yahoo-inc/cve-impacts huggingface dataset:
CVE-2002-1960: Cross-site scripting (XSS) vulnerability in Cybozu Share360 1.1 allows remote attackers to inject arbitrary web script or HTML via an HTML link.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via an, cross-site scripting (xss)
CVE-2002-1961: Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL whose hostname portion uses a fully qualified domain name (FQDN) that ends in a "." (dot).
Key phrases: bypass URL access restrictions, bypass URL access restrictions via a URL whose, url access restrictions
CVE-2002-1962: Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL with an IP address instead of a hostname.
Key phrases: bypass URL access restrictions, bypass URL access restrictions via a URL with, url access restrictions
CVE-2002-1963: Linux kernel 2.4.1 through 2.4.19 sets root's NR_RESERVED_FILES limit to 10 files, which allows local users to cause a denial of service (resource exhaustion) by opening 10 setuid binaries.
Key phrases: denial of service (resource exhaustion), cause a denial of service (resource exhaustion, setuid binaries
CVE-2002-1964: Unknown vulnerability in WesMo phpEventCalendar 1.1 allows remote attackers to execute arbitrary commands via unknown attack vectors.
Key phrases: execute arbitrary commands, execute arbitrary commands via unknown attack vectors
CVE-2002-1965: Cross-site scripting (XSS) vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to inject arbitrary web script or HTML via the (1) Javascript events, as demonstrated via an onerror event in an IMG SRC tag or (2) User-Agent field in an HTTP GET request.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1966: Directory traversal vulnerability in magiccard.cgi in My Postcards Platinum 5.0 and 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2002-1967: Buffer overflow in XiRCON 1.0 Beta 4 allows remote attackers to cause a denial of service (disconnect) via a long (1) ctcp, (2) primsg, (3) msg, or (4) notice command.
Key phrases: denial of service (disconnect), cause a denial of service (disconnect), buffer overflow
CVE-2002-1968: Com21 DOXport 1100 series cable modem running firmware 2.1.1.106, and possibly other versions before 2.1.1.108.003, downloads a DOCSIS configuration file from a TFTP server running on the internal network, which allows local users to modify configuration of the modem via a malicious TFTP server.
Key phrases: modify configuration of the modem via a malicious
CVE-2002-1969: Magic Notebook 1.0b and 1.1b allows remote attackers to cause a denial of service (crash) via an invalid username during login.
Key phrases: denial of service (crash), cause a denial of service (crash), invalid username
CVE-2002-1970: SnortCenter 0.9.5, when configured to push Snort rules, stores the rules in a temporary file with world-readable and world-writable permissions, which allows local users to obtain usernames and passwords for the alert database servers.
Key phrases: obtain usernames and passwords, obtain usernames and passwords for the alert database, world-writable permissions
CVE-2002-1971: The ping utility in networking_utils.php in Sourcecraft Networking_Utils 1.0 allows remote attackers to read arbitrary files via shell metacharacters in the Domain name or IP address argument.
Key phrases: read arbitrary files, read arbitrary files via shell metacharacters in the
CVE-2002-1972: Unknown vulnerability in Parallel port powerSwitch (aka pp_powerSwitch) 0.1 does not properly enforce access controls, which allows local users to access arbitrary ports.
Key phrases: access arbitrary ports, unknown
CVE-2002-1973: Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0, and 6.0 before SP3, as used in multiple products including BadBlue, allows remote attackers to cause a denial of service (access violation and crash) and possibly execute arbitrary code via a long query string that causes a parsing error.
Key phrases: execute arbitrary code, denial of service (access violation and crash), cause a denial of service (access violation, buffer overflow
CVE-2002-1974: The FTP service in Zaurus PDAs SL-5000D and SL-5500 does not require authentication, which allows remote attackers to access the file system as root.
Key phrases: access the file system as root
CVE-2002-1975: Sharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password as stored in the Security.conf file, which makes it easier for local users to guess the password via brute force methods.
Key phrases: brute force methods
CVE-2002-1976: ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKET_MR_PROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap.
