rainbutterfly/cve_corpus huggingface dataset:
CVE-2002-2007 
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2008 
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2009 
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2010 
Cross-site scripting (XSS) vulnerability in htsearch.cgi in htdig (ht://Dig) 3.1.5, 3.1.6, and 3.2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2011 
Cross-site scripting (XSS) vulnerability in the fom CGI program (fom.cgi) in Faq-O-Matic 2.711 and 2.712 allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2012 
Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2013 
Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2014 
Lotus Domino 5.0.8 web server returns different error messages when a valid or invalid user is provided in HTTP requests, which allows remote attackers to determine valid user names and makes it easier to conduct brute force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2015 
PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code via the caselist parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2016 
User-mode Linux (UML) 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2017 
sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious program, which is then executed by sastcpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2018 
sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the netencralg environment variable, which causes a segmentation fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2019 
PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) 2.1 allows remote attackers to execute arbitrary PHP code via the include_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2020 
Netgear RP114 Cable/DSL Web Safe Router Firmware 3.26 uses a default administrator password and accepts admin logins on the external interface, which allows remote attackers to gain privileges if the password is not changed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2021 
Cross-site scripting (XSS) vulnerability in WoltLab Burning Board (wbboard) 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2022 
Format string vulnerability in Kaffe OpenVM 1.0.6 and earlier allows local users to execute arbitrary code, when a java.lang.NoClassDefFoundError is thrown, via format specifiers in the forName attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2023 
The get_parameter_from_freqency_source function in beep2 1.0, 1.1 and 1.2, when installed setuid root, allows local users to read arbitrary files via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2024 
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2025 
Lotus Domino server 5.0.9a and earlier allows remote attackers to cause a denial of service by exhausting the number of working threads via a large number of HTTP requests for (1) an MS-DOS device name and (2) an MS-DOS device name with a large number of characters appended to the device name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2026 
Buffer overflow in BrowseFTP 1.62 client allows remote FTP servers to execute arbitrary code via a long FTP "220" message reply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2027 
Database of Our Owlish Wisdom (DOOW) 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform unauthorized activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2028 
The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2029 
PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2030 
Stack-based buffer overflow in SQLData Enterprise Server 3.0 allows remote attacker to execute arbitrary code and cause a denial of service via a long HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2031 
Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files via a script tag with a src parameter that references a non-JavaScript file, then using the onError event handler to monitor the results.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2032 
sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug parameter to (1) index.php and (2) modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2033 
faqmanager.cgi in FAQManager 2.2.5 and earlier allows remote attackers to read arbitrary files by specifying the filename in the toc parameter with a trailing null character (%00).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2034 
The Email Sanitizer before 1.133 for Procmail allows remote attackers to bypass the mail filter and execute arbitrary code via crafted recursive multipart MIME attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2035 
SQL injection vulnerability in RealityScape MyLogin 2000 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password in the login form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2036 
Sun Ray Server Software (SRSS) 1.3, when Non-Smartcard Mobility (NSCM) is enabled, allows remote attackers to login as another user by running dtlogin from a system that supports the XDMCP client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2037 
The Cisco Media Gateway Controller (MGC) in (1) SC2200 7.4 and earlier, (2) VSC3000 9.1 and earlier, (3) PGW 2200 9.1 and earlier, (4) Billing and Management Server (BAMS) and (5) Voice Services Provisioning Tool (VSPT) runs on default installations of Solaris 2.6 with unnecessary services and without the latest security patches, which allows attackers to exploit known vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2038 
Next Generation POSIX Threading (NGPT) 1.9.0 uses a filesystem-based shared memory entry, which allows local users to cause a denial of service or in threaded processes or spoof files via unknown methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2039 
/bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2040 
The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2041 
Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allows local users to execute arbitrary code via (1) a long ABLANG environment variable in phlocale or (2) a long -u option to pkg-installer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2042 
ptrace in the QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows programs to attach to privileged processes, which could allow local users to execute arbitrary code by modifying running processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2043 
SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2044 
Cross-site scripting (XSS) vulnerability in x_stat_admin.php in x-stat 2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the phpinfo action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2045 
x_stat_admin.php in x-stat 2.3 and earlier allows remote attackers to (1) execute PHP commands such as phpinfo or (2) obtain the full path of the web server via an invalid action parameter, which leaks the pathname in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2046 
x_news.php in X-News (x_news) 1.1 and earlier allows remote attackers to gain administrative privileges by stealing and replaying the md5_password cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2047 
The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2048 
Buffer overflow in PFinger 0.7.8 client allows remote attackers to execute arbitrary code via a long query value passed to the (1) finger program, (2) -l, (3) -d, and (4) -t options.  NOTE: if PFinger is not setuid or setgid, then this issue would not cross privilege boundaries and would not be considered a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2049 
configure for Dsniff 2.3, fragroute 1.2, and fragrouter 1.6, when downloaded from monkey.org on May 17, 2002, has been modified to contain a backdoor, which allows remote attackers to access the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2050 
Directory traversal vulnerability in processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a .. (dot dot) in the hostname of a log entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2051 
The processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a symlink attack on files specified as hostnames in a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2052 
Cisco 2611 router running IOS 12.1(6.5), possibly an interim release, allows remote attackers to cause a denial of service via port scans such as (1) scanning all ports on a single host and (2) scanning a network of hosts for a single open port through the router.  NOTE: the vendor could not reproduce this issue, saying that the original reporter was using an interim release of the software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2053 
The design of the Hot Standby Routing Protocol (HSRP), as implemented on Cisco IOS 12.1, when using IRPAS, allows remote attackers to cause a denial of service (CPU consumption) via a router with the same IP address as the interface on which HSRP is running, which causes a loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2054 
TeeKai Forum 1.2 allows remote attackers to authenticate as the administrator and and gain privileged web forum access by setting the valid_level cookie to admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2055 
Cross-site scripting (XSS) vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2056 
Cross-site scripting (XSS) vulnerability in TeeKai Forum 1.2 allows remote attackers to inject arbitrary web script or HTML via the valid_username_online cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2057 
TeeKai Forum 1.2 uses weak encryption of web usage statistics in data/member_log.txt, which is stored under the web document root with insufficient access control, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2058 
TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2059 
BIOS D845BG, D845HV, D845PT and D845WN on Intel motherboards does not properly restrict access to configuration information when BIOS passwords are enabled, which could allow local users to change the default boot device via the F8 key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2060 
Buffer overflow in Links 2.0 pre4 allows remote attackers to crash client browsers and possibly execute arbitrary code via gamma tables in large 16-bit PNG images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2061 
Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG image with large width and height values and an 8-bit or 16-bit alpha channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2062 
Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2063 
AtGuard 3.2 allows remote attackers to bypass firwall filters and execute prohibited programs by changing the filenames to permitted filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2064 
isadmin.php in PhpWebGallery 1.0 allows remote attackers to gain administrative access via by setting the photo_login cookie to pseudo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2065 
WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2066 
BestCrypt BCWipe 1.0.7 and 2.0 through 2.35.1 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2067 
East-Tec Eraser 2002 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2068 
Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2069 
PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2070 
SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2071 
Compaq Tru64 4.0 d allows remote attackers to cause a denial of service in (1) telnet, (2) FTP, (3) ypbind, (4) rpc.lockd, (5) snmp, (6) ttdbserverd, and possibly other services via a TCP SYN scan, as demonstrated using nmap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2072 
java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2073 
Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2074 
SQL injection vulnerability in Mailidx before 20020105 allows remote attackers to execute arbitrary SQL commands via the search web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2075 
ICQ 2001a and 2002b allows remote attackers to cause a denial of service (memory consumption and hang) via a contact message with a large contacts number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2076 
Directory traversal vulnerability in Lil' HTTP server 2.1 and 2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2077 
The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z
CVE-2002-2078 
Heap-based buffer overflow in Floositek (1) FTGate Pro 1.05 and (2) FTGate Office 1.05 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-14T04:00:00.000Z