rainbutterfly/cve_corpus huggingface dataset:
CVE-2002-1639 
Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter set to "version" or "host".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1640 
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via (1) Text Features in the DHTML UI or (2) the test parameter to the oracle.apps.cz.servlet.UiServlet servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1641 
Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server (9iAS) allow remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1642 
PostgreSQL 7.2.1 and 7.2.2 allows local users to delete transaction log (pg_clog) data and cause a denial of service (data loss) via the VACUUM command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1643 
Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET requests with long arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1644 
SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the parent process, which allows attackers to gain certain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1645 
Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1646 
SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1647 
The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1648 
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified send_to and subject parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1649 
Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1650 
The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1651 
Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients, possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1652 
Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1653 
Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encryption despite intended configuration, and may allow remote attackers to sniff sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1654 
iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1655 
The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-html-rend request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1656 
X-News (x_news) 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via sniffing or the users.txt data file, and providing it in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-28T05:00:00.000Z
CVE-2002-1657 
PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-22T04:00:00.000Z
CVE-2002-1658 
Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-27T04:00:00.000Z
CVE-2002-1659 
user_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user_id variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2002-1660 
calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2002-1661 
The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a denial of service (infinite loop) when leafnode requests a cross-posted article to one group whose name is a prefix of another group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-05T04:00:00.000Z
CVE-2002-1662 
Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11 allow remote attackers to execute arbitrary script on other clients via (1) search.php and (2) the "Your name" field during account registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2002-1663 
The Post_Method function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service (crash) via a POST request with an invalid or missing Content-Length header value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2002-1664 
Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-28T04:00:00.000Z
CVE-2002-1665 
Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long set_buddygrp field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-28T04:00:00.000Z
CVE-2002-1666 
Unknown vulnerability in Oracle E-Business Suite 11i.1 through 11i.6 allows remote attackers to execute unauthorized PL/SQL procedures by modifying the Oracle Applications URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1667 
The virtual memory management system in FreeBSD 4.5-RELEASE and earlier does not properly check the existence of a VM object during page invalidation, which allows local users to cause a denial of service (crash) by calling msync on an unaccessed memory map created with MAP_ANON and MAP_NOSYNC flags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1668 
HP-UX 11.11 and earlier allows local users to cause a denial of service (kernel deadlock), due to a "file system weakness" that is possibly via an mmap() system call and performing an I/O operation using data from the mapped buffer on the file descriptor for the mapped file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1669 
pkg_add in FreeBSD 4.2 through 4.4 creates a temporary directory with world-searchable permissions, which may allow local users to modify world-writable parts of the package during installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1670 
Microsoft Windows XP Professional upgrade edition overwrites previously installed patches for Internet Explorer 6.0, leaving Internet Explorer unpatched.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1671 
Microsoft Internet Explorer 5.0, 5.01, and 5.5 allows remote attackers to monitor the contents of the clipboard via the getData method of the clipboardData object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1672 
Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1673 
The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execute script and possibly steal cookies by inserting the script into certain files or fields, such as a real user name entry in the passwd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1674 
procfs on FreeBSD before 4.5 allows local users to cause a denial of service (kernel panic) by removing a file that the fstatfs function refers to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1675 
Format string vulnerability in the Cio_PrintF function of cio_main.c in Unreal IRCd 3.1.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1676 
BindView NetInventory 1.0, when used with NetRC 1.0, allows local users to read sensitive information (passwords) by deleting the HOSTCFG._NI file and forcing an audit, which rewrites the HOSTCFG._NI to HOSTCFG.INI and stores the passwords in cleartext until the audit is complete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1677 
14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, which generates an error message that reveals the path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1678 
