yahoo-inc/cve-impacts huggingface dataset:
CVE-2002-1318: Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2002-1319: The Linux kernel 2.4.20 and earlier, and 2.5.x, when running on x86 systems, allows local users to cause a denial of service (hang) via the emulation mode, which does not properly clear TF and NT EFLAGs.
Key phrases: denial of service (hang), cause a denial of service (hang)
CVE-2002-1320: Pine 4.44 and earlier allows remote attackers to cause a denial of service (core dump and failed restart) via an email message with a From header that contains a large number of quotation marks (").
Key phrases: denial of service (core dump and failed restart), cause a denial of service (core dump
CVE-2002-1321: Multiple buffer overflows in RealOne and RealPlayer allow remote attackers to execute arbitrary code via (1) a Synchronized Multimedia Integration Language (SMIL) file with a long parameter, (2) a long long filename in a rtsp:// request, e.g. from a .m3u file, or (3) certain "Now Playing" options on a downloaded file with a long filename.
Key phrases: execute arbitrary code, execute arbitrary code via (1) a, buffer overflows
CVE-2002-1322: Rational ClearCase 4.1, 2002.05, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain packets to port 371, e.g. via nmap.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1323: Safe.pm 2.0.7 and earlier, when used in Perl 5.8.0 and earlier, may allow attackers to break out of safe compartments in (1) Safe::reval or (2) Safe::rdo using a redefined @_ variable, which is not reset between successive calls.
Key phrases: break out of safe compartments in (1, redefined @_ variable
CVE-2002-1325: Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir Exposure Vulnerability."
Key phrases: determine a local user's username via a, user.dir exposure
CVE-2002-1327: Buffer overflow in the Windows Shell function in Microsoft Windows XP allows remote attackers to execute arbitrary code via an .MP3 or .WMA audio file with a corrupt custom attribute, aka "Unchecked Buffer in Windows Shell Could Enable System Compromise."
Key phrases: execute arbitrary code, execute arbitrary code via an .MP3 or .WMA, buffer overflow, unchecked buffer, system compromise
CVE-2002-1334: Cross-site scripting (XSS) vulnerability in BizDesign ImageFolio 3.01 and earlier allows remote attackers to execute arbitrary web script as other users via (1) the direct parameter in imageFolio.cgi, or (2) nph-build.cgi.
Key phrases: execute arbitrary web script, execute arbitrary web script as other users via, cross-site scripting (xss)
CVE-2002-1335: Cross-site scripting (XSS) vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies.
Key phrases: insert arbitrary web script or HTML, insert arbitrary web script or HTML and access, cross-site scripting (xss)
CVE-2002-1336: TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
Key phrases: bypass VNC authentication, bypass VNC authentication by sniffing the challenge and
CVE-2002-1337: Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
Key phrases: execute arbitrary code, execute arbitrary code via certain formatted address fields, buffer overflow
CVE-2002-1338: The Load method in the Chart component of Office Web Components (OWC) 9 and 10 generates an exception when a specified file does not exist, which allows remote attackers to determine the existence of local files.
Key phrases: determine the existence of local files, exception
CVE-2002-1339: The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10 follows redirections, which allows remote attackers to determine the existence of local files based on exceptions, or to read WorkSheet XML files.
Key phrases: determine the existence of local files based on
CVE-2002-1340: The "ConnectionFile" property in the DataSourceControl component in Office Web Components (OWC) 10 allows remote attackers to determine the existence of local files by detecting an exception.
Key phrases: determine the existence of local files by detecting, exception
CVE-2002-1341: Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the (1) mailbox and (2) passed_id parameters.
Key phrases: insert script and HTML via the (1, cross-site scripting (xss)
CVE-2002-1342: Unknown vulnerability in smb2www 980804-16 and earlier allows remote attackers to execute arbitrary commands.
Key phrases: execute arbitrary commands, unknown
CVE-2002-1344: Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences.
Key phrases: create or overwrite files as the wget user, directory traversal
CVE-2002-1345: Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.
Key phrases: create or overwrite files as the client user, directory traversal
CVE-2002-1347: Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflows, off-by-one error
CVE-2002-1348: w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies.
Key phrases: access files or cookies
CVE-2002-1349: Buffer overflow in pop3trap.exe for PC-cillin 2000, 2002, and 2003 allows local users to execute arbitrary code via a long input string to TCP port 110 (POP3).
