rainbutterfly/cve_corpus huggingface dataset:
CVE-2002-0442 
Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0443 
Microsoft Windows 2000 allows local users to bypass the policy that prohibits reusing old passwords by changing the current password before it expires, which does not enable the check for previous passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0444 
Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum, e.g. with a maximum number of licenses, which can allow remote authenticated users to bypass group policies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0445 
article.php in PHP FirstPost 0.1 allows allows remote attackers to obtain the full pathname of the server via an invalid post number in the post parameter, which leaks the pathname in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0446 
categorie.php3 in Black Tie Project (BTP) 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an invalid category ID (cid) parameter, which leaks the pathname in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0447 
Directory traversal vulnerability in Xerver Free Web Server 2.10 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0448 
Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request that contains many "C:/" sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0449 
Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to webplus.exe program, which triggers the overflow in webpsvc.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0450 
Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0451 
filemanager_forms.php in PHProjekt 3.1 and 3.1a allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in the lib_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0452 
Foundry Networks ServerIron switches do not decode URIs when applying "url-map" rules, which could make it easier for attackers to cause the switch to forward traffic to a different server than intended and exploit vulnerabilities that would otherwise be inaccessible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0453 
The account lockout capability in Oblix NetPoint 5.2 and earlier only locks out users once for the specified lockout period, which makes it easier for remote attackers to conduct brute force password guessing by waiting until the lockout period ends, then guessing passwords without being locked out again.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0454 
Qpopper (aka in.qpopper or popper) 4.0.3 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a very large string, which causes an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0455 
IncrediMail stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in other software that rely on installing and reading files from directories with known pathnames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0456 
Eudora 5.1 and earlier versions stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in other software that rely on installing and reading files from directories with known pathnames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0457 
Cross-site scripting vulnerability in signgbook.php for BG GuestBook 1.0 allows remote attackers to execute arbitrary Javascript via encoded tags such as &lt;, &gt;, and &amp; in fields such as (1) name, (2) email, (3) AIM screen name, (4) website, (5) location, or (6) message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0458 
Cross-site scripting vulnerability in News-TNK 1.2.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0459 
Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0460 
Bitvise WinSSHD before 2002-03-16 allows remote attackers to cause a denial of service (resource exhaustion) via a large number of incomplete connections that are not properly terminated, which are not properly freed by SSHd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0461 
Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service (application crash) via Javascript in a web page that calls location.replace on itself, causing a loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0462 
bigsam_guestbook.php for Big Sam (Built-In Guestbook Stand-Alone Module) 1.1.08 and earlier allows remote attackers to cause a denial of service (CPU consumption) or obtain the absolute path of the web server via a displayBegin parameter with a very large number, which leaks the web path in an error message when PHP safe_mode is enabled, or consumes resources when safe_mode is not enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0463 
home.php in ARSC (Really Simple Chat) 1.0.1 and earlier allows remote attackers to determine the full pathname of the web server via an invalid language in the arsc_language parameter, which leaks the pathname in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0464 
Directory traversal vulnerability in Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arbitrary files and directories via a .. (dot dot) in arguments to (1) file_editor.asp, (2) folderactions.asp, or (3) editoractions.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0465 
Directory traversal vulnerability in filemanager.asp for Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arbitrary files, and execute commands, via a .. (dot dot) in the OpenPath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0466 
Hosting Controller 1.4.1 and earlier allows remote attackers to browse arbitrary directories via a full C: style pathname in the filepath arguments to (1) Statsbrowse.asp, (2) servubrowse.asp, (3) browsedisk.asp, (4) browsewebalizerexe.asp, or (5) sqlbrowse.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0467 
Buffer overflows in Ecartis (formerly Listar) 1.0.0 before snapshot 20020125 allows remote attackers to execute arbitrary code via (1) address_match() of mystring.c or (2) other functions in tolist.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0468 
Buffer overflows in Ecartis (formerly Listar) 1.0.0 in snapshot 20020427 and earlier allow local users to gain privileges via (1) a long command line argument, which is not properly handled in core.c, or possibly via bad uses of sprintf() in (2) moderate.c, (3) lcgi.c, (4) fileapi.c, (5) cookie.c, (6) codes.c, or other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0469 
Ecartis (formerly Listar) 1.0.0 in snapshot 20020125 and earlier does not properly drop privileges when Ecartis is installed setuid-root, "lock-to-user" is not set, and ecartis is called by certain MTA's, which could allow local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0470 
PHPNetToolpack 0.1 relies on its environment's PATH to find and execute the traceroute program, which could allow local users to gain privileges by inserting a Trojan horse program into the search path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0471 
PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the a_query variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0472 
MSN Messenger Service 3.6, and possibly other versions, uses weak authentication when exchanging messages between clients, which allows remote attackers to spoof messages from other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0473 
db.php in phpBB 2.0 (aka phpBB2) RC-3 and earlier allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0474 
Cross-site scripting vulnerability in ZeroForum allows remote attackers to execute arbitrary Javascript on web clients by embedding the script within IMG image tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0475 
Cross-site scripting vulnerability in phpBB 1.4.4 and earlier allows remote attackers to execute arbitrary Javascript on web clients by embedding the script within an IMG image tag while editing a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0476 
Standalone Macromedia Flash Player 5.0 allows remote attackers to save arbitrary files and programs via a .SWF file containing the undocumented "save" FSCommand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0477 
