rainbutterfly/cve_corpus huggingface dataset:
CVE-2002-0803 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows remote attackers to display restricted products and components via a direct HTTP request to queryhelp.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-07-31T04:00:00.000Z
CVE-2002-0804 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0805 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, (1) creates new directories with world-writable permissions, and (2) creates the params file with world-writable permissions, which allows local users to modify the files and execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0806 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with the "del" option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0807 
Cross-site scripting vulnerabilities in Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, could allow remote attackers to execute script as other Bugzilla users via the full name (real name) field, which is not properly quoted by editusers.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-07-31T04:00:00.000Z
CVE-2002-0808 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when performing a mass change, sets the groupset of all bugs to the groupset of the first bug, which could inadvertently cause insecure groupset permissions to be assigned to some bugs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0809 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0810 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0811 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort order parameter to buglist.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-07-31T04:00:00.000Z
CVE-2002-0812 
Information leak in Compaq WL310, and the Orinoco Residential Gateway access point it is based on, uses a system identification string as a default SNMP read/write community string, which allows remote attackers to obtain and modify sensitive configuration information by querying for the identification string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-10T04:00:00.000Z
CVE-2002-0813 
Heap-based buffer overflow in the TFTP server capability in Cisco IOS 11.1, 11.2, and 11.3 allows remote attackers to cause a denial of service (reset) or modify configuration via a long filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0814 
Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0815 
The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP and SOAP/XML content from restricted sites by mapping the malicious server's parent DNS domain name to the restricted site, loading a page from the restricted site into one frame, and passing the information to the attacker-controlled frame, which is allowed because the document.domain of the two frames matches on the parent domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-01T04:00:00.000Z
CVE-2002-0816 
Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0817 
Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0818 
wwwoffled in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0819 
Format string vulnerability in artsd, when called by artswrapper, allows local users to gain privileges via format strings in the -a argument, which results in an error message that is not properly handled in a call to the arts_fatal function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-02T04:00:00.000Z
CVE-2002-0820 
FreeBSD kernel 4.6 and earlier closes the file descriptors 0, 1, and 2 after they have already been assigned to /dev/null when the descriptors reference procfs or linprocfs, which could allow local users to reuse the file descriptors in a setuid or setgid program to modify critical data and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-02T04:00:00.000Z
CVE-2002-0821 
Buffer overflows in Ethereal 0.9.4 and earlier allow remote attackers to cause a denial of service or execute arbitrary code via (1) the BGP dissector, or (2) the WCP dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-02T04:00:00.000Z
CVE-2002-0822 
Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly excecute arbitrary code via the (1) SOCKS, (2) RSVP, (3) AFS, or (4) LMP dissectors, which can be caused to core dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-02T04:00:00.000Z
CVE-2002-0823 
Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0824 
BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0825 
Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-07T04:00:00.000Z
CVE-2002-0826 
Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0827 
Vulnerability in pppd on UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to gain root privileges via (1) ppptalk or (2) ppp, a different vulnerability than CVE-2002-0824.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-07T04:00:00.000Z
CVE-2002-0829 
Integer overflow in the Berkeley Fast File System (FFS) in FreeBSD 4.6.1 RELEASE-p4 and earlier allows local users to access arbitrary file contents within FFS to gain privileges by creating a file that is larger than allowed by the virtual memory system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0830 
Network File System (NFS) in FreeBSD 4.6.1 RELEASE-p7 and earlier, NetBSD 1.5.3 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service (hang) via an RPC message with a zero length payload, which causes NFS to reference a previous payload and enter an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0831 
The kqueue mechanism in FreeBSD 4.3 through 4.6 STABLE allows local users to cause a denial of service (kernel panic) via a pipe call in which one end is terminated and an EVFILT_WRITE filter is registered for the other end.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0832 
Internet Explorer 5, 5.6, and 6 allows remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData (storeuserData) feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-07T04:00:00.000Z
CVE-2002-0833 
Buffer overflow in Eudora 5.1.1 and 5.0-J for Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a multi-part message with a long boundary string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-07T04:00:00.000Z
CVE-2002-0834 
Buffer overflow in the ISIS dissector for Ethereal 0.9.5 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via malformed packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-23T04:00:00.000Z
CVE-2002-0835 