Key phrases: execute arbitrary code, execute arbitrary code via a long input string, buffer overflow
CVE-2002-1350: The BGP decoding routines in tcpdump 3.6.x before 3.7 do not properly copy data, which allows remote attackers to cause a denial of service (application crash).
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2002-1351: Buffer overflow in Melange Chat System 1.10 allows remote attackers to cause a denial of service (chat server crash) and possibly execute arbitrary code via the msgText buffer in the chat_InterpretData function, as demonstrated via a long Nick (nickname) request.
Key phrases: execute arbitrary code, denial of service (chat server crash), cause a denial of service (chat server, buffer overflow
CVE-2002-1352: Per Magne Knutsen's CartMan shopping cart (cartman.php) 1.04 and earlier allows remote attackers to modify product prices by changing the price parameter.
Key phrases: modify product prices by changing the price parameter
CVE-2002-1353: LocalWEB2000 HTTP server 2.1.0 stores passwords in plain text under the web document root in users.lst, which allows remote attackers to obtain the passwords via a direct request to users.lst.
Key phrases: obtain the passwords, obtain the passwords via a direct request to, plain text
CVE-2002-1354: Directory traversal vulnerability in TYPSoft FTP Server 0.99.8 allows local users to list the contents of arbitrary directories via a ... (dot dot dot) in the cd/CWD command.
Key phrases: list the contents of arbitrary directories via a, directory traversal
CVE-2002-1355: Multiple integer signedness errors in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (infinite loop) via malformed messages.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop, multiple integer signedness errors
CVE-2002-1356: Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the (1) LMP, (2) PPP, or (3) TDS dissectors, possibly related to a missing field for EndVerifyAck messages.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), malformed packets, missing field for endverifyack messages
CVE-2002-1357: Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
Key phrases: execute arbitrary code, cause a denial of service or possibly execute
CVE-2002-1358: Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
Key phrases: execute arbitrary code, cause a denial of service or possibly execute
CVE-2002-1359: Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite.
Key phrases: execute arbitrary code, cause a denial of service or possibly execute, buffer overflow
CVE-2002-1360: Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.
Key phrases: execute arbitrary code, cause a denial of service or possibly execute
CVE-2002-1361: overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP (Security Hardening Patch) installed allows remote attackers to execute arbitrary code via a POST request with shell metacharacters in the email parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a POST request with, overflow, shell metacharacters
CVE-2002-1362: mICQ 0.4.9 and earlier allows remote attackers to cause a denial of service (crash) via malformed ICQ message types without a 0xFE separator character.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed icq message types
CVE-2002-1363: Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1364: Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses.
Key phrases: execute arbitrary code, execute arbitrary code via long WHOIS responses, buffer overflow
CVE-2002-1365: Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.
Key phrases: execute arbitrary code, execute arbitrary code via a header with a, heap-based buffer overflow, heap based buffer overflow
CVE-2002-1366: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream.
Key phrases: overwrite arbitrary files, create or overwrite arbitrary files via file race, file race conditions
CVE-2002-1367: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need authorization" page, as demonstrated by new-coke.
Key phrases: add printers without authentication via a certain UDP
CVE-2002-1368: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing negative arguments to be fed into memcpy() calls via HTTP requests with (1) a negative Content-Length value or (2) a negative length in a chunked transfer encoding.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), negative arguments
CVE-2002-1369: jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the options string, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
Key phrases: execute arbitrary code, execute arbitrary code via a buffer overflow attack
CVE-2002-1371: filters/image-gif.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which allows remote attackers to execute arbitrary code via modified chunk headers, as demonstrated by nogif.
Key phrases: execute arbitrary code, execute arbitrary code via modified chunk headers, zero-length gif images
CVE-2002-1372: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
Key phrases: denial of service (resource exhaustion), cause a denial of service (resource exhaustion
CVE-2002-1373: Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call.
Key phrases: denial of service (crash or hang), cause a denial of service (crash or, signed integer
CVE-2002-1374: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.
Key phrases: gain privileges, gain privileges via a brute force attack using, one-character password
CVE-2002-1375: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response.
Key phrases: execute arbitrary code, execute arbitrary code via a long response, com_change_user
CVE-2002-1376: libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute
CVE-2002-1377: vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.
