yahoo-inc/cve-impacts huggingface dataset:
CVE-2002-1642: PostgreSQL 7.2.1 and 7.2.2 allows local users to delete transaction log (pg_clog) data and cause a denial of service (data loss) via the VACUUM command.
Key phrases: denial of service (data loss), delete transaction log (pg_clog) data and
CVE-2002-1643: Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET requests with long arguments.
Key phrases: execute arbitrary code, execute arbitrary code via (1) a, buffer overflows, simultaneous http get requests
CVE-2002-1644: SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the parent process, which allows attackers to gain certain privileges.
Key phrases: gain certain privileges
CVE-2002-1645: Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.
Key phrases: execute arbitrary code, execute arbitrary code via a long URL, buffer overflow
CVE-2002-1646: SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.
Key phrases: override the AllowedAuthentications configuration and use less secure
CVE-2002-1647: The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL.
CVE-2002-1648: Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified send_to and subject parameters.
Key phrases: send email as other users via an IMG, cross-site request forgery (csrf), cross site request forgery
CVE-2002-1649: Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript via a javascript: URL, cross-site scripting (xss), arbitrary javascript
CVE-2002-1650: The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via a modified sqspell_command parameter
CVE-2002-1651: Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients, possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions.
Key phrases: insert arbitrary web content, insert arbitrary web content and steal sensitive information, cross-site scripting (xss)
CVE-2002-1652: Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long query parameter.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1653: Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encryption despite intended configuration, and may allow remote attackers to sniff sensitive information.
Key phrases: communicate without encryption despite intended configuration, sniff sensitive information
CVE-2002-1654: iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection.
Key phrases: conduct HTTP Basic Authentication via the wp-, attack vector, brute force password guessing
CVE-2002-1655: The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-html-rend request.
Key phrases: denial of service (crash), cause a denial of service (crash), wp-html-rend request
CVE-2002-1656: X-News (x_news) 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via sniffing or the users.txt data file, and providing it in a cookie.
Key phrases: authenticate as other users by obtaining the MD5, sniffing
CVE-2002-1657: PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.
Key phrases: brute force
CVE-2002-1658: Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Key phrases: execute arbitrary code, execute arbitrary code via a long user argument, buffer overflow, escalation of privileges, escalation privilege
CVE-2002-1659: user_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user_id variable.
Key phrases: gain privileges, gain privileges by modifying the user_id variable
CVE-2002-1660: calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2002-1661: The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a denial of service (infinite loop) when leafnode requests a cross-posted article to one group whose name is a prefix of another group.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2002-1662: Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11 allow remote attackers to execute arbitrary script on other clients via (1) search.php and (2) the "Your name" field during account registration.
Key phrases: execute arbitrary script, execute arbitrary script on other clients via (, cross-site scripting (xss)
CVE-2002-1663: The Post_Method function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service (crash) via a POST request with an invalid or missing Content-Length header value.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1664: Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensitive information.
Key phrases: add arbitrary users, obtain sensitive information, add arbitrary users to another user's buddy
CVE-2002-1665: Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long set_buddygrp field.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1666: Unknown vulnerability in Oracle E-Business Suite 11i.1 through 11i.6 allows remote attackers to execute unauthorized PL/SQL procedures by modifying the Oracle Applications URL.
Key phrases: execute unauthorized PL/SQL procedures by modifying, unknown
CVE-2002-1667: The virtual memory management system in FreeBSD 4.5-RELEASE and earlier does not properly check the existence of a VM object during page invalidation, which allows local users to cause a denial of service (crash) by calling msync on an unaccessed memory map created with MAP_ANON and MAP_NOSYNC flags.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1668: HP-UX 11.11 and earlier allows local users to cause a denial of service (kernel deadlock), due to a "file system weakness" that is possibly via an mmap() system call and performing an I/O operation using data from the mapped buffer on the file descriptor for the mapped file.
