morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0298.

assistant: ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) via certain HTTP GET requests containing (1) a %2e%2e (encoded dot-dot), (2) several /../ (dot dot) sequences, (3) a missing URI, or (4) several ../ in a URI that does not begin with a / (slash) character.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0299.

assistant: CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such as .BAT), which is executed during a scan.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0300.

assistant: gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the requested file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0301.

assistant: Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0302.

assistant: The Notify daemon for Symantec Enterprise Firewall (SEF) 6.5.x drops large alerts when SNMP is used as the transport, which could prevent some alerts from being sent in the event of an attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0303.

assistant: GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of other users by logging in without a password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0304.

assistant: Lil HTTP Server 2.1 allows remote attackers to read password-protected files via a /./ in the HTTP request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0305.

assistant: Zero One Tech (ZOT) P100s print server does not properly disable the SNMP service or change the default password, which could leave the server open to attack without the administrator's knowledge.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0306.

assistant: ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the p (plugin) parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0307.

assistant: Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existence of arbitrary files or execute any Perl program on the system via a .. (dot dot) in the p parameter, which reads the target file and attempts to execute the line using Perl's eval function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0308.

assistant: admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0309.

assistant: SMTP proxy in Symantec Enterprise Firewall (SEF) 6.5.x includes the firewall's physical interface name and address in an SMTP protocol exchange when NAT translation is made to an address other than the firewall, which could allow remote attackers to determine certain firewall configuration information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0310.

assistant: Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations (1) testweb/newstest, (2) alwn3845/imaptest, (3) alwi3845/wtest3452, or (4) testweb2/wtest4879.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0311.

assistant: Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell metacharacters in the -c argument for (1) in scoadminreg.cgi or (2) service_action.cgi.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0312.

assistant: Directory traversal vulnerability in Essentia Web Server 2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0313.

assistant: Buffer overflow in Essentia Web Server 2.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0314.

assistant: fasttrack p2p, as used in (1) KaZaA before 1.5, (2) grokster, and (3) morpheus allows remote attackers to cause a denial of service (memory exhaustion) via a series of client-to-client messages, which pops up new windows per message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0315.

assistant: fasttrack p2p, as used in (1) KaZaA, (2) grokster, and (3) morpheus allows remote attackers to spoof other users by modifying the username and network information in the message header.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0316.

assistant: Cross-site scripting vulnerability in eXtreme message board (XMB) 1.6x and earlier allows remote attackers to execute script as other XMB users by inserting the script into an IMG tag.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0317.

assistant: Gator ActiveX component (IEGator.dll) 3.0.6.1 allows remote web sites to install arbitrary software by specifying a Trojan Gator installation file (setup.ex_) in the src parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0318.

assistant: FreeRADIUS RADIUS server allows remote attackers to cause a denial of service (CPU consumption) via a flood of Access-Request packets.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0319.

assistant: Cross-site scripting vulnerability in edituser.php for pforum 1.14 and earlier allows remote attackers to execute script and steal cookies from other users via Javascript in a username.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0320.

assistant: Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) message or (2) IMvironment field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0321.

assistant: Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engineering or denial of service (flooding) attacks.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0322.

assistant: Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0323.

assistant: comment2.jse in ScriptEase:WebServer allows remote attackers to read arbitrary files by specifying the target file as an argument in the URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0324.

assistant: Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-*.reg file which contains the administrator name and password in cleartext, then retrieving the file from the web server before the Greymatter administrator performs a "Clear And Exit" action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0325.

assistant: Directory traversal vulnerability in BadBlue before 1.6.1 allows remote attackers to read arbitrary files via a ... (modified dot dot) in the URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0326.

assistant: Cross-site scripting vulnerability in BadBlue before 1.6.1 beta allows remote attackers to execute arbitrary script and possibly additional commands via a URL that contains Javascript.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0327.

assistant: Buffer overflow in Century Software TERM allows local users to gain root privileges via a long tty argument to the callin program.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0328.

assistant: Cross-site scripting vulnerability in Ikonboard 3.0.1 allows remote attackers to execute arbitrary script as other Ikonboard users and steal cookies via Javascript in an IMG tag.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0329.