Key phrases: execute arbitrary commands, execute arbitrary commands using the libcall feature in
CVE-2002-1378: Multiple buffer overflows in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allow remote attackers to execute arbitrary code via (1) long -t or -r parameters to slurpd, (2) a malicious ldapfilter.conf file that is not properly handled by getfilter functions, (3) a malicious ldaptemplates.conf that causes an overflow in libldap, (4) a certain access control list that causes an overflow in slapd, or (5) a long generated filename for logging rejected replication requests.
Key phrases: execute arbitrary code, execute arbitrary code via (1) long, buffer overflows
CVE-2002-1379: OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges.
Key phrases: execute arbitrary code, execute arbitrary code when libldap reads the .ldaprc
CVE-2002-1380: Linux kernel 2.2.x allows local users to cause a denial of service (crash) by using the mmap() function with a PROT_READ parameter to access non-readable memory pages through the /proc/pid/mem interface.
Key phrases: denial of service (crash), cause a denial of service (crash), non-readable memory pages
CVE-2002-1381: Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitrary code by modifying the pid_file_path value.
Key phrases: execute arbitrary code, execute arbitrary code by modifying the pid_file_path value, format string
CVE-2002-1382: Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format (SWF) files, a different issue than CAN-2002-0846.
Key phrases: execute arbitrary code, execute arbitrary code via certain malformed data headers
CVE-2002-1383: Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via (1) the CUPSd HTTP interface, as demonstrated by vanilla-coke, and (2) the image handling code in CUPS filters, as demonstrated by mksun.
Key phrases: execute arbitrary code, execute arbitrary code via (1) the, multiple integer overflows
CVE-2002-1384: Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf.
Key phrases: execute arbitrary code, execute arbitrary code via a ColorSpace entry with, integer overflow
CVE-2002-1385: openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for  openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
Key phrases: execute arbitrary code, execute arbitrary code via .. (dot dot
CVE-2002-1386: Buffer overflow in traceroute-nanog (aka traceroute-ng) may allow local users to execute arbitrary code via a long hostname argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long hostname argument, buffer overflow
CVE-2002-1387: The spray mode in traceroute-nanog (aka traceroute-ng) may allow local users to overwrite arbitrary memory locations via an array index overflow using the nprobes (number of probes) argument.
Key phrases: overwrite arbitrary memory locations, overwrite arbitrary memory locations via an array index, array index overflow
CVE-2002-1388: Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages.
Key phrases: inject arbitrary HTML, inject arbitrary HTML into web archive pages via, cross-site scripting (xss), arbitrary html
CVE-2002-1389: Buffer overflow in typespeed 0.4.2 and earlier allows local users to gain privileges via long input.
Key phrases: gain privileges, gain privileges via long input, buffer overflow
CVE-2002-1390: The daemon for GeneWeb before 4.09 does not properly handle requested paths, which allows remote attackers to read arbitrary files via a crafted URL.
Key phrases: read arbitrary files, read arbitrary files via a crafted URL
CVE-2002-1391: Buffer overflow in cnd-program for mgetty before 1.1.29 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Caller ID string with a long CallerName argument.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2002-1392: faxspool in mgetty before 1.1.29 uses a world-writable spool directory for outgoing faxes, which allows local users to modify fax transmission privileges.
Key phrases: modify fax transmission privileges, world-writable spool directory
CVE-2002-1393: Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.
Key phrases: execute arbitrary commands, execute arbitrary commands via (1) URLs, multiple
CVE-2002-1394: Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
Key phrases: bypass certain protections, read source code for server files or bypass
CVE-2002-1395: Internet Message (IM) 141-18 and earlier uses predictable file and directory names, which allows local users to (1) obtain unauthorized directory permissions via a temporary directory used by impwagent, and (2) overwrite and create arbitrary files via immknmz.
Key phrases: create arbitrary files, obtain unauthorized directory permissions, (1) obtain unauthorized directory permissions via
CVE-2002-1396: Heap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow attackers to cause a denial of service or execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary, heap-based buffer overflow, heap based buffer overflow
CVE-2002-1397: Vulnerability in the cash_words() function for PostgreSQL 7.2 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a large negative argument, possibly triggering an integer signedness error or buffer overflow.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, integer signedness error, buffer overflow
CVE-2002-1398: Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input."
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2002-1399: Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later versions before 7.2.3, with unknown impact, based on an invalid integer input which is processed as a different data type, as demonstrated using cash_out(2).
Key phrases: unknown, unknown impact
CVE-2002-1400: Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string.