Key phrases: sniff the network without detection
CVE-2002-1977: Network Associates PGP 7.0.4 and 7.1 does not time out according to the value set in the "Passphrase Cache" option, which could allow attackers to open encrypted files without providing a passphrase.
Key phrases: open encrypted files without providing a passphrase
CVE-2002-1978: IPFilter 3.1.1 through 3.4.28 allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.
Key phrases: bypass firewall rules, bypass firewall rules by sending a PASV command, pasv command string
CVE-2002-1979: WatchGuard SOHO products running firmware 5.1.6 and earlier, and Vclass/RSSA using 3.2 SP1 and earlier, allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.
Key phrases: bypass firewall rules, bypass firewall rules by sending a PASV command, pasv command string
CVE-2002-1980: Buffer overflow in Volume Manager daemon (vold) of Sun Solaris 2.5.1 through 8 allows local users to execute arbitrary code via unknown attack vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown attack vectors, buffer overflow
CVE-2002-1981: Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings.
Key phrases: execute the (1) sp_MSSetServerProperties or (, modify configuration including SQL server startup and alert
CVE-2002-1982: Directory traversal vulnerability in the list_directory function in Icecast 1.3.12 allows remote attackers to determine if a directory exists via a .. (dot dot) in the GET request, which returns different error messages depending on whether the directory exists or not.
Key phrases: determine if a directory exists via a .., directory traversal, error messages
CVE-2002-1983: The timer implementation in QNX RTOS 6.1.0 allows local users to cause a denial of service (hang) and possibly execute arbitrary code by creating multiple timers with a 1-ms tick.
Key phrases: execute arbitrary code, denial of service (hang), cause a denial of service (hang)
CVE-2002-1984: Microsoft Internet Explorer 5.0.1 through 6.0 on Windows 2000 or Windows XP allows remote attackers to cause a denial of service (crash) via an OBJECT tag that contains a crafted CLASSID (CLSID) value of "CLSID:00022613-0000-0000-C000-000000000046".
Key phrases: denial of service (crash), cause a denial of service (crash), object tag
CVE-2002-1985: iSMTP 5.0.1 allows remote attackers to cause a denial of service via a long "MAIL FROM" command, possibly triggering a buffer overflow.
Key phrases: cause a denial of service via a long, buffer overflow
CVE-2002-1986: Perception LiteServe 2.0 through 2.0.1 allows remote attackers to obtain the source code of CGI scripts via an HTTP request with a trailing dot (".").
Key phrases: obtain the source code of CGI scripts via
CVE-2002-1987: Directory traversal vulnerability in view_source.jsp in Resin 2.1.2 allows remote attackers to read arbitrary files via a "\\\\.." (backslash dot dot).
Key phrases: read arbitrary files, read arbitrary files via a "\\\\.., directory traversal
CVE-2002-1988: Resin 2.1.1 allows remote attackers to cause a denial of service (memory consumption and hang) via a URL with long variables for non-existent resources.
Key phrases: denial of service (memory consumption and hang), cause a denial of service (memory consumption, url with long variables, non-existent resources
CVE-2002-1989: Resin 2.1.1 allows remote attackers to cause a denial of service (thread and connection consumption) via multiple URL requests containing the DOS 'CON' device name and a registered file extension such as .jsp or .xtp.
Key phrases: denial of service (thread and connection consumption), cause a denial of service (thread and
CVE-2002-1990: Resin 2.0.5 through 2.1.2 allows remote attackers to reveal physical path information via a URL request for the example Java class file HelloServlet.
Key phrases: reveal physical path information via a URL request
CVE-2002-1991: PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php.
Key phrases: execute arbitrary commands, php file inclusion
CVE-2002-1992: Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote attackers to cause a denial of service in IIS via (1) a long template file name or (2) a long HTTP header.
Key phrases: cause a denial of service in IIS via, buffer overflow
CVE-2002-1993: webbbs_post.pl in WebBBS 4 and 5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the followup parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2002-1994: advserver.exe in Advanced Web Server (AdvServer) Professional 1.030000 allows remote attackers to cause a denial of service via multiple HTTP requests containing a single carriage return/line feed (CRLF) sequence.
