yahoo-inc/cve-impacts huggingface dataset:
CVE-2002-1141: An input validation error in the Sun Microsystems RPC library Services for Unix 3.0 Interix SD, as implemented on Microsoft Windows NT4, 2000, and XP, allows remote attackers to cause a denial of service via malformed fragmented RPC client packets, aka "Denial of service by sending an invalid RPC request."
Key phrases: cause a denial of service via malformed fragmented, input validation error
CVE-2002-1142: Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.
Key phrases: execute code via a malformed HTTP request to, heap-based buffer overflow, malformed http request, heap based buffer overflow
CVE-2002-1143: Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."
Key phrases: steal sensitive information via certain field codes that, flaw in word fields, information disclosure
CVE-2002-1145: The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.
Key phrases: gain privileges, gain privileges by updating a webtask that is, public
CVE-2002-1146: The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Key phrases: denial of service (crash), cause a denial of service (crash), read buffer overflow
CVE-2002-1147: The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration enabled, does not authenticate requests to reset the device, which allows remote attackers to cause a denial of service via a direct request to the device_reset CGI program.
Key phrases: cause a denial of service via a direct
CVE-2002-1148: The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
Key phrases: read source code for server files via a, direct request
CVE-2002-1149: The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings.
Key phrases: sensitive information
CVE-2002-1150: The Remote Desktop Sharing (RDS) Screen Saver Protection capability for Microsoft NetMeeting 3.01 through SP2 (4.4.3396) allows attackers with physical access to hijack remote sessions by entering certain logoff or shutdown sequences (such as CTRL-ALT-DEL) and canceling out of the resulting user confirmation prompts, such as when the remote user is editing a document.
Key phrases: hijack remote sessions by entering certain logoff or, shutdown sequences
CVE-2002-1151: The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains.
Key phrases: execute script and steal cookies from subframes that, cross-site scripting
CVE-2002-1152: Konqueror in KDE 3.0 through 3.0.2 does not properly detect the "secure" flag in an HTTP cookie, which could cause Konqueror to send the cookie across an unencrypted channel, which could allow remote attackers to steal the cookie via sniffing.
Key phrases: steal the cookie via sniffing, unencrypted channel, steal cookie
CVE-2002-1153: IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers, such as "Host".
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash)
CVE-2002-1154: anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cause a denial of service (disk consumption) by using the command to report updates more frequently and fill the web server error log.
Key phrases: denial of service (disk consumption), cause a denial of service (disk consumption
CVE-2002-1155: Buffer overflow in KON kon2 0.3.9b and earlier allows local users to execute arbitrary code via a long -Coding command line argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long -Coding command, buffer overflow
CVE-2002-1156: Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
Key phrases: view the source code of a CGI script
CVE-2002-1157: Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
Key phrases: execute script as other web site visitors, cross-site scripting
CVE-2002-1158: Buffer overflow in the irw_through function for Canna 3.5b2 and earlier allows local users to execute arbitrary code as the bin user.
Key phrases: execute arbitrary code, execute arbitrary code as the bin user, buffer overflow
CVE-2002-1159: Canna 3.6 and earlier does not properly validate requests, which allows remote attackers to cause a denial of service or information leak.
Key phrases: cause a denial of service or information leak
CVE-2002-1160: The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su.
Key phrases: gain root privileges, gain root privileges by stealing the cookies from, mit-magic-cookies, steal cookie
CVE-2002-1165: Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
Key phrases: bypass the intended restrictions, bypass the intended restrictions of smrsh by inserting
CVE-2002-1166: Buffer overflow in John Franks WN Server 1.18.2 through 2.0.0 allows remote attackers to execute arbitrary code via a long GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long GET request, buffer overflow
CVE-2002-1167: Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP GET request.
Key phrases: execute script as other users via an HTTP, cross-site scripting (xss)
CVE-2002-1168: Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that contains an Location: header with a "%0a%0d" (CRLF) sequence, which echoes the Location as an HTTP header in the server response.
Key phrases: execute script as other users via an HTTP, cross-site scripting (xss)
CVE-2002-1169: IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to cause a denial of service (crash) via an HTTP request to helpout.exe with a missing HTTP version number, which causes ibmproxy.exe to crash.