Key phrases: execute arbitrary code, execute arbitrary code by causing repeat(), heap-based buffer overflow, large string, heap based buffer overflow
CVE-2002-1401: Buffer overflows in (1) circle_poly, (2) path_encode and (3) path_add (also incorrectly identified as path_addr) for PostgreSQL 7.2.3 and earlier allow attackers to cause a denial of service and possibly execute arbitrary code, possibly as a result of an integer overflow.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflows, integer overflow
CVE-2002-1402: Buffer overflows in the (1) TZ and (2) SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflows
CVE-2002-1403: dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script.
Key phrases: execute arbitrary code, execute arbitrary code via shell metacharacters that are
CVE-2002-1405: CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.
Key phrases: inject false HTTP headers into an HTTP request, crlf injection
CVE-2002-1406: Unknown vulnerability in passwd for VVOS HP-UX 11.04, with unknown impact, related to "Unexpected behavior."
Key phrases: unknown, unknown impact
CVE-2002-1407: TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.
Key phrases: spoof the certificates of trusted sites via a, man-in-the-middle, spoofing, man in the middle
CVE-2002-1408: Unknown vulnerability or vulnerabilities in HP OpenView EMANATE 14.2 snmpModules allow the SNMP read-write community name to be exposed, related to (1) "'read-only' community access," and/or (2) an easily guessable community name.
Key phrases: be exposed, unknown
CVE-2002-1409: ptrace on HP-UX 11.00 through 11.11 allows local users to cause a denial of service (data page fault panic) via "an incorrect reference to thread register state."
Key phrases: denial of service (data page fault panic), cause a denial of service (data page, incorrect reference to thread register state
CVE-2002-1410: Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of admin.cgi, or (2) reconfigure Guestbook via direct access of config.cgi.
Key phrases: (1) delete entries via direct access, easy guestbook cgi programs
CVE-2002-1411: Directory traversal vulnerability in update.dpgs in Duma Photo Gallery System (DPGS) 0.99.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the id parameter.
Key phrases: read arbitrary files, read arbitrary files via .. (dot dot, directory traversal
CVE-2002-1412: Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script.
Key phrases: execute arbitrary code, execute arbitrary code via a modified GALLERY_BASEDIR variable
CVE-2002-1413: RCONAG6 for Novell Netware SP2, while running RconJ in secure mode, allows remote attackers to bypass authentication using the RconJ "Secure IP" (SSL) option during a connection.
Key phrases: bypass authentication, bypass authentication using the RconJ "Secure IP
CVE-2002-1414: Buffer overflow in qmailadmin allows local users to gain privileges via a long QMAILADMIN_TEMPLATEDIR environment variable.
Key phrases: gain privileges, gain privileges via a long QMAILADMIN_TEMPLATEDIR environment variable, buffer overflow
CVE-2002-1415: Format string vulnerability in SMTP service for WebEasyMail 3.4.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in SMTP requests.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), format string
CVE-2002-1416: The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct brute force attacks.
Key phrases: brute force
CVE-2002-1417: Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to read arbitrary files via a URL containing a "..%5c" sequence (modified dot-dot), which is mapped to the directory separator.
Key phrases: read arbitrary files, read arbitrary files via a URL containing a, directory traversal
CVE-2002-1418: Buffer overflow in the interpreter for Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to cause a denial of service (ABEND) via a long module name.
Key phrases: denial of service (ABEND), cause a denial of service (ABEND), buffer overflow, denial of service (abend)
CVE-2002-1419: The upgrade of IRIX on Origin 3000 to 6.5.13 through 6.5.16 changes the MAC address of the system, which could modify intended access restrictions that are based on a MAC address.
CVE-2002-1420: Integer signedness error in select() on OpenBSD 3.1 and earlier allows local users to overwrite arbitrary kernel memory via a negative value for the size parameter, which satisfies the boundary check as a signed integer, but is later used as an unsigned integer during a data copying operation.
Key phrases: overwrite arbitrary kernel memory, overwrite arbitrary kernel memory via a negative value, integer signedness error
CVE-2002-1421: SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php.
Key phrases: perform unauthorized database operations via (1), sql injection
CVE-2002-1422: admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters.
Key phrases: create or delete files via URL-encoded, url-encoded pathnames
CVE-2002-1423: tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter.