Key phrases: cause a denial of service via multiple HTTP
CVE-2002-1995: Cross-site scripting (XSS) vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1996: Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and (2) catid parameter in index.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1997: ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension.
Key phrases: execute arbitrary code, bypass filtering, bypass filtering and possibly execute arbitrary code via
CVE-2002-1998: Buffer overflow in rpc.cmsd in SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows remote attackers to execute arbitrary commands via a long parameter to rtable_create (procedure 21).
Key phrases: execute arbitrary commands, execute arbitrary commands via a long parameter to, buffer overflow
CVE-2002-1999: HP Praesidium Webproxy 1.0 running on HP-UX 11.04 VVOS could allow remote attackers to cause Webproxy to forward requests to the internal network via crafted HTTP requests.
Key phrases: cause Webproxy to forward requests to the internal
CVE-2002-2000: ACMS 4.3 and 4.4 in OpenVMS Alpha 7.2 and 7.3 does not properly use process privileges, which allows attackers to access data.
Key phrases: access data, process privileges
CVE-2002-20001: The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
Key phrases: send arbitrary numbers, send arbitrary numbers that are actually not public, DHE, disruptive, basic attack scenario
CVE-2002-2001: jmcce 1.3.8 in Mandrake 8.1 creates log files in /tmp with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack, predictable names
CVE-2002-2002: Buffer overflow in libc in Compaq Tru64 4.0F, 5.0, 5.1 and 5.1A allows attackers to execute arbitrary code via long (1) LANG and (2) LOCPATH environment variables.
Key phrases: execute arbitrary code, execute arbitrary code via long (1), buffer overflow
CVE-2002-2003: ypbind in Compaq Tru64 4.0F, 4.0G, 5.0A, 5.1 and 5.1A allows remote attackers to cause the process to core dump via certain network packets generated by nmap.
Key phrases: cause the process to core dump via certain, ypbind
CVE-2002-2004: portmapper in Compaq Tru64 4.0G and 5.0A allows remote attackers to cause a denial of service via a flood of packets.
Key phrases: cause a denial of service via a flood, portmapper
CVE-2002-2005: Unknown vulnerability in Java web start 1.0.1_01, 1.0.1, 1.0 and 1.0.1.01 (HP-UX 11.x only) allows attackers to gain access to restricted resources via unknown attack vectors.
Key phrases: gain access, gain access to restricted resources via unknown attack, unknown attack vectors
CVE-2002-2006: The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
Key phrases: obtain the installation path and other sensitive system information, snoopservlet
CVE-2002-2007: The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
Key phrases: obtain sensitive system information, obtain sensitive system information such as directory listings
CVE-2002-2008: Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
Key phrases: obtain the web root path via an HTTP request, leak information
CVE-2002-2009: Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
Key phrases: obtain the web root path via HTTP requests
CVE-2002-2010: Cross-site scripting (XSS) vulnerability in htsearch.cgi in htdig (ht://Dig) 3.1.5, 3.1.6, and 3.2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2011: Cross-site scripting (XSS) vulnerability in the fom CGI program (fom.cgi) in Faq-O-Matic 2.711 and 2.712 allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2012: Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
Key phrases: cause "unexpected results" via an HTTP, unknown
CVE-2002-2013: Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
Key phrases: steal cookies from another domain via a link
CVE-2002-2014: Lotus Domino 5.0.8 web server returns different error messages when a valid or invalid user is provided in HTTP requests, which allows remote attackers to determine valid user names and makes it easier to conduct brute force attacks.
Key phrases: determine valid user names and makes it easier, brute force
CVE-2002-2015: PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code via the caselist parameter.
Key phrases: include arbitrary files, include arbitrary files and possibly execute code via, php file inclusion
CVE-2002-2016: User-mode Linux (UML) 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code.
Key phrases: execute arbitrary code
CVE-2002-2017: sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious program, which is then executed by sastcpd.
