.net/security_center/static/9924.php; http://www.securityfocus.com/bid/5518
CVE: CVE-2002-1416
Published: 2003-04-11
Description: The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct brute force attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/288222; http://www.iss.net/security_center/static/9925.php; http://www.securityfocus.com/bid/5519
CVE: CVE-2002-1417
Published: 2003-04-11
Description: Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to read arbitrary files via a URL containing a "..%5c" sequence (modified dot-dot), which is mapped to the directory separator.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0199.html; http://support.novell.com/servlet/tidfinder/2963297; http://www.iss.net/security_center/static/9910.php
CVE: CVE-2002-1418
Published: 2003-04-11
Description: Buffer overflow in the interpreter for Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to cause a denial of service (ABEND) via a long module name.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0199.html; http://support.novell.com/servlet/tidfinder/2963297; http://www.iss.net/security_center/static/9911.php