Key phrases: read arbitrary files, read arbitrary files via an absolute pathname in
CVE-2002-1424: Buffer overflow in munpack in mpack 1.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2002-1425: Directory traversal vulnerability in munpack in mpack 1.5 and earlier allows remote attackers to create new files in the parent directory via a ../ (dot-dot) sequence in the filename to be extracted.
Key phrases: create new files in the parent directory via, directory traversal
CVE-2002-1426: HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 characters, possibly triggering a buffer overflow.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1427: The print_html_to_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users.
Key phrases: modify home pages of other users, user credentials
CVE-2002-1428: index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the user_cookie parameter set to 1.
Key phrases: bypass authentication, bypass authentication via a cookie or URL with
CVE-2002-1429: Cross-site scripting vulnerability in board.php of endity.com ShoutBOX allows remote attackers to inject arbitrary HTML into the shoutbox page via the site parameter.
Key phrases: inject arbitrary HTML, inject arbitrary HTML into the shoutbox page via, cross-site scripting, arbitrary html
CVE-2002-1430: Unknown vulnerability in Sympoll 1.2 allows remote attackers to read arbitrary files when register_globals is enabled, possibly by modifying certain PHP variables through URL parameters.
Key phrases: read arbitrary files, read arbitrary files when register_globals is enabled, unknown
CVE-2002-1431: Belkin F5D5230-4 4-Port Cable/DSL Gateway Router 1.20.000 modifies the source IP address of internal packets to that of the router's external interface when forwarding a request from an internal host to an internal web server, which allows remote attackers to hide which host is being used to access the web server.
Key phrases: hide which host is being used to access
CVE-2002-1432: MidiCart stores the midicart.mdb database file under the Web document root, which allows remote attackers to steal sensitive information by directly requesting the database.
Key phrases: steal sensitive information by directly requesting the database, web document root
CVE-2002-1433: Kerio MailServer 5.0 allows remote attackers to cause a denial of service (hang) via SYN packets to the supported network services.
Key phrases: denial of service (hang), cause a denial of service (hang), syn packets
CVE-2002-1434: Multiple cross-site scripting (XSS) vulnerabilities in the Web mail module of Kerio MailServer 5.0 allow remote attackers to execute HTML script as other users via certain URLs.
Key phrases: execute HTML script as other users via certain, cross-site scripting (xss)
CVE-2002-1435: class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allow_url_fopen' setting is enabled via a URL in the config_atkroot parameter that points to the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code when the 'allow_url_fopen
CVE-2002-1436: The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary Perl code via an HTTP POST request.
Key phrases: execute arbitrary Perl code, execute arbitrary Perl code via an HTTP POST
CVE-2002-1437: Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to read arbitrary files via an HTTP request containing "..%5c" (URL-encoded dot-dot backslash) sequences.
Key phrases: read arbitrary files, read arbitrary files via an HTTP request containing, directory traversal
CVE-2002-1438: The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to obtain Perl version information via the -v option.
Key phrases: obtain Perl version information, obtain Perl version information via the -v option
CVE-2002-1439: Unknown vulnerability related to stack corruption in the TGA daemon for HP-UX 11.04 (VVOS) Virtualvault 4.0, 4.5, and 4.6 may allow attackers to obtain access to system files.
Key phrases: obtain access, obtain access to system files, unknown, stack corruption
CVE-2002-1440: The Gateway GS-400 server has a default root password of "0001n" that can not be changed via the administrative interface, which can allow attackers to gain root privileges.
Key phrases: gain root privileges, root password
CVE-2002-1441: Multiple buffer overflows in Tomahawk SteelArrow before 4.5 allow remote attackers to execute arbitrary code via (1) the Steelarrow Service (Steelarrow.exe) using a long UserIdent Cookie header, (2) DLLHOST.EXE (Steelarrow.dll) via a request for a long .aro file, or (3) DLLHOST.EXE via a Chunked Transfer-Encoding request.
Key phrases: execute arbitrary code, execute arbitrary code via (1) the, buffer overflows
CVE-2002-1442: The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a window to tools.google.com or the res: protocol, then using script to modify the window's location to the toolbar's configuration URL, which bypasses the origin verification check.
Key phrases: perform unauthorized toolbar operations including script execution and, origin verification check
CVE-2002-1443: The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler.
Key phrases: monitor a user's input into the toolbar
CVE-2002-1444: The Google toolbar 1.1.60, when running on Internet Explorer 5.5 and 6.0, allows remote attackers to cause a denial of service (crash with an exception in oleaut32.dll) via malicious HTML, possibly related to small width and height parameters or an incorrect call to the Google.Search() function.