Key phrases: denial of service (crash), cause a denial of service (crash), missing http version number
CVE-2002-1170: The handle_var_requests function in snmp_agent.c for the SNMP daemon in the Net-SNMP (formerly ucd-snmp) package 5.0.1 through 5.0.5 allows remote attackers to cause a denial of service (crash) via a NULL dereference.
Key phrases: denial of service (crash), cause a denial of service (crash), null dereference
CVE-2002-1174: Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2002-1175: The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed dns packet
CVE-2002-1176: Buffer overflow in Winamp 2.81 allows remote attackers to execute arbitrary code via a long Artist ID3v2 tag in an MP3 file.
Key phrases: execute arbitrary code, execute arbitrary code via a long Artist ID3v2, buffer overflow
CVE-2002-1177: Multiple buffer overflows in Winamp 3.0, when displaying an MP3 in the Media Library window, allows remote attackers to execute arbitrary code via an MP3 file containing a long (1) Artist or (2) Album ID3v2 tag.
Key phrases: execute arbitrary code, execute arbitrary code via an MP3 file containing, buffer overflows
CVE-2002-1178: Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\\\\ (dot-dot backslash) sequences in an HTTP request to the cgi-bin directory.
Key phrases: execute arbitrary commands, execute arbitrary commands via ..\\\\ (dot, directory traversal
CVE-2002-1179: Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long "From" address, which triggers the overflow when the user views or previews the message.
Key phrases: execute arbitrary code, execute arbitrary code via a digitally signed email, buffer overflow
CVE-2002-1180: A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."
Key phrases: upload malicious .COM files, script source access
CVE-2002-1181: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.
Key phrases: execute HTML script as other users through (, cross-site scripting (xss), unknown attack vectors
CVE-2002-1182: IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed webdav requests, large amount of memory
CVE-2002-1183: Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).
Key phrases: execute code, certificate validation flaw, identity spoofing
CVE-2002-1184: The system root folder of Microsoft Windows 2000 has default permissions of Everyone group with Full access (Everyone:F) and is in the search path when locating programs during login or application launch from the desktop, which could allow attackers to gain privileges as other users via Trojan horse programs.
Key phrases: gain privileges, gain privileges as other users via Trojan horse
CVE-2002-1185: Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure."
Key phrases: denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, malformed png image file failure, heap based buffer overflow
CVE-2002-1186: Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."
Key phrases: steal potentially sensitive information from a user by, encoded characters information disclosure
CVE-2002-1187: Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource.
Key phrases: read and execute files on the local system, cross-site scripting vulnerability (xss)
CVE-2002-1188: Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading."
Key phrases: obtain user information, identify the path to the Temporary Internet Files, temporary internet files folders name reading
CVE-2002-1189: The default configuration of Cisco Unity 2.x and 3.x does not block international operator calls in the predefined restriction tables, which could allow authenticated users to place international calls using call forwarding.
Key phrases: place international calls using call forwarding, international operator calls
CVE-2002-1190: Cisco Unity 2.x and 3.x uses well-known default user accounts, which could allow remote attackers to gain access and place arbitrary calls.
Key phrases: place arbitrary calls, gain access, gain access and place arbitrary calls, default user accounts
CVE-2002-1191: The Sabserv client component in Sabre Desktop Reservation Software 4.2 through 4.4 allows remote attackers to cause a denial of service via malformed input to TCP port 1001.
Key phrases: cause a denial of service via malformed input
CVE-2002-1192: Multiple buffer overflows in rogue on NetBSD 1.6 and earlier, FreeBSD 4.6, and possibly other operating systems, allows local users to gain "games" group privileges via malformed entries in a game save file.
Key phrases: gain "games" group privileges, gain "games" group privileges via malformed, buffer overflows, malformed entries
CVE-2002-1193: tkmail before 4.0beta9-8.1 allows local users to create or overwrite files as users via a symlink attack on temporary files.
Key phrases: create or overwrite files as users via a, symlink
CVE-2002-1194: Buffer overflow in talkd on NetBSD 1.6 and earlier, and possibly other operating systems, may allow remote attackers to execute arbitrary code via a long inbound message.
Key phrases: execute arbitrary code, execute arbitrary code via a long inbound message, buffer overflow
CVE-2002-1195: Cross-site scripting vulnerability (XSS) in the PHP interface for ht://Check 1.1 allows remote web servers to insert arbitrary HTML, including script, via a web page.