Key phrases: execute arbitrary code, execute arbitrary code by setting the authprog environment
CVE-2002-2018: sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the netencralg environment variable, which causes a segmentation fault.
Key phrases: gain privileges, gain privileges by setting the netencralg environment variable, segmentation fault
CVE-2002-2019: PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) 2.1 allows remote attackers to execute arbitrary PHP code via the include_file parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the include_file parameter, php remote file inclusion, arbitrary php code
CVE-2002-2020: Netgear RP114 Cable/DSL Web Safe Router Firmware 3.26 uses a default administrator password and accepts admin logins on the external interface, which allows remote attackers to gain privileges if the password is not changed.
Key phrases: gain privileges, gain privileges if the password is not changed, admin logins
CVE-2002-2021: Cross-site scripting (XSS) vulnerability in WoltLab Burning Board (wbboard) 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2022: Format string vulnerability in Kaffe OpenVM 1.0.6 and earlier allows local users to execute arbitrary code, when a java.lang.NoClassDefFoundError is thrown, via format specifiers in the forName attribute.
Key phrases: execute arbitrary code, format string
CVE-2002-2023: The get_parameter_from_freqency_source function in beep2 1.0, 1.1 and 1.2, when installed setuid root, allows local users to read arbitrary files via unknown attack vectors.
Key phrases: read arbitrary files, read arbitrary files via unknown attack vectors, setuid root
CVE-2002-2024: Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.
Key phrases: obtain the full web root pathname via an HTTP request, horde imp, leak information
CVE-2002-2025: Lotus Domino server 5.0.9a and earlier allows remote attackers to cause a denial of service by exhausting the number of working threads via a large number of HTTP requests for (1) an MS-DOS device name and (2) an MS-DOS device name with a large number of characters appended to the device name.
Key phrases: cause a denial of service by exhausting the
CVE-2002-2026: Buffer overflow in BrowseFTP 1.62 client allows remote FTP servers to execute arbitrary code via a long FTP "220" message reply.
Key phrases: execute arbitrary code, execute arbitrary code via a long FTP ", buffer overflow
CVE-2002-2027: Database of Our Owlish Wisdom (DOOW) 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform unauthorized activities.
Key phrases: perform unauthorized activities, user permissions
CVE-2002-2028: The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing.
Key phrases: brute force password guessing
CVE-2002-2029: PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
Key phrases: read arbitrary files, read arbitrary files and possibly execute arbitrary programs
CVE-2002-2030: Stack-based buffer overflow in SQLData Enterprise Server 3.0 allows remote attacker to execute arbitrary code and cause a denial of service via a long HTTP request.
Key phrases: execute arbitrary code, execute arbitrary code and cause a denial of, stack-based buffer overflow, denial of service, stack based buffer overflow
CVE-2002-2031: Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files via a script tag with a src parameter that references a non-JavaScript file, then using the onError event handler to monitor the results.
Key phrases: determine the existence of arbitrary files via a, javascript execution, results
CVE-2002-2032: sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug parameter to (1) index.php and (2) modules.php.
Key phrases: gain SQL query information, gain SQL query information by setting the sql_debug
CVE-2002-2033: faqmanager.cgi in FAQManager 2.2.5 and earlier allows remote attackers to read arbitrary files by specifying the filename in the toc parameter with a trailing null character (%00).
Key phrases: read arbitrary files, read arbitrary files by specifying the filename in
CVE-2002-2034: The Email Sanitizer before 1.133 for Procmail allows remote attackers to bypass the mail filter and execute arbitrary code via crafted recursive multipart MIME attachments.
Key phrases: execute arbitrary code, bypass the mail filter, bypass the mail filter and execute arbitrary code
CVE-2002-2035: SQL injection vulnerability in RealityScape MyLogin 2000 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password in the login form.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection
CVE-2002-2036: Sun Ray Server Software (SRSS) 1.3, when Non-Smartcard Mobility (NSCM) is enabled, allows remote attackers to login as another user by running dtlogin from a system that supports the XDMCP client.