Preboot eXecution Environment (PXE) server allows remote attackers to cause a denial of service (crash) via certain DHCP packets from Voice-Over-IP (VOIP) phones.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0836 
dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0837 
wordtrans 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to (1) execute arbitrary code or (2) conduct cross-site scripting attacks via certain parameters (possibly "dict") to the wordtrans.php script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-09-10T04:00:00.000Z
CVE-2002-0838 
Buffer overflow in (1) gv 3.5.8 and earlier, (2) gvv 1.0.2 and earlier, (3) ggv 1.99.90 and earlier, (4) gnome-gv, and (5) kghostview in kdegraphics 2.2.2 and earlier, allows attackers to execute arbitrary code via a malformed (a) PDF or (b) PostScript file, which is processed by an unsafe call to sscanf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-10-01T04:00:00.000Z
CVE-2002-0839 
The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-10-05T04:00:00.000Z
CVE-2002-0840 
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0842 
Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracle9i Application Server 9.0.2) allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes the format string specifiers to be returned from dav_lookup_uri() in mod_dav.c, which is then used in a call to ap_log_rerror().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0843 
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-10-05T04:00:00.000Z
CVE-2002-0844 
Off-by-one overflow in the CVS PreservePermissions of rcs.c for CVSD before 1.11.2 allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0845 
Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0846 
The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specified length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0847 
tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0848 
Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier, when using RADIUS with a challenge type of Password Authentication Protocol (PAP) or Challenge, sends the user password in cleartext in a validation retry request, which could allow remote attackers to steal passwords via sniffing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0849 
Linux-iSCSI iSCSI implementation installs the iscsi.conf file with world-readable permissions on some operating systems, including Red Hat Linux Limbo Beta #1, which could allow local users to gain privileges by reading the cleartext CHAP password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-10T04:00:00.000Z
CVE-2002-0850 
Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0851 
Format string vulnerability in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the ISDN4Linux (i4l) package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0852 
Buffer overflows in Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service via (1) an Internet Key Exchange (IKE) with a large Security Parameter Index (SPI) payload, or (2) an IKE packet with a large number of valid payloads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-14T04:00:00.000Z
CVE-2002-0853 
Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0854 
Buffer overflows in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the i4l package on SuSE 7.3, 8.0, and possibly other operating systems, may allow local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-14T04:00:00.000Z
CVE-2002-0855 
Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-14T04:00:00.000Z
CVE-2002-0856 
SQL*NET listener for Oracle Net Oracle9i 9.0.x and 9.2 allows remote attackers to cause a denial of service (crash) via certain debug requests that are not properly handled by the debugging feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0857 
Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-20T04:00:00.000Z
CVE-2002-0858 
catsnmp in Oracle 9i and 8i is installed with a dbsnmp user with a default dbsnmp password, which allows attackers to perform restricted database operations and possibly gain other privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-20T04:00:00.000Z
CVE-2002-0859 
Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0860 
The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that redirects to the target file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0861 
Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-23T04:00:00.000Z
CVE-2002-0862 
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-09-10T04:00:00.000Z
CVE-2002-0863 
Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-10-01T04:00:00.000Z
CVE-2002-0864 
The Remote Data Protocol (RDP) version 5.1 in Microsoft Windows XP allows remote attackers to cause a denial of service (crash) when Remote Desktop is enabled via a PDU Confirm Active data packet that does not set the Pattern BLT command, aka "Denial of Service in Remote Desktop."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0865 
A certain class that supports XML (Extensible Markup Language) in Microsoft Virtual Machine (VM) 5.0.3805 and earlier, probably com.ms.osp.ospmrshl, exposes certain unsafe methods, which allows remote attackers to execute unsafe code via a Java applet, aka "Inappropriate Methods Exposed in XML Support Classes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0866 
Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL terminated by a null string, aka "DLL Execution via JDBC Classes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0867 
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet Explorer via invalid handle data in a Java applet, aka "Handle Validation Flaw."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2004-09-01T04:00:00.000Z
CVE-2002-0869 
Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-11-02T05:00:00.000Z
CVE-2002-0870 
The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through the interface, possibly via a variant of the original attack, as identified by Cisco bug ID CSCdw08549.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2002-08-20T04:00:00.000Z
CVE-2002-0871 
xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0872 
l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z
CVE-2002-0873 
Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attribute/value pair, possibly via a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2003-04-02T05:00:00.000Z