Cross-site scripting (XSS) vulnerability in memberlist.php in Jelsoft vBulletin 2.0 rc 2 through 2.2.4 allows remote attackers to steal authentication credentials by injecting script into $letterbits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1679 
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 2.2.0 allows remote attackers to execute arbitrary script as other users by injecting script into a bulletin board message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1680 
Cross-site scripting (XSS) vulnerability in CGI Online Worldweb Shopping 1.1 (a.k.a. COWS) allows remote attackers to execute arbitrary script as other users by injecting script into (1) diagnose.cgi or (2) compatible.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1681 
Cross-site scripting (XSS) vulnerability in Slashcode CVS releases June 17 through July 1 2002 allows remote attackers to execute arbitrary script as other users by injecting script into the paragraph <P> tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1682 
NewsReactor 1.0 uses a weak encryption scheme, which could allow local users to decrypt the passwords and gain access to other users' newsgroup accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1683 
Cross-site scripting (XSS) vulnerability in BadBlue Personal Edition 1.7.3 allows remote attackers to execute arbitrary script as other users by injecting script into the cleanSearchString() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1684 
Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in the script used to read Microsoft Office documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1685 
Cross-site scripting vulnerability (XSS) in BadBlue Enterprise Edition and Personal Edition 1.7 and 1.7.2 allows remote attackers to execute arbitrary script as other users by injecting script into ext.dll ISAPI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1686 
Buffer overflow in lscfg of unknown versions of AIX has unknown impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1687 
Buffer overflow in the diagnostics library in AIX allows local users to "cause data and instructions to be overwritten" via a long DIAGNOSTICS environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1688 
The browser history feature in Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to execute arbitrary script as other users and steal authentication information via cookies by injecting JavaScript into the URL, which is executed when the user hits the Back button.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1689 
Unknown vulnerability in the login program on AIX before 4.0 could allow remote users to specify 100 or more environment variables when logging on, which exceeds the length of a certain string, possibly triggering a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1690 
Unknown vulnerability in AIX before 4.0 with unknown attack vectors and unknown impact, aka "security issue," as fixed by APAR IY28225.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1691 
Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attackers to gain unauthorized access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1692 
Buffer overflow in backup utility of Microsoft Windows 95 allows attackers to execute arbitrary code by causing a filename with a long extension to be placed in a folder to be backed up.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1694 
Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1695 
Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while Norton Internet Security is running.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1696 
Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Always use Secure Viewer when decrypting" option is not checked, and the user replies to an encrypted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1697 
Electronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, which could allow remote attackers to gain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1698 
Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument in the message header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1699 
SQL injection vulnerability in ASP Client Check (ASPCC) 1.3 and 1.5 allows remote attackers to bypass authentication and gain unauthorized access via the password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1700 
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1702 
Cross-site scripting vulnerability (XSS) in DeltaScripts PHP Classifieds 6.0.5 allows remote attackers to execute arbitrary script as other users via the URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1703 
Cross-site scripting vulnerability (XSS) in auction.cgi for Mewsoft NetAuction 3.0 allows remote attackers to execute arbitrary script as other users via the Term parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1704 
Zeroboard 4.1, when the "allow_url_fopen" and "register_globals" variables are enabled, allows remote attackers to execute arbitrary PHP code by modifying the _zb_path parameter to reference a URL on a remote web server that contains the code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1705 
Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to cause a denial of service (crash) via a Cascading Style Sheet (CSS) with the p{cssText} element declared and a bold font weight.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1706 
Cisco IOS software 11.3 through 12.2 running on Cisco uBR7200 and uBR7100 series Universal Broadband Routers allows remote attackers to modify Data Over Cable Service Interface Specification (DOCSIS) settings via a DOCSIS file without a Message Integrity Check (MIC) signature, which is approved by the router.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1707 
install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_dir parameter to reference a URL on a remote web server that contains the code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1708 
Cross-site scripting vulnerability (XSS) in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the (1) subject or (2) message fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1709 
SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1710 
The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1711 
BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z
CVE-2002-1712 
Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the ACK and FIN bits set to the NetBIOS port (TCP/139), as demonstrated by stream3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-21T04:00:00.000Z