Key phrases: login as another user by running dtlogin from, non-smartcard mobility (nscm)
CVE-2002-2037: The Cisco Media Gateway Controller (MGC) in (1) SC2200 7.4 and earlier, (2) VSC3000 9.1 and earlier, (3) PGW 2200 9.1 and earlier, (4) Billing and Management Server (BAMS) and (5) Voice Services Provisioning Tool (VSPT) runs on default installations of Solaris 2.6 with unnecessary services and without the latest security patches, which allows attackers to exploit known vulnerabilities.
Key phrases: exploit known vulnerabilities
CVE-2002-2038: Next Generation POSIX Threading (NGPT) 1.9.0 uses a filesystem-based shared memory entry, which allows local users to cause a denial of service or in threaded processes or spoof files via unknown methods.
Key phrases: cause a denial of service or in threaded, filesystem-based shared memory entry, spoofing
CVE-2002-2039: /bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
Key phrases: obtain sensitive information, obtain sensitive information from core dump files by
CVE-2002-2040: The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.
Key phrases: execute arbitrary commands, execute arbitrary commands by modifying the PATH environment
CVE-2002-2041: Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allows local users to execute arbitrary code via (1) a long ABLANG environment variable in phlocale or (2) a long -u option to pkg-installer.
Key phrases: execute arbitrary code, execute arbitrary code via (1) a, buffer overflows
CVE-2002-2042: ptrace in the QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows programs to attach to privileged processes, which could allow local users to execute arbitrary code by modifying running processes.
Key phrases: execute arbitrary code, attach to privileged processes, execute arbitrary code by modifying running processes
CVE-2002-2043: SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands and log in as, sql injection
CVE-2002-2044: Cross-site scripting (XSS) vulnerability in x_stat_admin.php in x-stat 2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the phpinfo action.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2002-2045: x_stat_admin.php in x-stat 2.3 and earlier allows remote attackers to (1) execute PHP commands such as phpinfo or (2) obtain the full path of the web server via an invalid action parameter, which leaks the pathname in an error message.
Key phrases: obtain the full path of the web server, (1) execute PHP commands such as, invalid action parameter
CVE-2002-2046: x_news.php in X-News (x_news) 1.1 and earlier allows remote attackers to gain administrative privileges by stealing and replaying the md5_password cookie.
Key phrases: gain administrative privileges, gain administrative privileges by stealing and replaying the
CVE-2002-2047: The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2002-2048: Buffer overflow in PFinger 0.7.8 client allows remote attackers to execute arbitrary code via a long query value passed to the (1) finger program, (2) -l, (3) -d, and (4) -t options.  NOTE: if PFinger is not setuid or setgid, then this issue would not cross privilege boundaries and would not be considered a vulnerability.
Key phrases: execute arbitrary code, execute arbitrary code via a long query value, buffer overflow
CVE-2002-2049: configure for Dsniff 2.3, fragroute 1.2, and fragrouter 1.6, when downloaded from monkey.org on May 17, 2002, has been modified to contain a backdoor, which allows remote attackers to access the system.
Key phrases: access the system, backdoor
CVE-2002-2050: Directory traversal vulnerability in processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a .. (dot dot) in the hostname of a log entry.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a .. (dot, directory traversal
CVE-2002-2051: The processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a symlink attack on files specified as hostnames in a log file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2002-2052: Cisco 2611 router running IOS 12.1(6.5), possibly an interim release, allows remote attackers to cause a denial of service via port scans such as (1) scanning all ports on a single host and (2) scanning a network of hosts for a single open port through the router.  NOTE: the vendor could not reproduce this issue, saying that the original reporter was using an interim release of the software.
Key phrases: cause a denial of service via port scans, single open port
CVE-2002-2053: The design of the Hot Standby Routing Protocol (HSRP), as implemented on Cisco IOS 12.1, when using IRPAS, allows remote attackers to cause a denial of service (CPU consumption) via a router with the same IP address as the interface on which HSRP is running, which causes a loop.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption, loop
CVE-2002-2054: TeeKai Forum 1.2 allows remote attackers to authenticate as the administrator and and gain privileged web forum access by setting the valid_level cookie to admin.