assistant: Cross-site scripting vulnerability in Snitz Forums 2000 3.3.03 and earlier allows remote attackers to execute arbitrary script as other Forums 2000 users via Javascript in an IMG tag.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0330.

assistant: Cross-site scripting vulnerability in codeparse.php of Open Bulletin Board (OpenBB) 1.0.0 allows remote attackers to execute arbitrary script and steal cookies via Javascript in the IMG tag.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0331.

assistant: Directory traversal vulnerability in the HTTP server for BPM Studio Pro 4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0332.

assistant: Buffer overflows in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to execute arbitrary code via (1) a long DNS hostname that is determined using reverse DNS lookups, (2) a long AUTH string, or (3) certain data in the xtell request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0333.

assistant: Directory traversal vulnerability in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to read files with short names, and local users to read more files using a symlink with a short name, via a .. in the TTY argument.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0334.

assistant: xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0335.

assistant: Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long HTTP GET request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0336.

assistant: Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a LIST command containing a large number of / (slash), * (wildcard), and .. characters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0337.

assistant: RealPlayer 8 allows remote attackers to cause a denial of service (CPU utilization) via malformed .mp3 files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0338.

assistant: The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service (crash) via an attachment whose name includes an MS-DOS device name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0339.

assistant: Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC level packet when the MAC packet's length is less than the IP level packet length.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0340.

assistant: Windows Media Player (WMP) 8.00.00.4477, and possibly other versions, automatically detects and executes .wmf and other content, even when the file's extension or content type does not specify .wmf, which could make it easier for attackers to conduct unauthorized activities via Trojan horse files containing .wmf content.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0341.

assistant: GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server via an HTTP request with an invalid HTMLVER parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0342.

assistant: Kmail 1.2 on KDE 2.1.1 allows remote attackers to cause a denial of service (crash) via an email message whose body is approximately 55 K long.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0343.

assistant: Hotline Client 1.8.5 stores sensitive user information, including passwords, in plaintext in the bookmarks file, which could allow local users with access to the bookmarks file to gain privileges by extracting the passwords.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0344.

assistant: Symantec LiveUpdate 1.5 and earlier in Norton Antivirus stores usernames and passwords for a local LiveUpdate server in cleartext in the registry, which may allow remote attackers to impersonate the LiveUpdate server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0345.

assistant: Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, which could allow an attacker to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0346.

assistant: Cross-site scripting vulnerability in Cobalt RAQ 4 allows remote attackers to execute arbitrary script as other Cobalt users via Javascript in a URL to (1) service.cgi or (2) alert.cgi.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0347.

assistant: Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. (dot dot) in an HTTP request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0348.

assistant: service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long service argument.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0349.

assistant: Tiny Personal Firewall (TPF) 2.0.15, under certain configurations, will pop up an alert to the system even when the screen is locked, which could allow an attacker with physical access to the machine to hide activities or bypass access restrictions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0350.

assistant: HP Procurve Switch 4000M running firmware C.08.22 and C.09.09 allows remote attackers to cause a denial of service via a port scan of the management IP address, which disables the telnet service.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0351.

assistant: Buffer overflows in CFS daemon (cfsd) before 1.3.3-8.1, and 1.4x before 1.4.1-5, allow remote attackers to cause a denial of service and possibly execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0352.

assistant: Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0353.

assistant: The ASN.1 parser in Ethereal 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a certain malformed packet, which causes Ethereal to allocate memory incorrectly, possibly due to zero-length fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0354.

assistant: The XMLHttpRequest object (XMLHTTP) in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories on a client system by opening a URL that redirects the browser to the file on the client, then reading the result using the responseText property.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0355.

assistant: netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0356.

assistant: Vulnerability in XFS filesystem reorganizer (fsr_xfs) in SGI IRIX 6.5.10 and earlier allows local users to gain root privileges by overwriting critical system files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0357.

assistant: Unknown vulnerability in rpc.passwd in the nfs.sw.nis subsystem of SGI IRIX 6.5.15 and earlier allows local users to gain root privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0358.