Standalone Macromedia Flash Player 5.0 before 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the "exec" FSCommand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0478 
The default configuration of Foundry Networks EdgeIron 4802F allows remote attackers to modify sensitive information via arbitrary SNMP community strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0479 
Gravity Storm Service Pack Manager 2000 creates a hidden share (SPM2000c$) mapped to the C drive, which may allow local users to bypass access restrictions on certain directories in the C drive, such as system32, by accessing them through the hidden share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0480 
ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d is configured to allow a user "skank" on a machine "starscream" to become a key manager when the "first time connection" feature is enabled and before any legitimate administrators have connected, which could allow remote attackers to gain access to the device during installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0481 
An interaction between Windows Media Player (WMP) and Outlook 2002 allows remote attackers to bypass Outlook security settings and execute Javascript via an IFRAME in an HTML email message that references .WMS (Windows Media Skin) or other WMP media files, whose onload handlers execute the player.LaunchURL() Javascript function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0482 
Directory traversal vulnerability in PCI Netsupport Manager before version 7, when running web extensions, allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0483 
index.php for PHP-Nuke 5.4 and earlier allows remote attackers to determine the physical pathname of the web server when the file parameter is set to index.php, which triggers an error message that leaks the pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0484 
move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0485 
Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0486 
Intellisol Xpede 4.1 uses weak encryption to store authentication information in cookies, which could allow local users with access to the cookies to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0487 
Intellisol Xpede 4.1 stores passwords in plaintext in a Javascript "session timeout" re-authentication capability, which could allow local users with access to gain privileges of other Xpede users by reading the password from the source file, e.g. from the browser's cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0488 
Linux Directory Penguin traceroute.pl CGI script 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0489 
Linux Directory Penguin NsLookup CGI script (nslookup.pl) 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the (1) query or (2) type parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0490 
Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0491 
admin.php in AlGuest 1.0 guestbook checks for the existence of the admin cookie to authenticate the AlGuest administrator, which allows remote attackers to bypass the authentication and gain privileges by setting the admin cookie to an arbitrary value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0492 
dcshop.cgi in DCShop 1.002 Beta allows remote attackers to delete arbitrary setup files via a null character in the database parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0493 
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0494 
Cross-site scripting vulnerability in WebSight Directory System 0.1 allows remote attackers to execute arbitrary Javascript and gain access to the WebSight administrator via a new link submission containing the script in a website name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0495 
csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0496 
The HTTP server for SouthWest Talker server 1.0.0 allows remote attackers to cause a denial of service (server crash) via a malformed URL to port 5002.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0497 
Buffer overflow in mtr 0.46 and earlier, when installed setuid root, allows local users to access a raw socket via a long MTR_OPTIONS environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0498 
Etnus TotalView 5.0.0-4 installs certain files with UID 5039 and GID 59, which could allow local users with that UID or GID to modify the files and gain privileges as other TotalView users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0499 
The d_path function in Linux kernel 2.2.20 and earlier, and 2.4.18 and earlier, truncates long pathnames without generating an error, which could allow local users to force programs to perform inappropriate operations on the wrong directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0500 
Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc property that references the target file, which sets certain elements of the image object such as file size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0501 
Format string vulnerability in log_print() function of Posadis DNS server before version m5pre2 allows local users and possibly remote attackers to execute arbitrary code via format strings that are inserted into logging messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0502 
Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0503 
Directory traversal vulnerability in boilerplate.asp for Citrix NFuse 1.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the NFuse_Template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0504 
Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other clients via the NFuse_Application parameter to (1) launch.jsp or (2) launch.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0505 
Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote attackers to cause a denial of service (crash and reload) via a series of authentication failures, e.g. via incorrect passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0506 
Buffer overflow in newt.c of newt windowing library (libnewt) 0.50.33 and earlier may allow attackers to cause a denial of service or execute arbitrary code in setuid programs that use libnewt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0507 
An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a previous user via several submissions of an OWA Authentication request with the proper OWA password for the previous user, which is eventually accepted by OWA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0508 
wwwisis 3.45 and earlier allows remote attackers to execute arbitrary commands and read files via the parameters (1) prolog or (2) epilog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0509 
Transparent Network Substrate (TNS) Listener in Oracle 9i 9.0.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a single malformed TCP packet to port 1521.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0510 
The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remote attackers to determine that a target system is running Linux.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-06-11T04:00:00.000Z
CVE-2002-0511 
The default configuration of Name Service Cache Daemon (nscd) in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulting the authoritative DNS server for the A record, which could make it easier for remote attackers to bypass applications that restrict access based on host names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0512 
startkde in KDE for Caldera OpenLinux 2.3 through 3.1.1 sets the LD_LIBRARY_PATH environment variable to include the current working directory, which could allow local users to gain privileges of other users running startkde via Trojan horse libraries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z