rainbutterfly/cve_corpus huggingface dataset:
CVE-2002-0372 
Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0373 
The Windows Media Device Manager (WMDM) Service in Microsoft Windows Media Player 7.1 on Windows 2000 systems allows local users to obtain LocalSystem rights via a program that calls the WMDM service to connect to an invalid local storage device, aka "Privilege Elevation through Windows Media Device Manager Service".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0374 
Format string vulnerability in the logging function for the pam_ldap PAM LDAP module before version 144 allows attackers to execute arbitrary code via format strings in the configuration file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0375 
Cross-site scripting vulnerability in sgdynamo.exe for Sgdynamo allows remote attackers to execute arbitrary Javascript via a URL with the script in the HTNAME parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-05-09T04:00:00.000Z
CVE-2002-0376 
Buffer overflow in Apple QuickTime 5.0 ActiveX component allows remote attackers to execute arbitrary code via a long pluginspage field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0377 
Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0378 
The default configuration of LPRng print spooler in Red Hat Linux 7.0 through 7.3, Mandrake 8.1 and 8.2, and other operating systems, accepts print jobs from arbitrary remote hosts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-15T04:00:00.000Z
CVE-2002-0379 
Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 support, and imapd 2000.287 and earlier, allows remote authenticated users to execute arbitrary code via a long BODY request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0380 
Buffer overflow in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via an NFS packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0381 
The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0382 
XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0384 
Buffer overflow in Jabber plug-in for Gaim client before 0.58 allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0385 
Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' (double quote) and and '>' characters, which causes the TCL interpreter to crash and include stack data in the output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-04-16T04:00:00.000Z
CVE-2002-0386 
The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash) via (1) an HTTP GET request containing a ".." (dot dot) sequence, or (2) a malformed HTTP GET request with a chunked Transfer-Encoding with missing data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-10-29T05:00:00.000Z
CVE-2002-0387 
Buffer overflow in gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before 6.5 allows remote attackers to execute arbitrary code via a long HTTP request URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0388 
Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) the Pipermail index summaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-05-31T04:00:00.000Z
CVE-2002-0389 
Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0391 
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0392 
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0393 
Buffer overflow in Red-M 1050 (Bluetooth Access Point) management web interface allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0394 
Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0395 
The TFTP server for Red-M 1050 (Bluetooth Access Point) can not be disabled and makes it easier for remote attackers to crack the administration password via brute force methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0396 
The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, which allows attackers to connect to the server from the same IP address as a user who has already established a session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0397 
Red-M 1050 (Bluetooth Access Point) publicizes its name, IP address, and other information in UDP packets to a broadcast address, which allows any system on the network to obtain potentially sensitive information about the Access Point device by monitoring UDP port 8887.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0398 
Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0399 
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-10-01T04:00:00.000Z
CVE-2002-0400 
ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL, aka DoS_findtype.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0401 
SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0402 
Buffer overflow in X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0403 
DNS dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet that causes Ethereal to enter an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0404 
Vulnerability in GIOP dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (memory consumption).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0405 
Buffer overflow in Transsoft Broker FTP Server 5.0 evaluation allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CWD command with a large number of . (dot) characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0406 
Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server without providing login credentials, which prevents other users from being able to log in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0407 
htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as (1) a request with a .pl or .java extension, or (2) a request containing a large number of periods, which causes htcgibin.exe to leak the pathname in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0408 
htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0409 
orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0410 
send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0411 
Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0412 
Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote attackers to execute arbitrary code by causing format strings to be injected into calls to the syslog function, via (1) an HTTP GET request, (2) a user name in HTTP authentication, or (3) a password in HTTP authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0413 
Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0414 
KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0415 
Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read files that are accessible to RealPlayer via a .. (dot dot) in an HTTP GET request to port 1275.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0416 
Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0417 
Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the ALTERNATE_TEMPLATES parameter for various mmstdo*.cgi programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0418 
Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the param_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0419 
Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which (2) in certain configurations, the server IP address is provided as the realm for Basic authentication, which could reveal real IP addresses that were obscured by NAT, or (3) when NTLM authentication is used, the NetBIOS name of the server and its Windows NT domain are revealed in response to an Authorization request.  NOTE: this entry originally contained a vector (1) in which the server reveals whether it supports Basic or NTLM authentication through 401 Access Denied error messages.  CVE has REJECTED this vector; it is not a vulnerability because the information is already available through legitimate use, since authentication cannot proceed without specifying a scheme that is supported by both the client and the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0420 
Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0421 
IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0422 
IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0423 
Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a finger request from an IP address with a long hostname that is obtained via a reverse DNS lookup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0424 
efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user (typically "nobody"), which allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0425 
mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message in a DCC connection request that cannot be ignored or canceled by the user, which may leak the alternate nickname in a response message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0426 
VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via manual key entry, which makes it easier for attackers to crack the keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0427 
Buffer overflows in fpexec in mod_frontpage before 1.6.1 may allow attackers to gain root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0428 
Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the to_expire or expire values in the client's users.C configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0429 
The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary processes via a a binary compatibility interface (lcall).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0430 
MultiFileUploadHandler.php in the Sun Cobalt RaQ XTR administration interface allows local users to bypass authentication and overwrite arbitrary files via a symlink attack on a temporary file, followed by a request to MultiFileUpload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0431 
XTux allows remote attackers to cause a denial of service (CPU consumption) via random inputs in the initial connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0432 
Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0433 
Pi3Web 2.0.0 allows remote attackers to view restricted files via an HTTP request containing a "*" (wildcard or asterisk) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0434 
Marcus S. Xenakis directory.php script allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0435 
Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local users to delete directories as the user running fileutils by moving a low-level directory to a higher level as it is being deleted, which causes fileutils to chdir to a ".." directory that is higher than expected, possibly up to the root file system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0436 
sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0437 
Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, as described with the term "string format vulnerability" by some sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0438 
ZyXEL ZyWALL 10 before 3.50 allows remote attackers to cause a denial of service via an ARP packet with the firewall's IP address and an incorrect MAC address, which causes the firewall to disable the LAN interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0439 
Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript and steal credit card numbers or delete items by injecting the script into new customer information fields such as the message field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0440 
Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web servers to bypass content scanning via a Content-length header set to 0, which is often ignored by HTTP clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0441 
Directory traversal vulnerability in imlist.php for Php Imglist allows remote attackers to read arbitrary code via a .. (dot dot) in the cwd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z