assistant: MediaMail and MediaMail Pro in SGI IRIX 6.5.16 and earlier allows local users to force the program to dump core via certain arguments, which could allow the users to read sensitive data or gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0359.

assistant: xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, which allows remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems, to gain root privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0360.

assistant: Buffer overflow in Sun AnswerBook2 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0362.

assistant: Buffer overflow in AOL Instant Messenger (AIM) 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0363.

assistant: ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0364.

assistant: Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0366.

assistant: Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0367.

assistant: smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0368.

assistant: The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with a malformed RFC message attribute, aka "Malformed Mail Attribute can Cause Exchange 2000 to Exhaust CPU Resources."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0369.

assistant: Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0370.

assistant: Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0371.

assistant: Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0372.

assistant: Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player".
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0373.

assistant: The Windows Media Device Manager (WMDM) Service in Microsoft Windows Media Player 7.1 on Windows 2000 systems allows local users to obtain LocalSystem rights via a program that calls the WMDM service to connect to an invalid local storage device, aka "Privilege Elevation through Windows Media Device Manager Service".
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0374.

assistant: Format string vulnerability in the logging function for the pam_ldap PAM LDAP module before version 144 allows attackers to execute arbitrary code via format strings in the configuration file name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0375.

assistant: Cross-site scripting vulnerability in sgdynamo.exe for Sgdynamo allows remote attackers to execute arbitrary Javascript via a URL with the script in the HTNAME parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0376.

assistant: Buffer overflow in Apple QuickTime 5.0 ActiveX component allows remote attackers to execute arbitrary code via a long pluginspage field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0377.

assistant: Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0378.

assistant: The default configuration of LPRng print spooler in Red Hat Linux 7.0 through 7.3, Mandrake 8.1 and 8.2, and other operating systems, accepts print jobs from arbitrary remote hosts.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0379.

assistant: Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 support, and imapd 2000.287 and earlier, allows remote authenticated users to execute arbitrary code via a long BODY request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0380.

assistant: Buffer overflow in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via an NFS packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0381.

assistant: The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0382.

assistant: XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0384.

assistant: Buffer overflow in Jabber plug-in for Gaim client before 0.58 allows remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0385.

assistant: Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' (double quote) and and '>' characters, which causes the TCL interpreter to crash and include stack data in the output.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0386.

assistant: The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash) via (1) an HTTP GET request containing a ".." (dot dot) sequence, or (2) a malformed HTTP GET request with a chunked Transfer-Encoding with missing data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0387.

assistant: Buffer overflow in gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before 6.5 allows remote attackers to execute arbitrary code via a long HTTP request URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0388.

assistant: Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) the Pipermail index summaries.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0389.

assistant: Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0391.

assistant: Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0392.

assistant: Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0393.

assistant: Buffer overflow in Red-M 1050 (Bluetooth Access Point) management web interface allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0394.

assistant: Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0395.

assistant: The TFTP server for Red-M 1050 (Bluetooth Access Point) can not be disabled and makes it easier for remote attackers to crack the administration password via brute force methods.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0396.

assistant: The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, which allows attackers to connect to the server from the same IP address as a user who has already established a session.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0397.

assistant: Red-M 1050 (Bluetooth Access Point) publicizes its name, IP address, and other information in UDP packets to a broadcast address, which allows any system on the network to obtain potentially sensitive information about the Access Point device by monitoring UDP port 8887.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0398.

assistant: Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0399.

assistant: Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0400.

assistant: ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL, aka DoS_findtype.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0401.

assistant: SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0402.

assistant: Buffer overflow in X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0403.

assistant: DNS dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet that causes Ethereal to enter an infinite loop.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0404.

assistant: Vulnerability in GIOP dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (memory consumption).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0405.

assistant: Buffer overflow in Transsoft Broker FTP Server 5.0 evaluation allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CWD command with a large number of . (dot) characters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0406.

assistant: Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server without providing login credentials, which prevents other users from being able to log in.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0407.

assistant: htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as (1) a request with a .pl or .java extension, or (2) a request containing a large number of periods, which causes htcgibin.exe to leak the pathname in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0408.

assistant: htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0409.

assistant: orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0410.

assistant: send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0411.

assistant: Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0412.