Key phrases: denial of service (crash with an exception in oleaut32.dll), cause a denial of service (crash with, malicious html, small width and height parameters, incorrect call
CVE-2002-1445: Cross-site scripting (XSS) vulnerability in CERN Proxy Server allows remote attackers to execute script as other users via a link to a non-existent page whose name contains the script, which is inserted into the resulting error page.
Key phrases: execute script as other users via a link, cross-site scripting (xss)
CVE-2002-1446: The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later returns the CKR_OK status even when it detects an invalid signature, which could allow remote attackers to modify or forge messages.
Key phrases: modify or forge messages, invalid signature
CVE-2002-1447: Buffer overflow in the vpnclient program for UNIX VPN Client before 3.5.2 allows local users to gain administrative privileges via a long profile name in a connect argument.
Key phrases: gain administrative privileges, gain administrative privileges via a long profile name, buffer overflow
CVE-2002-1448: An undocumented SNMP read/write community string ('NoGaH$@!') in Avaya P330, P130, and M770-ATM Cajun products allows remote attackers to gain administrative privileges.
Key phrases: gain administrative privileges, snmp read write community string
CVE-2002-1449: eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by reading password.txt.
Key phrases: overwrite arbitrary files, overwrite arbitrary files by reading password.txt, arbitrary file read
CVE-2002-1450: IBM UniVerse with UV/ODBC allows attackers to cause a denial of service (client crash or server CPU consumption) via a query with an invalid link between tables, possibly via a buffer overflow.
Key phrases: denial of service (client crash or server CPU consumption), cause a denial of service (client crash, server cpu consumption, buffer overflow
CVE-2002-1451: Blazix before 1.2.2 allows remote attackers to read source code of JSP scripts or list restricted web directories via an HTTP request that ends in a (1) "+" or (2) "\\\\" (backslash) character.
Key phrases: read source code of JSP scripts or list
CVE-2002-1452: Buffer overflow in the search capability for MyWebServer 1.0.2 allows remote attackers to execute arbitrary code via a long searchTarget parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a long searchTarget parameter, buffer overflow
CVE-2002-1453: Cross-site scripting (XSS) vulnerability in MyWebServer 1.0.2 allows remote attackers to insert script and HTML via a long request followed by the malicious script, which is echoed back to the user in an error message.
Key phrases: insert script and HTML via a long request, cross-site scripting (xss)
CVE-2002-1454: MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does not exist, which leaks the pathname in an error message.
Key phrases: determine the absolute path of the web document
CVE-2002-1455: Multiple cross-site scripting (XSS) vulnerabilities in OmniHTTPd allow remote attackers to insert script or HTML into web pages via (1) test.php, (2) test.shtml, or (3) redir.exe.
Key phrases: insert script or HTML into web pages via, cross-site scripting (xss)
CVE-2002-1456: Buffer overflow in mIRC 6.0.2 and earlier allows remote attackers to execute arbitrary code via a long $asctime value.
Key phrases: execute arbitrary code, execute arbitrary code via a long $asctime, buffer overflow
CVE-2002-1457: SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parameter.
Key phrases: execute arbitrary SQL statements, execute arbitrary SQL statements via the search parameter, sql injection
CVE-2002-1458: Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to insert arbitrary script or HTML via message fields including (1) From, (2) E-Mail, (3) Subject and (4) Body.
Key phrases: insert arbitrary script or HTML, insert arbitrary script or HTML via message fields, cross-site scripting
CVE-2002-1459: Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is off, allows remote attackers to insert arbitrary script or HTML via message fields including (1) From, (2) E-Mail, and (3) Subject.
Key phrases: insert arbitrary script or HTML, insert arbitrary script or HTML via message fields, cross-site scripting
CVE-2002-1460: L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST (attachment, attachment_name, attachment_size and attachment_type), which allows remote attackers to read arbitrary files.
Key phrases: read arbitrary files, file upload
CVE-2002-1461: Web Shop Manager 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search box.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2002-1462: details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by modifying certain hidden form fields.
Key phrases: modify information of other users by modifying certain, hidden form fields
CVE-2002-1463: Symantec Raptor Firewall 6.5 and 6.5.3, Enterprise Firewall 6.5.2 and 7.0, VelociRaptor Models 500/700/1000 and 1100/1200/1300, and Gateway Security 5110/5200/5300 generate easily predictable initial sequence numbers (ISN), which allows remote attackers to spoof connections.