Key phrases: insert arbitrary HTML, cross-site scripting vulnerability (xss), arbitrary html
CVE-2002-1196: editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.
CVE-2002-1197: bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail.
Key phrases: execute arbitrary code, execute arbitrary code via shell metacharacters in a
CVE-2002-1198: Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL injection attack.
Key phrases: execute arbitrary SQL, execute arbitrary SQL via a SQL injection attack, sql injection
CVE-2002-1199: The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments.
Key phrases: read arbitrary files, directory traversal, symlink
CVE-2002-1200: Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute
CVE-2002-1201: IBM AIX 4.3.3 and AIX 5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a flood of malformed TCP packets without any flags set, which prevents AIX from releasing the associated memory buffers.
Key phrases: denial of service (CPU consumption or crash), cause a denial of service (CPU consumption, cpu consumption, malformed tcp packets
CVE-2002-1202: Unknown vulnerability in routed for HP Tru64 UNIX V4.0F through V5.1A allows local and remote attackers to read arbitrary files.
Key phrases: read arbitrary files, unknown
CVE-2002-1203: IBM SecureWay Firewall before 4.2.2 performs extra processing before determining that a packet is invalid and dropping it, which allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed TCP packets without any flags set.
Key phrases: denial of service (resource exhaustion), cause a denial of service (resource exhaustion
CVE-2002-1204: Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail address, and possibly the e-mail password, by redefining the user_pref() function and accessing the prefs.js file, which is stored in a directory with a predictable name.
Key phrases: use a link to steal a user's, predictable name, sensitive information
CVE-2002-1209: Directory traversal vulnerability in SolarWinds TFTP Server 5.0.55, and possibly earlier, allows remote attackers to read arbitrary files via "..\\\\" (dot-dot backslash) sequences in a GET request.
Key phrases: read arbitrary files, read arbitrary files via "..\\\\", directory traversal
CVE-2002-1210: Qualcomm Eudora 5.1.1, 5.2, and possibly other versions stores email attachments in a predictable location, which allows remote attackers to read arbitrary files via a link that loads an attachment with malicious script into a frame, which then executes the script in the local browser context.
Key phrases: read arbitrary files, read arbitrary files via a link that loads, predictable location
CVE-2002-1211: Prometheus 6.0 and earlier allows remote attackers to execute arbitrary PHP code via a modified PROMETHEUS_LIBRARY_BASE that points to code stored on a remote server, which is then used in (1) index.php, (2) install.php, or (3) various test_*.php scripts.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a modified PROMETHEUS_LIBRARY_BASE
CVE-2002-1212: Buffer overflow in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1213: Directory traversal vulnerability in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to read arbitrary files via an HTTP request with ".." (dot-dot) sequences containing URL-encoded forward slash ("%2F") characters.
Key phrases: read arbitrary files, read arbitrary files via an HTTP request with, directory traversal
CVE-2002-1214: Buffer overflow in Microsoft PPTP Service on Windows XP and Windows 2000 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a certain PPTP packet with malformed control data.
Key phrases: execute arbitrary code, denial of service (hang), cause a denial of service (hang), buffer overflow
CVE-2002-1215: Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier (claimed as buffer overflows in some sources) allow remote attackers to execute arbitrary code via certain packets to UDP port 694 (incorrectly claimed as TCP in some sources).
Key phrases: execute arbitrary code, execute arbitrary code via certain packets to UDP, multiple format string, buffer overflows
CVE-2002-1216: GNU tar 1.13.19 and other versions before 1.13.25 allows remote attackers to overwrite arbitrary files via a symlink attack, as the result of a modification that effectively disabled the security check.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack, modification
CVE-2002-1217: Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions.
Key phrases: execute arbitrary code, cross-frame scripting, arbitrary files
CVE-2002-1219: Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).
Key phrases: execute arbitrary code, execute arbitrary code via a certain DNS server, buffer overflow
CVE-2002-1220: BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.
Key phrases: denial of service (termination due to assertion failure), cause a denial of service (termination due, udp payload size
CVE-2002-1221: BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.