assistant: Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote attackers to execute arbitrary code by causing format strings to be injected into calls to the syslog function, via (1) an HTTP GET request, (2) a user name in HTTP authentication, or (3) a password in HTTP authentication.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0413.

assistant: Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0414.

assistant: KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0415.

assistant: Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read files that are accessible to RealPlayer via a .. (dot dot) in an HTTP GET request to port 1275.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0416.

assistant: Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0417.

assistant: Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the ALTERNATE_TEMPLATES parameter for various mmstdo*.cgi programs.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0418.

assistant: Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the param_name parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0419.

assistant: Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which (2) in certain configurations, the server IP address is provided as the realm for Basic authentication, which could reveal real IP addresses that were obscured by NAT, or (3) when NTLM authentication is used, the NetBIOS name of the server and its Windows NT domain are revealed in response to an Authorization request.  NOTE: this entry originally contained a vector (1) in which the server reveals whether it supports Basic or NTLM authentication through 401 Access Denied error messages.  CVE has REJECTED this vector; it is not a vulnerability because the information is already available through legitimate use, since authentication cannot proceed without specifying a scheme that is supported by both the client and the server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0420.

assistant: Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user sessions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0421.

assistant: IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0422.

assistant: IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0423.

assistant: Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a finger request from an IP address with a long hostname that is obtained via a reverse DNS lookup.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0424.

assistant: efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user (typically "nobody"), which allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0425.

assistant: mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message in a DCC connection request that cannot be ignored or canceled by the user, which may leak the alternate nickname in a response message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0426.

assistant: VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via manual key entry, which makes it easier for attackers to crack the keys.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0427.

assistant: Buffer overflows in fpexec in mod_frontpage before 1.6.1 may allow attackers to gain root privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0428.

assistant: Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the to_expire or expire values in the client's users.C configuration file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0429.

assistant: The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary processes via a a binary compatibility interface (lcall).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0430.

assistant: MultiFileUploadHandler.php in the Sun Cobalt RaQ XTR administration interface allows local users to bypass authentication and overwrite arbitrary files via a symlink attack on a temporary file, followed by a request to MultiFileUpload.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0431.

assistant: XTux allows remote attackers to cause a denial of service (CPU consumption) via random inputs in the initial connection.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0432.

assistant: Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0433.

assistant: Pi3Web 2.0.0 allows remote attackers to view restricted files via an HTTP request containing a "*" (wildcard or asterisk) character.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0434.

assistant: Marcus S. Xenakis directory.php script allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0435.

assistant: Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local users to delete directories as the user running fileutils by moving a low-level directory to a higher level as it is being deleted, which causes fileutils to chdir to a ".." directory that is higher than expected, possibly up to the root file system.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0436.

assistant: sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0437.

assistant: Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, as described with the term "string format vulnerability" by some sources.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0438.

assistant: ZyXEL ZyWALL 10 before 3.50 allows remote attackers to cause a denial of service via an ARP packet with the firewall's IP address and an incorrect MAC address, which causes the firewall to disable the LAN interface.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0439.

assistant: Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript and steal credit card numbers or delete items by injecting the script into new customer information fields such as the message field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0440.

assistant: Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web servers to bypass content scanning via a Content-length header set to 0, which is often ignored by HTTP clients.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0441.

assistant: Directory traversal vulnerability in imlist.php for Php Imglist allows remote attackers to read arbitrary code via a .. (dot dot) in the cwd parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0442.

assistant: Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0443.

assistant: Microsoft Windows 2000 allows local users to bypass the policy that prohibits reusing old passwords by changing the current password before it expires, which does not enable the check for previous passwords.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0444.

assistant: Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum, e.g. with a maximum number of licenses, which can allow remote authenticated users to bypass group policies.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0445.

assistant: article.php in PHP FirstPost 0.1 allows allows remote attackers to obtain the full pathname of the server via an invalid post number in the post parameter, which leaks the pathname in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0446.

assistant: categorie.php3 in Black Tie Project (BTP) 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an invalid category ID (cid) parameter, which leaks the pathname in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-0447.

assistant: Directory traversal vulnerability in Xerver Free Web Server 2.10 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in an HTTP GET request.