Key phrases: gain privileged, authenticate as the administrator and and gain privileged, privileged web forum access, valid_level cookie
CVE-2002-2055: Cross-site scripting (XSS) vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2056: Cross-site scripting (XSS) vulnerability in TeeKai Forum 1.2 allows remote attackers to inject arbitrary web script or HTML via the valid_username_online cookie.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2057: TeeKai Forum 1.2 uses weak encryption of web usage statistics in data/member_log.txt, which is stored under the web document root with insufficient access control, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
Key phrases: identify IP's visiting the site by dividing, weak encryption, insufficient access control
CVE-2002-2058: TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'.
Key phrases: identify IP's visiting the site by dividing, weak encryption
CVE-2002-2059: BIOS D845BG, D845HV, D845PT and D845WN on Intel motherboards does not properly restrict access to configuration information when BIOS passwords are enabled, which could allow local users to change the default boot device via the F8 key.
Key phrases: change the default boot device via the F8
CVE-2002-2060: Buffer overflow in Links 2.0 pre4 allows remote attackers to crash client browsers and possibly execute arbitrary code via gamma tables in large 16-bit PNG images.
Key phrases: execute arbitrary code, crash client browsers and possibly execute arbitrary code, buffer overflow
CVE-2002-2061: Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG image with large width and height values and an 8-bit or 16-bit alpha channel.
Key phrases: execute arbitrary code, crash client browsers and execute arbitrary code via, heap-based buffer overflow, heap based buffer overflow
CVE-2002-2062: Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2063: AtGuard 3.2 allows remote attackers to bypass firwall filters and execute prohibited programs by changing the filenames to permitted filenames.
Key phrases: bypass firwall filters, bypass firwall filters and execute prohibited programs by
CVE-2002-2064: isadmin.php in PhpWebGallery 1.0 allows remote attackers to gain administrative access via by setting the photo_login cookie to pseudo.
Key phrases: gain administrative access, gain administrative access via by setting the photo_login, pseudo
CVE-2002-2065: WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root.
Key phrases: read arbitrary include files with .inc extensions from, browsing in includes directory
CVE-2002-2066: BestCrypt BCWipe 1.0.7 and 2.0 through 2.35.1 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Key phrases: recover sensitive information that was supposed to be, windows alternate data streams
CVE-2002-2067: East-Tec Eraser 2002 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Key phrases: recover sensitive information that was supposed to be, alternate data streams
CVE-2002-2068: Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Key phrases: recover sensitive information that was supposed to be, alternate data streams
CVE-2002-2069: PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Key phrases: recover sensitive information that was supposed to be, alternate data streams
CVE-2002-2070: SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Key phrases: recover sensitive information that was supposed to be, alternate data streams
CVE-2002-2071: Compaq Tru64 4.0 d allows remote attackers to cause a denial of service in (1) telnet, (2) FTP, (3) ypbind, (4) rpc.lockd, (5) snmp, (6) ttdbserverd, and possibly other services via a TCP SYN scan, as demonstrated using nmap.
Key phrases: cause a denial of service in (1
CVE-2002-2072: java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.
Key phrases: denial of service (JVM crash), cause a denial of service (JVM crash, null argument
CVE-2002-2073: Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2074: SQL injection vulnerability in Mailidx before 20020105 allows remote attackers to execute arbitrary SQL commands via the search web page.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the search web, sql injection
CVE-2002-2075: ICQ 2001a and 2002b allows remote attackers to cause a denial of service (memory consumption and hang) via a contact message with a large contacts number.