Key phrases: denial of service (crash), cause a denial of service (crash), sig rr elements, invalid expiry times, null dereference
CVE-2002-1222: Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reset) via a long HTTP request.
Key phrases: denial of service (reset), cause a denial of service (reset), buffer overflow
CVE-2002-1223: Buffer overflow in DSC 3.0 parser from GSview, as used in KGhostView in KDE 1.1 and KDE 3.0.3a, may allow attackers to cause a denial of service or execute arbitrary code via a modified .ps (PostScript) input file.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary, buffer overflow
CVE-2002-1224: Directory traversal vulnerability in kpf for KDE 3.0.1 through KDE 3.0.3a allows remote attackers to read arbitrary files as the kpf user via a URL with a modified icon parameter.
Key phrases: read arbitrary files, read arbitrary files as the kpf user via, directory traversal
CVE-2002-1225: Multiple buffer overflows in Heimdal before 0.5, possibly in both the (1) kadmind and (2) kdc servers, may allow remote attackers to gain root access.
Key phrases: gain root access, buffer overflows
CVE-2002-1226: Unknown vulnerabilities in Heimdal before 0.5 with unknown impact, possibly in the (1) kadmind and (2) kdc servers, may allow remote or local attackers to gain root or other access, but not via buffer overflows (CVE-2002-1225).
Key phrases: gain root or other access, unknown, unknown impact, buffer overflows, gain root access
CVE-2002-1227: PAM 0.76 treats a disabled password as if it were an empty (null) password, which allows local and remote attackers to gain privileges as disabled users.
Key phrases: gain privileges, gain privileges as disabled users, disabled password, empty (null) password
CVE-2002-1228: Unknown vulnerability in NFS on Solaris 2.5.1 through Solaris 9 allows an NFS client to cause a denial of service by killing the lockd daemon.
Key phrases: cause a denial of service by killing the, unknown
CVE-2002-1229: Avaya Cajun switches P880, P882, P580, and P550R 5.2.14 and earlier contain undocumented accounts (1) manuf and (2) diag with default passwords, which allows remote attackers to gain privileges.
Key phrases: gain privileges, undocumented accounts, default passwords
CVE-2002-1230: NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message, as demonstrated by GetAd, aka "Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation."
Key phrases: execute arbitrary code, execute arbitrary code as LocalSystem via "shatter, flaw in windows wm_timer message handling, privilege elevation
CVE-2002-1231: SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to cause a denial of service via an rcp call on /proc.
Key phrases: cause a denial of service via an rcp, rcp call
CVE-2002-1232: Memory leak in ypdb_open in yp_db.c for ypserv before 2.5 in the NIS package 3.9 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of requests for a map that does not exist.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2002-1233: A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
Key phrases: read or modify the Apache password file via, regression error, symlink
CVE-2002-1235: The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
Key phrases: execute arbitrary code, execute arbitrary code via a buffer overflow attack
CVE-2002-1236: The remote management web server for Linksys BEFSR41 EtherFast Cable/DSL Router before firmware 1.42.7 allows remote attackers to cause a denial of service (crash) via an HTTP request to Gozila.cgi without any arguments.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1238: Peter Sandvik's Simple Web Server 0.5.1 and earlier allows remote attackers to bypass access restrictions for files via an HTTP request with a sequence of multiple / (slash) characters such as http://www.example.com///file/.
Key phrases: bypass access restrictions, bypass access restrictions for files via an HTTP
CVE-2002-1239: QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to find and execute the cp program while operating at raised privileges, which allows local users to gain privileges by modifying the PATH to point to a malicious cp program.
Key phrases: gain privileges, gain privileges by modifying the PATH to point
CVE-2002-1242: SQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php.
Key phrases: gain privileges, modify the database and gain privileges via the, sql injection
CVE-2002-1244: Format string vulnerability in Pablo FTP Server 1.5, 1.3, and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format strings in the USER command.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, format string
CVE-2002-1245: Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, which allows local users to modify /dev/mem and gain privileges via a modified PATH environment variable that points to a Trojan horse gzip program.
Key phrases: gain privileges, modify /dev/mem and gain privileges via
CVE-2002-1247: Buffer overflow in LISa allows local users to gain access to a raw socket via a long LOGNAME environment variable for the resLISa daemon.