Key phrases: denial of service (kernel deadlock), cause a denial of service (kernel deadlock, file system weakness
CVE-2002-1669: pkg_add in FreeBSD 4.2 through 4.4 creates a temporary directory with world-searchable permissions, which may allow local users to modify world-writable parts of the package during installation.
Key phrases: modify world-writable parts of the package, world-searchable permissions
CVE-2002-1670: Microsoft Windows XP Professional upgrade edition overwrites previously installed patches for Internet Explorer 6.0, leaving Internet Explorer unpatched.
Key phrases: unpatched
CVE-2002-1671: Microsoft Internet Explorer 5.0, 5.01, and 5.5 allows remote attackers to monitor the contents of the clipboard via the getData method of the clipboardData object.
Key phrases: monitor the contents of the clipboard via the
CVE-2002-1672: Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials.
Key phrases: read the root user's cookie-based, insecure permissions, hijack
CVE-2002-1673: The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execute script and possibly steal cookies by inserting the script into certain files or fields, such as a real user name entry in the passwd file.
Key phrases: execute script and possibly steal cookies by inserting
CVE-2002-1674: procfs on FreeBSD before 4.5 allows local users to cause a denial of service (kernel panic) by removing a file that the fstatfs function refers to.
Key phrases: denial of service (kernel panic), cause a denial of service (kernel panic, procfs
CVE-2002-1675: Format string vulnerability in the Cio_PrintF function of cio_main.c in Unreal IRCd 3.1.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), format string
CVE-2002-1676: BindView NetInventory 1.0, when used with NetRC 1.0, allows local users to read sensitive information (passwords) by deleting the HOSTCFG._NI file and forcing an audit, which rewrites the HOSTCFG._NI to HOSTCFG.INI and stores the passwords in cleartext until the audit is complete.
Key phrases: read sensitive information (passwords) by deleting, cleartext
CVE-2002-1677: 14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, which generates an error message that reveals the path.
Key phrases: determine the physical path to the web root, invalid cfg parameter, reveals the path
CVE-2002-1678: Cross-site scripting (XSS) vulnerability in memberlist.php in Jelsoft vBulletin 2.0 rc 2 through 2.2.4 allows remote attackers to steal authentication credentials by injecting script into $letterbits.
Key phrases: steal authentication credentials by injecting script into $, cross-site scripting (xss)
CVE-2002-1679: Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 2.2.0 allows remote attackers to execute arbitrary script as other users by injecting script into a bulletin board message.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting (xss)
CVE-2002-1680: Cross-site scripting (XSS) vulnerability in CGI Online Worldweb Shopping 1.1 (a.k.a. COWS) allows remote attackers to execute arbitrary script as other users by injecting script into (1) diagnose.cgi or (2) compatible.cgi.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting (xss)
CVE-2002-1681: Cross-site scripting (XSS) vulnerability in Slashcode CVS releases June 17 through July 1 2002 allows remote attackers to execute arbitrary script as other users by injecting script into the paragraph <P> tag.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting (xss)
CVE-2002-1682: NewsReactor 1.0 uses a weak encryption scheme, which could allow local users to decrypt the passwords and gain access to other users' newsgroup accounts.
Key phrases: gain access, decrypt the passwords and gain access to other, weak encryption scheme, decrypt password
CVE-2002-1683: Cross-site scripting (XSS) vulnerability in BadBlue Personal Edition 1.7.3 allows remote attackers to execute arbitrary script as other users by injecting script into the cleanSearchString() function.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting (xss)
CVE-2002-1684: Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in the script used to read Microsoft Office documents.
Key phrases: read arbitrary files, read arbitrary files via a ../ (, directory traversal
CVE-2002-1685: Cross-site scripting vulnerability (XSS) in BadBlue Enterprise Edition and Personal Edition 1.7 and 1.7.2 allows remote attackers to execute arbitrary script as other users by injecting script into ext.dll ISAPI.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting vulnerability (xss)
CVE-2002-1686: Buffer overflow in lscfg of unknown versions of AIX has unknown impact.