Key phrases: denial of service (memory consumption and hang), cause a denial of service (memory consumption
CVE-2002-2076: Directory traversal vulnerability in Lil' HTTP server 2.1 and 2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2002-2077: The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
Key phrases: obtain sensitive information, obtain sensitive information by sniffing the session
CVE-2002-2078: Heap-based buffer overflow in Floositek (1) FTGate Pro 1.05 and (2) FTGate Office 1.05 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, heap-based buffer overflow, heap based buffer overflow
CVE-2002-2079: mosix-protocol-stack in Multicomputer Operating System for UnIX (MOSIX) 1.5.7 allows remote attackers to cause a denial of service via malformed packets.
Key phrases: cause a denial of service via malformed packets
CVE-2002-2080: Floositek FTGate PRO 1.05 allows remote attackers to cause a denial of service (memory and CPU consumption) via a large number of RCPT TO: messages during an SMTP session.
Key phrases: denial of service (memory and CPU consumption), cause a denial of service (memory and, rcpt to: messages
CVE-2002-2081: cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\\\\temp.
Key phrases: denial of service (disk consumption), cause a denial of service (disk consumption
CVE-2002-2082: FTGate and FTGate Pro 1.05 lock user mailboxes before authentication succeeds, which allows remote attackers to lock the mailboxes of other users.
Key phrases: lock the mailboxes of other users
CVE-2002-2083: The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help feature, which can be launched from the Novell Netware login screen.
Key phrases: open arbitrary files, bypass the login and open arbitrary files via
CVE-2002-2084: Directory traversal vulnerability in index.php of Portix 0.4.02 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) l and (2) topic parameters.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2002-2085: Directory traversal vulnerability in page.cgi of WWWeBBB Forum 3.82 beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2002-2086: Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via (1) "<<script" in unspecified input fields or (2) a javascript: URL in the src attribute of an IMG tag.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss), unspecified
CVE-2002-2087: Buffer overflow in Borland InterBase 6.0 allows local users to execute arbitrary code via a long INTERBASE environment variable when calling (1) gds_drop, (2) gds_lock_mgr, or (3) gds_inet_server.
Key phrases: execute arbitrary code, execute arbitrary code via a long INTERBASE environment, buffer overflow
CVE-2002-2088: The MOSIX Project clump/os 5.4 creates a default VNC account without a password, which allows remote attackers to gain root access.
Key phrases: gain root access, vnc account
CVE-2002-2089: Buffer overflow in rcp in Solaris 9.0 allows local users to execute arbitrary code via a long command line argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long command line, buffer overflow
CVE-2002-2090: Caucho Technology Resin server 2.1.1 to 2.1.2 allows remote attackers to obtain server's root path via requests for MS-DOS device names such as lpt9.xtp.
Key phrases: obtain server's root path via requests for MS, servers root path
CVE-2002-2091: Format string vulnerability in Deception Finger Daemon, decfingerd, 0.7 may allow remote attackers to execute arbitrary code via the username of a finger request.
Key phrases: execute arbitrary code, execute arbitrary code via the username of a, format string
CVE-2002-2092: Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.
Key phrases: gain privileges, gain privileges by attaching a debugger to a, race condition
CVE-2002-2093: The Video Control Panel on SGI O2/IRIX 6.5, when the Default Input is set to "Output Video", allows attackers to access a console session by running videoout then videoin.
Key phrases: access a console session by running videoout then, default input
CVE-2002-2094: Joe Testa hellbent 01 allows remote attackers to determine the full path of the web root directory via a GET request with a relative path that includes the root's parent, which generates a 403 error message if the parent is incorrect, but a normal response if the parent is correct.
Key phrases: determine the full path of the web root, joe testa hellbent
CVE-2002-2095: Joe Testa hellbent 01 webserver allows attackers to read files that are specified in the hellbent.prefs file by creating a file with a similar name in the web root, as demonstrated using (1) index.webroot and (2) index.ipallow.
Key phrases: read files that are specified in the hellbent.prefs
CVE-2002-2096: Buffer overflow in Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
Key phrases: execute arbitrary code, execute arbitrary code via a long (1, buffer overflow
CVE-2002-2097: The compression code in MaraDNS before 0.9.01 allows remote attackers to cause a denial of service via crafted DNS packets.