Key phrases: gain access, gain access to a raw socket via a, buffer overflow
CVE-2002-1248: Northern Solutions Xeneo Web Server 2.1.0.0, 2.0.759.6, and other versions before 2.1.5 allows remote attackers to cause a denial of service (crash) via a GET request for a "%" URI.
Key phrases: denial of service (crash), cause a denial of service (crash), % uri
CVE-2002-1250: Buffer overflow in Abuse 2.00 and earlier allows local users to gain root privileges via a long -net command line argument.
Key phrases: gain root privileges, gain root privileges via a long -net command, buffer overflow
CVE-2002-1251: Buffer overflow in log2mail before 0.2.5.1 allows remote attackers to execute arbitrary code via a long log message.
Key phrases: execute arbitrary code, execute arbitrary code via a long log message, buffer overflow
CVE-2002-1252: The Application Messaging Gateway for PeopleTools 8.1x before 8.19, as used in various PeopleSoft products, allows remote attackers to read arbitrary files via certain XML External Entities (XXE) fields in an HTTP POST request that is processed by the SimpleFileHandler handler.
Key phrases: read arbitrary files, read arbitrary files via certain XML External Entities, xml external entities (xxe)
CVE-2002-1253: Abuse 2.00 and earlier allows local users to gain privileges via command line arguments that specify alternate Lisp scripts that run at escalated privileges, which can contain functions that execute commands or modify files.
Key phrases: gain privileges, gain privileges via command line arguments that specify, escalate privilege, execute commands
CVE-2002-1254: Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods."
Key phrases: bypass the cross-domain security model and access information, cross domain verification via cached methods, execute code
CVE-2002-1255: Microsoft Outlook 2002 allows remote attackers to cause a denial of service (repeated failure) via an email message with a certain invalid header field that is accessed using POP3, IMAP, or WebDAV, aka "E-mail Header Processing Flaw Could Cause Outlook 2002 to Fail."
Key phrases: denial of service (repeated failure), cause a denial of service (repeated failure, e-mail header processing flaw
CVE-2002-1256: The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller.
Key phrases: disable the digital signing settings in an SMB, unsigned
CVE-2002-1257: Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.
Key phrases: execute arbitrary code, execute arbitrary code by including a Java applet
CVE-2002-1258: Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error.
Key phrases: read files via a Java applet with a, parsing error, spoofing
CVE-2002-1260: The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
Key phrases: bypass security checks, bypass security checks and access database contents via, untrusted java applet
CVE-2002-1262: Internet Explorer 5.5 and 6.0 does not perform complete security checks on external caching, which allows remote attackers to read arbitrary files.
Key phrases: read arbitrary files, external caching
CVE-2002-1264: Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.
Key phrases: execute arbitrary code, execute arbitrary code via a long USERID parameter, buffer overflow
CVE-2002-1265: The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang).
Key phrases: denial of service (hang), cause a denial of service (hang), time-out mechanism
CVE-2002-1266: Mac OS X 10.2.2 allows local users to gain privileges by mounting a disk image file that was created on another system, aka "Local User Privilege Elevation via Disk Image File."
Key phrases: gain privileges, gain privileges by mounting a disk image file, local user privilege elevation via disk image file
CVE-2002-1267: Mac OS X 10.2.2 allows remote attackers to cause a denial of service by accessing the CUPS Printing Web Administration utility, aka "CUPS Printing Web Administration is Remotely Accessible."
Key phrases: cause a denial of service by accessing the, remotely accessible
CVE-2002-1268: Mac OS X 10.2.2 allows local users to gain privileges via a mounted ISO 9600 CD, aka "User Privilege Elevation via Mounting an ISO 9600 CD."
Key phrases: gain privileges, gain privileges via a mounted ISO 9600 CD, user privilege elevation
CVE-2002-1269: Unknown vulnerability in NetInfo Manager application in Mac OS X 10.2.2 allows local users to access restricted parts of a filesystem.
Key phrases: access restricted parts of a filesystem, unknown
CVE-2002-1270: Mac OS X 10.2.2 allows local users to read files that only allow write access via the map_fd() Mach system call.
Key phrases: read files that only allow write access via, write access via the map_fd() Mach
CVE-2002-1271: The Mail::Mailer Perl module in the perl-MailTools package 1.47 and earlier uses mailx as the default mailer, which allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx.