Key phrases: spoof connections, initial sequence numbers (isn), spoofing
CVE-2002-1464: Cross-site scripting (XSS) vulnerability in CafeLog b2 Weblog Tool allows remote attackers to insert arbitrary HTML or script via the GPC variable.
Key phrases: insert arbitrary HTML or script, insert arbitrary HTML or script via the GPC, cross-site scripting (xss), arbitrary html
CVE-2002-1465: SQL injection vulnerability in CafeLog b2 Weblog Tool allows remote attackers to execute arbitrary SQL code via the tablehosts variable.
Key phrases: execute arbitrary SQL code, execute arbitrary SQL code via the tablehosts variable, sql injection, arbitrary sql code
CVE-2002-1466: CafeLog b2 Weblog Tool 2.06pre4, with allow_fopen_url enabled, allows remote attackers to execute arbitrary PHP code via the b2inc variable.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the b2inc variable, allow_fopen_url
CVE-2002-1467: Macromedia Flash Plugin before 6,0,47,0 allows remote attackers to bypass the same-domain restriction and read arbitrary files via (1) an HTTP redirect, (2) a "file://" base in a web document, or (3) a relative URL from a web archive (mht file).
Key phrases: read arbitrary files, bypass the same-domain restriction, bypass the same-domain restriction and read
CVE-2002-1468: Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root.
Key phrases: execute arbitrary code, execute arbitrary code as root, buffer overflow
CVE-2002-1469: scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls by uploading malicious programs and modifying the PATH variable in $HOME/.ssh/environment to locate those programs.
Key phrases: bypass access controls, bypass access controls by uploading malicious programs and
CVE-2002-1470: SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes the password to be logged in the world-readable sc_serv.log file.
Key phrases: obtain the cleartext administrative password, obtain the cleartext administrative password via a GET, world-readable sc_serv.log file
CVE-2002-1471: The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate, which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack.
Key phrases: monitor or modify sessions via a man-, man-in-the-middle, man in the middle
CVE-2002-1472: Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.
Key phrases: gain root privileges, gain root privileges via a modified LD_PRELOAD environment, untrusted search path
CVE-2002-1473: Multiple buffer overflows in lp subsystem for HP-UX 10.20 through 11.11 (11i) allow local users to cause a denial of service and possibly execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflows
CVE-2002-1474: Unknown vulnerability or vulnerabilities in TCP/IP component for HP Tru64 UNIX 4.0f, 4.0g, and 5.0a allows remote attackers to cause a denial of service.
Key phrases: cause a denial of service, unknown
CVE-2002-1475: Unknown vulnerability in the ARP component for HP Tru64 UNIX 4.0f, 4.0g, and 5.0a allows remote attackers to "take over packets destined for another host" and cause a denial of service.
Key phrases: "take over packets destined for another host, unknown, denial of service
CVE-2002-1476: Buffer overflow in setlocale in libc on NetBSD 1.4.x through 1.6, and possibly other operating systems, when called with the LC_ALL category, allows local attackers to execute arbitrary code via a user-controlled locale string that has more than 6 elements, which exceeds the boundaries of the new_categories category array, as exploitable through programs such as xterm and zsh.
Key phrases: execute arbitrary code, execute arbitrary code via a user-controlled, buffer overflow, exploitable
CVE-2002-1477: graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2002-1478: Cacti before 0.6.8 allows attackers to execute arbitrary commands via the "Data Input" option in console mode.
Key phrases: execute arbitrary commands, execute arbitrary commands via the "Data Input
CVE-2002-1479: Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.
Key phrases: gain privileges, modify databases as the Cacti user and possibly, world-readable permissions
CVE-2002-1480: Cross-site scripting (XSS) vulnerability in phpGB before 1.20 allows remote attackers to inject arbitrary HTML or script into guestbook pages, which is executed when the administrator deletes the entry.
Key phrases: inject arbitrary HTML or script, inject arbitrary HTML or script into guestbook pages, cross-site scripting (xss), arbitrary html
CVE-2002-1481: savesettings.php in phpGB 1.20 and earlier does not require authentication, which allows remote attackers to cause a denial of service or execute arbitrary PHP code by using savesettings.php to modify config.php.
Key phrases: execute arbitrary PHP code, cause a denial of service or execute arbitrary