Key phrases: cause a denial of service via crafted DNS
CVE-2002-2098: Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets.
Key phrases: execute arbitrary code, execute arbitrary code via large packets, buffer overflow
CVE-2002-2099: Buffer overflow in the GNU DataDisplay Debugger (DDD) 3.3.1 allows local users to execute arbitrary code and possibly gain privileges via a long HOME environment variable.  NOTE: since DDD is not installed setuid or setgid, perhaps this issue should not be included in CVE.
Key phrases: execute arbitrary code, gain privileges, execute arbitrary code and possibly gain privileges via, buffer overflow
CVE-2002-2100: Microsoft Outlook 2002 allows remote attackers to embed bypass the file download restrictions for attachments via an HTML email message that uses an IFRAME to reference malicious content.
Key phrases: bypass the file download restrictions, embed bypass, embed bypass the file download restrictions for attachments
CVE-2002-2101: Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
Key phrases: execute arbitrary JavaScript code
CVE-2002-2102: InfBlocks.java in JCraft JZlib before 0.0.7 allow remote attackers to cause a denial of service (NullPointerException) via an invalid block of deflated data.
Key phrases: denial of service (NullPointerException), cause a denial of service (NullPointerException), infblocks, invalid block of deflated data
CVE-2002-2103: Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
Key phrases: hide the original source of activities, spoofed hostname, double-reverse lookup, spoofing
CVE-2002-2104: graph.php in Ganglia PHP RRD Web Client 1.0.2 allows remote attackers to execute arbitrary commands via the command parameter, which is provided to the passthru function.
Key phrases: execute arbitrary commands, execute arbitrary commands via the command parameter
CVE-2002-2105: Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.
Key phrases: prevent the system from booting via a corrupt, corrupt explorer.exe.manifest file
CVE-2002-2106: PHP remote file inclusion vulnerability in WikkiTikkiTavi before 0.21 allows remote attackers to execute arbitrary PHP code via the TemplateDir variable, as demonstrated using conflict.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the TemplateDir variable, php remote file inclusion
CVE-2002-2107: Cross-site scripting (XSS) vulnerability in the lookup script in Veridis OpenKeyServer (OKS) 1.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-2108: Unknown vulnerability in the "VAIO Manual" software in certain Sony VAIO personal computers sold from November 2001 to January 2002, allows remote attackers to modify data via a web page or HTML e-mail.
Key phrases: modify data via a web page or HTML, unknown
CVE-2002-2109: Matt Wright FormMail 1.9 and earlier allows remote attackers to bypass the HTTP_REFERER check and conduct unauthorized activities via (1) a blank referer, (2) a spoofed referer with a trusted domain/URL after the beginning of the referer, or (3) a spoofed referer with a trusted domain/URL in the beginning (hostname) portion of the referer.
Key phrases: bypass the HTTP_REFERER check, bypass the HTTP_REFERER check and conduct unauthorized activities, http_referer check, blank referer, spoofed referer, spoofing
CVE-2002-2110: The RCA Digital Cable Modems DCM225 and DCM225E allow remote attackers to cause a denial of service (modem device reset) by connecting to port 80 on the 10.0.0.0/8 device.
Key phrases: denial of service (modem device reset), cause a denial of service (modem device, port
CVE-2002-2111: Fwmon before 1.0.10 allows remote attackers to cause a denial of service (crash) by causing the kernel to return a large packet.
Key phrases: denial of service (crash), cause a denial of service (crash), fwmon
CVE-2002-2112: RCA Digital Cable Modem DCM225 and DCM225E, and other modems that must conform to the Data-over-Cable Service Interface Specifications DOCSIS standard, uses the "public" community string for SNMP access, which allows remote attackers to read or write MIB information.
Key phrases: read or write MIB information, public community string
CVE-2002-2113: search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2002-2114: Artekopia Netjuke before 1.0 b7 allows remote attackers to execute arbitrary code on the web server, possibly via the section parameter, which is passed to an eval call.
Key phrases: execute arbitrary code, execute arbitrary code on the web server, section parameter