Key phrases: execute arbitrary commands, execute arbitrary commands by inserting them into the
CVE-2002-1272: Alcatel OmniSwitch 7700/7800 switches running AOS 5.1.1 contains a back door telnet server that was intended for development but not removed before distribution, which allows remote attackers to gain administrative privileges.
Key phrases: gain administrative privileges, back door telnet server
CVE-2002-1275: Unknown vulnerability in html2ps HTML/PostScript converter 1.0, when used within LPRng, allows remote attackers to execute arbitrary code via "unsanitized input."
Key phrases: execute arbitrary code, execute arbitrary code via "unsanitized input
CVE-2002-1276: An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
Key phrases: cross-site scripting (xss)
CVE-2002-1277: Buffer overflow in Window Maker (wmaker) 0.80.0 and earlier may allow remote attackers to execute arbitrary code via a certain image file that is not properly handled when Window Maker uses width and height information to allocate a buffer.
Key phrases: execute arbitrary code, execute arbitrary code via a certain image file, buffer overflow
CVE-2002-1278: The mailconf module in Linuxconf 1.24, and other versions before 1.28, on Conectiva Linux 6.0 through 8, and possibly other distributions, generates the Sendmail configuration file (sendmail.cf) in a way that configures Sendmail to run as an open mail relay, which allows remote attackers to send Spam email.
Key phrases: send Spam email, open mail relay, spam email
CVE-2002-1279: Multiple buffer overflows in conf.c for Masqmail 0.1.x before 0.1.17, and 0.2.x before 0.2.15, allow local users to gain privileges via certain entries in the configuration file (-C option).
Key phrases: gain privileges, gain privileges via certain entries in the configuration, buffer overflows
CVE-2002-1280: Memory leak in RealSecure Event Collector 6.5 allows attackers to cause a denial of service (memory consumption and crash).
Key phrases: denial of service (memory consumption and crash), cause a denial of service (memory consumption, memory leak
CVE-2002-1281: Unknown vulnerability in the rlogin KIO subsystem (rlogin.protocol) of KDE 2.x 2.1 and later, and KDE 3.x 3.0.4 and earlier, allows local and remote attackers to execute arbitrary code via a certain URL.
Key phrases: execute arbitrary code, execute arbitrary code via a certain URL, unknown
CVE-2002-1282: Unknown vulnerability in the telnet KIO subsystem (telnet.protocol) of KDE 2.x 2.1 and later allows local and remote attackers to execute arbitrary code via a certain URL.
Key phrases: execute arbitrary code, execute arbitrary code via a certain URL, unknown
CVE-2002-1283: Buffer overflow in Novell iManager (eMFrame) before 1.5 allows remote attackers to cause a denial of service via an authentication request with a long Distinguished Name (DN) attribute.
Key phrases: cause a denial of service via an authentication, buffer overflow
CVE-2002-1284: The wizard in KGPG 0.6 through 0.8.2 does not properly provide the passphrase to gpg when creating new keys, which causes secret keys to be created with an empty passphrase and allows local attackers to steal the keys if they can be read.
Key phrases: steal the keys if they can be read, empty passphrase
CVE-2002-1285: runlpr in the LPRng package allows the local lp user to gain root privileges via certain command line arguments.
Key phrases: gain root privileges, gain root privileges via certain command line arguments
CVE-2002-1286: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context via a URL that contains a colon in the domain portion, which is not properly parsed and loads an applet from a malicious site within the security context of the site that is being visited by the user.
Key phrases: steal cookies and execute script in a different
CVE-2002-1287: Stack-based buffer overflow in the Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service via a long class name through (1) Class.forName or (2) ClassLoader.loadClass.
Key phrases: cause a denial of service via a long, stack-based buffer overflow, stack based buffer overflow
CVE-2002-1288: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to determine the current directory of the Internet Explorer process via the getAbsolutePath() method in a File() call.
Key phrases: determine the current directory of the Internet Explorer
CVE-2002-1289: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code via the getNativeServices function, which creates an instance of the com.ms.awt.peer.INativeServices (INativeServices) class, whose methods do not verify the memory addresses that are passed as parameters.