Key phrases: buffer overflow, unknown impact
CVE-2002-1687: Buffer overflow in the diagnostics library in AIX allows local users to "cause data and instructions to be overwritten" via a long DIAGNOSTICS environment variable.
Key phrases: "cause data and instructions to be overwritten, buffer overflow
CVE-2002-1688: The browser history feature in Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to execute arbitrary script as other users and steal authentication information via cookies by injecting JavaScript into the URL, which is executed when the user hits the Back button.
Key phrases: execute arbitrary script, execute arbitrary script as other users and steal
CVE-2002-1689: Unknown vulnerability in the login program on AIX before 4.0 could allow remote users to specify 100 or more environment variables when logging on, which exceeds the length of a certain string, possibly triggering a buffer overflow.
Key phrases: specify 100 or more environment variables when logging, unknown, buffer overflow
CVE-2002-1690: Unknown vulnerability in AIX before 4.0 with unknown attack vectors and unknown impact, aka "security issue," as fixed by APAR IY28225.
Key phrases: unknown, unknown impact
CVE-2002-1691: Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attackers to gain unauthorized access.
Key phrases: gain unauthorized access
CVE-2002-1692: Buffer overflow in backup utility of Microsoft Windows 95 allows attackers to execute arbitrary code by causing a filename with a long extension to be placed in a folder to be backed up.
Key phrases: execute arbitrary code, execute arbitrary code by causing a filename with, buffer overflow
CVE-2002-1694: Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running.
Key phrases: modify the log file contents while IIS is, file_share_read, file_share_write
CVE-2002-1695: Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while Norton Internet Security is running.
Key phrases: modify the log file contents while Norton Internet, file_share_read, file_share_write
CVE-2002-1696: Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Always use Secure Viewer when decrypting" option is not checked, and the user replies to an encrypted message.
CVE-2002-1697: Electronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, which could allow remote attackers to gain sensitive information.
Key phrases: gain sensitive information, weak encryption algorithm
CVE-2002-1698: Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument in the message header.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1699: SQL injection vulnerability in ASP Client Check (ASPCC) 1.3 and 1.5 allows remote attackers to bypass authentication and gain unauthorized access via the password field.
Key phrases: bypass authentication, gain unauthorized access, bypass authentication and gain unauthorized access via the, sql injection
CVE-2002-1700: Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting vulnerability (xss)
CVE-2002-1702: Cross-site scripting vulnerability (XSS) in DeltaScripts PHP Classifieds 6.0.5 allows remote attackers to execute arbitrary script as other users via the URL parameter.
Key phrases: execute arbitrary script, execute arbitrary script as other users via the, cross-site scripting vulnerability (xss)
CVE-2002-1703: Cross-site scripting vulnerability (XSS) in auction.cgi for Mewsoft NetAuction 3.0 allows remote attackers to execute arbitrary script as other users via the Term parameter.
Key phrases: execute arbitrary script, execute arbitrary script as other users via the, cross-site scripting vulnerability (xss)
CVE-2002-1704: Zeroboard 4.1, when the "allow_url_fopen" and "register_globals" variables are enabled, allows remote attackers to execute arbitrary PHP code by modifying the _zb_path parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the _, allow_url_fopen, register_globals
CVE-2002-1705: Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to cause a denial of service (crash) via a Cascading Style Sheet (CSS) with the p{cssText} element declared and a bold font weight.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1706: Cisco IOS software 11.3 through 12.2 running on Cisco uBR7200 and uBR7100 series Universal Broadband Routers allows remote attackers to modify Data Over Cable Service Interface Specification (DOCSIS) settings via a DOCSIS file without a Message Integrity Check (MIC) signature, which is approved by the router.
Key phrases: modify Data Over Cable Service Interface Specification (
CVE-2002-1707: install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_dir parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the phpbb_root_dir, allow_url_fopen
CVE-2002-1708: Cross-site scripting vulnerability (XSS) in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the (1) subject or (2) message fields.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting vulnerability (xss)
CVE-2002-1709: SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable.
Key phrases: obtain sensitive information, obtain sensitive information or possibly modify data via, sql injection
CVE-2002-1710: The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file.
Key phrases: steal sensitive information like a password file
CVE-2002-1711: BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments.
Key phrases: read other users' attachments, world readable tmp basilix directory
CVE-2002-1712: Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the ACK and FIN bits set to the NetBIOS port (TCP/139), as demonstrated by stream3.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption
CVE-2002-1713: The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read other user's files.
Key phrases: read other user's files, world-readable permissions
CVE-2002-1714: Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type "text/html" with the DATA field that identifies the HTML document that contains the object, which may cause infinite recursion.
Key phrases: denial of service (crash), cause a denial of service (crash), infinite recursion
CVE-2002-1715: SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access.
Key phrases: bypass restricted shells such as rbash or rksh, gain normal shell, world-writeable directory
CVE-2002-1716: The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability.
Key phrases: create arbitrary files, create arbitrary files using the SaveAs capability, saveas capability
CVE-2002-1717: Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.
Key phrases: view path information via a GET request to
CVE-2002-1718: Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
Key phrases: view the contents of a Frontpage Server Extension
CVE-2002-1719: Unknown vulnerability in Bavo 0.3 allows remote attackers to modify posted messages.
Key phrases: modify posted messages, unknown
CVE-2002-1720: SQL injection vulnerability in Spooky Login 2.0 through 2.5 allows remote attackers to bypass authentication and gain privileges via the password field.
Key phrases: bypass authentication, gain privileges, bypass authentication and gain privileges via the password, sql injection
CVE-2002-1721: Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the FFGET_FILE variable with a (null) byte.
Key phrases: denial of service (crash), cause a denial of service (crash), off-by-one error
CVE-2002-1722: Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have been assigned to a button.
Key phrases: bypass the screen, the system to bypass the screen locking function, physical access
CVE-2002-1723: Powerboards 2.2b allows remote attackers to view the full path to the backend database by sending a cookie containing a non-existent username to profiles.php, which displays the full path in the error message.
Key phrases: view the full path to the backend database
CVE-2002-1724: Cross-site scripting vulnerability (XSS) in phpimageview.php for PHPImageView 1.0 allows remote attackers to execute arbitrary script as other users via the pic parameter.
Key phrases: execute arbitrary script, execute arbitrary script as other users via the, cross-site scripting vulnerability (xss)
CVE-2002-1725: phpimageview.php in PHPImageView 1.0 allows remote attackers to obtain sensitive information via the pw=show option, which invokes the phpinfo function.
Key phrases: obtain sensitive information, obtain sensitive information via the pw=show
CVE-2002-1726: secure_inc.php in PhotoDB 1.4 allows remote attackers to bypass authentication via a URL with a large Time parameter, non-empty rmtusername and rmtpassword parameter, and an accesslevel parameter that is lower than the access level of the requested page.
Key phrases: bypass authentication, bypass authentication via a URL with a large
CVE-2002-1727: Cross-site scripting vulnerability (XSS) in (1) as_web.exe and (2) as_web4.exe in askSam Web Publisher 1 and 4 allows remote attackers to execute arbitrary script as other users via a URL.
Key phrases: execute arbitrary script, execute arbitrary script as other users via a, cross-site scripting vulnerability (xss)
CVE-2002-1728: askSam Web Publisher 1.0 and 4.0 allows remote attackers to determine the full path to the web root directory via a request for a file that does not exist, which generates an error message that reveals the full path.
Key phrases: determine the full path to the web root
CVE-2002-1729: Cross-site scripting vulnerability (XSS) in ASPjar Guestbook 1.00 allows remote attackers to execute arbitrary script as other users via the "web site" parameter in a guestbook message.
Key phrases: execute arbitrary script, execute arbitrary script as other users via the, cross-site scripting vulnerability (xss)
CVE-2002-1730: ASPjar Guestbook 1.00 allows remote attackers to delete arbitrary messages accessing the delete.asp administrative script with certain cookie values set to "true".
Key phrases: delete arbitrary messages, delete arbitrary messages accessing the delete.asp administrative script, cookie values
CVE-2002-1731: The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF.
Key phrases: list valid user accounts by viewing the object
CVE-2002-1732: Multiple cross-site scripting (XSS) vulnerabilities in Actinic Catalog 4.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string argument to certain .pl files, (2) the REFPAGE parameter to ca000007.pl, (3) PRODREF parameter to ss000007.pl, or (4) hop parameter to ca000001.pl.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2002-1733: Cross-site scripting (XSS) vulnerability in the web-based message board in Prospero Technologies allows remote attackers to inject arbitrary web script or HTML via a message board post.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2002-1734: NewsPro 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to "logged,true".
Key phrases: gain unauthorized administrator access, gain unauthorized administrator access by setting their authentication, authentication cookie
CVE-2002-1735: Buffer overflow in dlogin 1.0a could allow local users to gain privileges via unknown attack vectors.
Key phrases: gain privileges, gain privileges via unknown attack vectors, buffer overflow
CVE-2002-1736: Unknown vulnerability in CGINews before 1.06 allow remote attackers to read arbitrary files via "unfiltered user input."
Key phrases: read arbitrary files, read arbitrary files via "unfiltered user input, unknown
CVE-2002-1737: Astaro Security Linux 2.016 creates world-writable files and directories, which allows local users to overwrite arbitrary files.
Key phrases: overwrite arbitrary files, world-writable files
CVE-2002-1738: Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send anonymous email.
Key phrases: send anonymous email
CVE-2002-1739: Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords.
Key phrases: crack passwords, weak encryption algorithm
CVE-2002-1740: Buffer overflow in WorldClient.cgi in WorldClient in Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to execute arbitrary code via a long folder name (NewFolder parameter).
Key phrases: execute arbitrary code, execute arbitrary code via a long folder name, buffer overflow
CVE-2002-1741: Directory traversal vulnerability in WorldClient.cgi in WorldClient for Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to delete arbitrary files via a ".." (dot dot) in the Attachments parameter.
Key phrases: delete arbitrary files, delete arbitrary files via a "..", directory traversal
CVE-2002-1742: SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.
Key phrases: load arbitrary Perl functions, load arbitrary Perl functions by suppling a non, non-existent function, autoload subroutine
CVE-2002-1743: AOL ICQ 2002a Build 3722 allows remote attackers to cause a denial of service (crash) via a malformed .hpf file.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed .hpf file
CVE-2002-1744: Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).
Key phrases: view source code and determine the existence of, directory traversal, arbitrary files
CVE-2002-1745: Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
Key phrases: view the source code for files with extensions, off-by-one error
CVE-2002-1746: Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets.
Key phrases: inject data into user sessions by sniffing and, vtun
CVE-2002-1747: Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB.
Key phrases: inject data into user sessions without detection, forwarded packets, cut-and-paste
CVE-2002-1748: Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts.
Key phrases: gain access, gain access to arbitrary accounts, unknown
CVE-2002-1749: Windows 2000 Terminal Services, when using the disconnect feature of the client, does not properly lock itself if it is left idle until the screen saver activates and the user disconnects, which could allow attackers to gain administrator privileges.
Key phrases: gain administrator privileges
CVE-2002-1750: csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
Key phrases: execute arbitrary Perl code, execute arbitrary Perl code via the setup parameter
CVE-2002-1751: csLiveSupport.cgi in CGIScript.net csLiveSupport allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
Key phrases: execute arbitrary Perl code, execute arbitrary Perl code via the setup parameter
CVE-2002-1752: csChatRBox.cgi in CGIScript.net csChat-R-Box allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
Key phrases: execute arbitrary Perl code, execute arbitrary Perl code via the setup parameter
CVE-2002-1753: csNewsPro.cgi in CGIScript.net csNews Professional (csNewsPro) allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
Key phrases: execute arbitrary Perl code, execute arbitrary Perl code via the setup parameter
CVE-2002-1754: Buffer overflow in Novell NetWare Client 4.80 through 4.83 allows local users to cause a denial of service (crash) by using ping, traceroute, or a similar utility to force the client to resolve a large hostname.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1755: tinc 1.0pre3 and 1.0pre4 VPN does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on CBC.
Key phrases: inject data into user sessions without detection, cut-and-paste
CVE-2002-1756: ACDSee 4.0 allows remote attackers to cause a denial of service (crash) via an .ais file with a long file description field, which is not properly handled when the file properties of the file are viewed.
Key phrases: denial of service (crash), cause a denial of service (crash), long file description field
CVE-2002-1757: PHProjekt 2.0 through 3.1 relies on the $PHP_SELF variable for authentication, which allows remote attackers to bypass authentication for scripts via a request to a .php file with "sms" in the URL, which is included in the PATH_INFO portion of the $PHP_SELF variable, as demonstrated using "mail_send.php/sms".
Key phrases: bypass authentication, bypass authentication for scripts via a request to
CVE-2002-1758: PHProjekt 2.0 through 3.1 allows remote attackers to view or modify data via requests to certain scripts that do not verify if the user is logged in.
Key phrases: view or modify data via requests to certain
CVE-2002-1759: The upload function in PHProjekt 2.0 through 3.1 does not properly verify certain variables related to uploaded data, which allows remote attackers to cause PHProjekt to process arbitrary files.
Key phrases: process arbitrary files, cause PHProjekt to process arbitrary files
CVE-2002-1760: Multiple SQL injection vulnerabilities in PHProjekt 2.0 through 3.1 allow remote attackers to execute arbitrary SQL commands via the unknown attack vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the unknown attack, sql injection, arbitrary sql commands, unknown attack vectors
CVE-2002-1761: Directory traversal vulnerability in PHProjekt 2.0 through 3.1 allows remote attackers to read arbitrary files via .. (dot dot) sequences.
Key phrases: read arbitrary files, read arbitrary files via .. (dot dot, directory traversal
CVE-2002-1762: Microsoft Baseline Security Analyzer (MBSA) 1.0 stores security scans in a known location C:\\\\Documents and Settings\\\\username\\\\SecurityScans in plaintext, which could allow remote attackers to obtain sensitive information about the system via malicious active content such as ActiveX controls or Java.
Key phrases: obtain sensitive information, obtain sensitive information about the system via malicious, plaintext, malicious active content
CVE-2002-1763: The dtscreen Sun Solaris 8 CDE screensaver crashes when the "Shift" and "Return" keys are pressed repeatedly and quickly, which allows local users to access the current session.
Key phrases: access the current session, crash
CVE-2002-1764: acroread in Adobe Acrobat Reader 4.05 on Linux allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2002-1765: Evolution 1.0.3 and 1.0.4 allows remote attackers to cause a denial of service (memory consumption and crash) via an email with a malformed MIME header.
Key phrases: denial of service (memory consumption and crash), cause a denial of service (memory consumption, malformed mime header
CVE-2002-1766: Buffer overflow in Composer in Netscape 4.77 allows local users to overwrite process memory and execute arbitrary code via a font tag with a long face attribute.
Key phrases: execute arbitrary code, overwrite process memory and execute arbitrary code via, buffer overflow
CVE-2002-1767: Buffer overflow in tnslsnr of Oracle 8i Database Server 8.1.5 for Linux allows local users to execute arbitrary code as the oracle user via a long command line argument.
Key phrases: execute arbitrary code, execute arbitrary code as the oracle user via, buffer overflow
CVE-2002-1768: Cisco IOS 11.1 through 12.2, when HSRP support is not enabled, allows remote attackers to cause a denial of service (CPU consumption) via randomly sized UDP packets to the Hot Standby Routing Protocol (HSRP) port 1985.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2002-1769: Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the "Log on locally" privilege.
Key phrases: remote attackers the "Log on locally", default password
CVE-2002-1770: Qualcomm Eudora 5.1 allows remote attackers to execute arbitrary code via an HTML e-mail message that uses a file:// URL in a t:video tag to reference an attached Windows Media Player file containing JavaScript code, which is launched and executed in the My Computer zone by Internet Explorer.
Key phrases: execute arbitrary code, execute arbitrary code via an HTML e-
CVE-2002-1771: Matt Wright FormMail 1.9 and earlier allows remote attackers to send spam or anonymous e-mail by injecting a newline character followed by CC:, BCC:, or additional TO: fields in the email and realname CGI variables.
Key phrases: send spam or anonymous e-mail by, newline character
CVE-2002-1772: Novell Netware 5.0 through 5.1 may allow local users to gain "Domain Admin" rights by logging into a Novell Directory Services (NDS) account, and executing "net use" on an NDS_ADM account that is not in the NT domain but has domain access rights, which allows the user to enter a null password.
Key phrases: gain "Domain Admin" rights, gain "Domain Admin" rights by logging, enter a null password
CVE-2002-1773: Buffer overflow in ICQ 2.6x for MacOS X 10.0 through 10.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long request.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2002-1774: NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus 2002 allows remote attackers to send viruses that bypass the e-mail scanning via a NULL character in the MIME header before the virus.  NOTE: the vendor has disputed this issue, acknowledging that the initial scan is bypassed, but the AutoProtect feature would detect the virus before it is executed
Key phrases: bypass the e-mail scanning via a NULL character, send viruses that bypass the e-mail
CVE-2002-1775: NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus (NAV) 2002 allows remote attackers to bypass the initial virus scan and cause NAV to prematurely stop scanning by using a non-RFC compliant MIME header.  NOTE: the vendor has disputed this issue, acknowledging that the initial scan is bypassed, but the AutoProtect feature would detect the virus before it is executed
Key phrases: bypass the initial virus scan and cause NAV, non-rfc compliant mime header
CVE-2002-1776: NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus 2002 allows remote attackers to bypass virus protection via a Word Macro virus with a .nch or .dbx extension, which is automatically recognized and executed as a Microsoft Office document.  NOTE: the vendor has disputed this issue, acknowledging that the initial scan is bypassed, but the Office plug-in would detect the virus before it is executed
Key phrases: bypass virus protection, bypass virus protection via a Word Macro virus
CVE-2002-1777: NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus (NAV) 2002 allows remote attackers to bypass e-mail scanning via a filename in the Content-Type field with an excluded extension such as .nch or .dbx, but a malicious extension in the Content-Disposition field, which is used by Outlook to obtain the file name.  NOTE: the vendor has disputed this issue, acknowledging that the initial scan is bypassed, but Norton AntiVirus or the Office plug-in would detect the virus before it is executed
Key phrases: bypass e-mail scanning via a filename, obtain the file name.  NOTE:
CVE-2002-1778: Symantec Norton Personal Firewall 2002 allows remote attackers to bypass the portscan protection by using a (1) SYN/FIN, (2) SYN/FIN/URG, (3) SYN/FIN/PUSH, or (4) SYN/FIN/URG/PUSH scan.
Key phrases: bypass the portscan protection, bypass the portscan protection by using a (, syn fin
CVE-2002-1779: The "block fragmented IP Packets" option in Symantec Norton Personal Firewall 2002 (NPW) does not properly protect against certain attacks on Windows vulnerabilities such as jolt2 (CVE-2000-0305).
Key phrases: windows
CVE-2002-1780: BPM Studio Pro 4.2 by ALCATech GmbH includes a webserver that allows a remote attacker to cause a denial of service (crash) by sending a URL request for a MS-DOS device such as con.  NOTE: it has been disputed that this and possibly other application-level DOS device issues stem from a bug in Windows, and as such, such applications should not be considered vulnerable themselves.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1781: Multiple buffer overflows in DeleGate 7.7.0 through 7.8.1 allow remote attackers to execute arbitrary code, as demonstrated using a long USER command to the POP proxy.
Key phrases: execute arbitrary code, buffer overflows
CVE-2002-1782: The default configuration of University of Washington IMAP daemon (wu-imapd), when running on a system that does not allow shell access, allows a local user with a valid IMAP account to read arbitrary files as that user.
Key phrases: read arbitrary files, read arbitrary files as that user, shell access
CVE-2002-1783: CRLF injection vulnerability in PHP 4.2.1 through 4.2.3, when allow_url_fopen is enabled, allows remote attackers to modify HTTP headers for outgoing requests by causing CRLF sequences to be injected into arguments that are passed to the (1) fopen or (2) file functions.
Key phrases: modify HTTP headers for outgoing requests by causing, crlf injection
CVE-2002-1784: Unknown vulnerability in inetd in HP Tru64 Unix 4.0f through 5.1a allows remote attackers to cause a denial of service via unknown attack vectors.
Key phrases: cause a denial of service via unknown attack, unknown attack vectors
CVE-2002-1785: Cross-site scripting (XSS) vulnerability in Zeus Administration Server in Zeus Web Server 4.0 through 4.1r2 allows remote authenticated users to inject arbitrary web script or HTML via the section parameter to index.fcgi.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1786: SGI IRIX 6.5 through 6.5.14 applies a umask of 022 to root core dumps, which allows local users to read the core dumps and possibly obtain sensitive information.
Key phrases: obtain sensitive information, read the core dumps and possibly obtain sensitive, root core dumps
CVE-2002-1787: Buffer overflow in uux in eoe.sw.uucp package of SGI IRIX 6.5 through 6.5.17 allows local users to execute arbitrary code via unknown attack vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown attack vectors, buffer overflow
CVE-2002-1788: Format string vulnerability in the nn_exitmsg function in nn 6.6.0 through 6.6.3 allows remote NNTP servers to execute arbitrary code via format strings in server responses.
Key phrases: execute arbitrary code, execute arbitrary code via format strings in server
CVE-2002-1789: Format string vulnerability in newsx NNTP client before 1.4.8 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a call to the syslog function.
Key phrases: execute arbitrary code, execute arbitrary code via format string specifiers that
CVE-2002-1790: The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed messages via encapsulated SMTP addresses, a similar vulnerability to CVE-1999-0682.
Key phrases: bypass anti-relaying rules, bypass anti-relaying rules and send spam, spoofing
CVE-2002-1791: SGI IRIX 6.5 through 6.5.17 creates temporary desktop files with world-writable permissions, which allows local users to overwrite or corrupt those files.
Key phrases: overwrite or corrupt those files, world-writable permissions
CVE-2002-1792: Buffer overflow in Fake Identd 0.9 through 1.4 allows remote attackers to execute arbitrary code as root via a long request that is split into multiple packets.
Key phrases: execute arbitrary code, execute arbitrary code as root via a long, buffer overflow
CVE-2002-1793: HTTP Server mod_ssl module running on HP-UX 11.04 with Virtualvault OS (VVOS) 4.5 through 4.6 closes the connection when the Apache server times out during an SSL request, which may allow attackers to cause a denial of service.
Key phrases: cause a denial of service
CVE-2002-1794: Unknown vulnerability in pam_authz in the LDAP-UX Integration product on HP-UX 11.00 and 11.11 allows remote attackers to execute r-commands with privileges of other users.
Key phrases: execute r-commands with privileges of other, unknown
CVE-2002-1795: Cross-site scripting (XSS) vulnerability in connect.asp in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss), unknown vectors
CVE-2002-1796: ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, which allows local users to load unauthorized Chai services.
Key phrases: load unauthorized Chai services
CVE-2002-1797: ChaiVM for HP color LaserJet 4500 and 4550 or HP LaserJet 4100 and 8150 does not properly enforce access control restrictions, which could allow local users to add, delete, or modify any services hosted by the ChaiServer.
Key phrases: add, access control restrictions
CVE-2002-1798: MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.
Key phrases: upload arbitrary php files, (1) upload arbitrary php files via, access sensitive information
CVE-2002-1799: Cross-site scripting (XSS) vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML via the (1) email parameter to add.php or (2) banurl parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)