Key phrases: execute arbitrary code, denial of service (crash), read restricted process memory
CVE-2002-1290: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read and modify the contents of the Clipboard via an applet that accesses the (1) ClipBoardGetText and (2) ClipBoardSetText methods of the INativeServices class.
Key phrases: read and modify the contents of the Clipboard
CVE-2002-1291: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares via an applet tag with a codebase set to a "file://%00" (null character) URL.
Key phrases: read arbitrary local files and network shares via, applet tag
CVE-2002-1292: The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security Manager (SSM) class (com.ms.security.StandardSecurityManager) and bypass intended StandardSecurityManager restrictions by modifying the (1) deniedDefinitionPackages or (2) deniedAccessPackages settings, causing a denial of service by adding Java applets to the list of applets that are prevented from running.
Key phrases: bypass intended StandardSecurityManager restrictions, extend the Standard Security Manager (SSM), denial of service
CVE-2002-1293: The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loader.CabCracker), which allows remote attackers to bypass the security checks that are performed by the load() method.
Key phrases: bypass the security checks, bypass the security checks that are performed by, bypass security
CVE-2002-1294: The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities via an applet that uses those references to access proprietary Microsoft methods.
Key phrases: denial of service (crash due to illegal memory accesses), cause a denial of service (crash due, unauthorized activities
CVE-2002-1295: The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions (such as private constructors) by providing the class name in the code parameter, aka "Incomplete Java Object Instantiation Vulnerability."
Key phrases: denial of service (crash), bypass Java class restrictions, cause a denial of service (crash), incomplete java object instantiation
CVE-2002-1296: Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module.
Key phrases: execute arbitrary code, execute arbitrary code via ".." sequences, directory traversal
CVE-2002-1306: Multiple buffer overflows in LISa on KDE 2.x for 2.1 and later, and KDE 3.x before 3.0.4, allow (1) local and possibly remote attackers to execute arbitrary code via the "lisa" daemon, and (2) remote attackers to execute arbitrary code via a certain "lan://" URL.
Key phrases: execute arbitrary code, execute arbitrary code via the "lisa", multiple buffer overflows
CVE-2002-1307: Cross-site scripting vulnerability (XSS) in MHonArc 2.5.12 and earlier allows remote attackers to insert script or HTML via an email message with the script in a MIME header name.
Key phrases: insert script or HTML via an email message, cross-site scripting vulnerability (xss)
CVE-2002-1308: Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression.
Key phrases: execute arbitrary code, execute arbitrary code via a jar: URL, heap-based buffer overflow, heap based buffer overflow
CVE-2002-1309: Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary via an HTTP GET request with a long .cfm file name.
Key phrases: execute arbitrary via an HTTP GET request with, heap-based buffer overflow, http get request, heap based buffer overflow
CVE-2002-1310: Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia JRun 4.0 and earlier allows remote attackers to execute arbitrary via an HTTP GET request with a long .jsp file name.
Key phrases: execute arbitrary via an HTTP GET request with, heap-based buffer overflow, http get request, heap based buffer overflow
CVE-2002-1311: Courier sqwebmail before 0.40.0 does not quickly drop privileges after startup in certain cases, which could allow local users to read arbitrary files.
Key phrases: read arbitrary files
CVE-2002-1312: Buffer overflow in the Web management interface in Linksys BEFW11S4 wireless access point router 2 and BEFSR11, BEFSR41, and BEFSRU31 EtherFast Cable/DSL routers with firmware before 1.43.3 with remote management enabled allows remote attackers to cause a denial of service (router crash) via a long password.
Key phrases: denial of service (router crash), cause a denial of service (router crash, buffer overflow
CVE-2002-1313: nullmailer 1.00RC5 and earlier allows local users to cause a denial of service via an email to a local user that does not exist, which generates an error that causes nullmailer to stop sending mail to all users.
Key phrases: cause a denial of service via an email
CVE-2002-1315: Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows remote attackers to execute web script or HTML as the iPlanet administrator by injecting the desired script into error logs, and possibly escalating privileges by using the XSS vulnerability in conjunction with another issue (CVE-2002-1316).
Key phrases: execute web script or HTML as the iPlanet, cross-site scripting (xss), escalating privileges, escalate privilege
CVE-2002-1316: importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315).
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the, exploit this vulnerability via a separate XSS issue, xss issue
CVE-2002-1317: Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow