yahoo-inc/cve-impacts huggingface dataset:
CVE-2002-1800: phpRank 1.8 stores the administrative password in plaintext on the server and in the "ap" cookie, which allows remote attackers to retrieve the administrative password.
Key phrases: retrieve the administrative password, plaintext
CVE-2002-1801: ImageFolio 2.23 through 2.27 allows remote attackers to obtain sensitive information via a nonexistent image category, which leaks the web root in the resulting error message.
Key phrases: obtain sensitive information, obtain sensitive information via a nonexistent image category, web root
CVE-2002-1802: Cross-site scripting (XSS) vulnerability in Xoops 1.0 RC3 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag when submitting news.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1803: Cross-site scripting (XSS) vulnerability in PHP-Nuke 6.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1804: Cross-site scripting (XSS) vulnerability in NPDS 4.8 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1805: Cross-site scripting (XSS) vulnerability in DaCode 1.2.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1806: Cross-site scripting (XSS) vulnerability in Drupal 4.0.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1807: Cross-site scripting (XSS) vulnerability in phpWebSite 0.8.3 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1808: Cross-site scripting (XSS) vulnerability in Meunity Community System 1.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag when creating a topic.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1809: The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL database.
Key phrases: gain unauthorized root access, gain unauthorized root access to the MySQL database, null root password
CVE-2002-1810: D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contains sensitive information such as the administrative password, the WEP encryption keys, and network configuration information.
Key phrases: access the TFTP server without authentication and read, sensitive information
CVE-2002-1811: Belkin F5D6130 Wireless Network Access Point running firmware AP14G8 allows remote attackers to cause a denial of service (connection loss) by sending several SNMP GetNextRequest requests.
Key phrases: denial of service (connection loss), cause a denial of service (connection loss
CVE-2002-1812: Buffer overflow in gdam123 0.933 and 0.942 allows local users to execute arbitrary code via a long filename parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a long filename parameter, buffer overflow
CVE-2002-1813: Directory traversal vulnerability in AOL Instant Messenger (AIM) 4.8.2790 allows remote attackers to execute arbitrary programs by specifying the program in the href attribute of a link.
Key phrases: execute arbitrary programs, execute arbitrary programs by specifying the program in, directory traversal
CVE-2002-1814: Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via long command line arguments.
Key phrases: execute arbitrary code, execute arbitrary code via long command line arguments, buffer overflow
CVE-2002-1815: Directory traversal vulnerability in source.php and source.cgi in Aquonics File Manager 1.5 allows remote attackers to read arbitrary files via a ..  (dot dot) in the URL.
Key phrases: read arbitrary files, read arbitrary files via a ..  (, directory traversal
CVE-2002-1816: Off-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP GET, off-by-one buffer overflow
CVE-2002-1817: Unknown vulnerability in Veritas Cluster Server (VCS) 1.2 for WindowsNT, Cluster Server 1.3.0 for Solaris, and Cluster Server 1.3.1 for HP-UX allows attackers to gain privileges via unknown attack vectors.
Key phrases: gain privileges, gain privileges via unknown attack vectors
CVE-2002-1818: ezhttpbench.php in eZ httpbench 1.1 allows remote attackers to read arbitrary files via a full pathname in the AnalyseSite parameter.
Key phrases: read arbitrary files, read arbitrary files via a full pathname in
CVE-2002-1819: Directory traversal vulnerability in TinyHTTPD 0.1 .0 allows remote attackers to read or execute arbitrary files via a ".." (dot dot) in the URL.
Key phrases: execute arbitrary files, read or execute arbitrary files via a ", directory traversal
CVE-2002-1820: register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a."
Key phrases: impersonate the administrator by registering an account name
CVE-2002-1821: Ultimate PHP Board (UPB) 1.0 and 1.0b allows remote authenticated users to gain privileges and perform unauthorized actions via direct requests to (1) admin_members.php, (2) admin_config.php, (3) admin_cat.php, or (4) admin_forum.php.
Key phrases: gain privileges, gain privileges and perform unauthorized actions via direct
CVE-2002-1822: IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page (JSP).
Key phrases: obtain the path to the web root directory, sensitive information, information leak
CVE-2002-1823: Buffer overflow in the HttpGetRequest function in Zeroo HTTP server 1.5 allows remote attackers to execute arbitrary code via a long HTTP request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP request, buffer overflow, long http request
CVE-2002-1824: Microsoft Internet Explorer 6.0, when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake, does not prompt the user before searching for and finding a newer certificate, which may allow attackers to perform a man-in-the-middle attack. NOTE: it is not clear whether this poses a vulnerability.
Key phrases: perform a man-in-the-, man-in-the-middle, man in the middle
CVE-2002-1825: Format string vulnerability in PerlRTE_example1.pl in WASD 7.1, 7.2.0 through 7.2.3, and 8.0.0 allows remote attackers to execute arbitrary commands or crash the server via format strings in the $name variable.
Key phrases: execute arbitrary commands, execute arbitrary commands or crash the server via, format string
CVE-2002-1826: grsecurity 1.9.4 for Linux kernel 2.4.18 allows local users to bypass read-only permissions by using mmap to directly map /dev/mem or /dev/kmem to kernel memory.
Key phrases: bypass read-only permissions, bypass read-only permissions by using mmap
CVE-2002-1827: Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock on the (1) alias, (2) map, (3) statistics, and (4) pid files.
Key phrases: cause a denial of service by obtaining an, exclusive lock
CVE-2002-1828: Savant Webserver 3.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request with a negative Content-Length value.
Key phrases: denial of service (crash), cause a denial of service (crash), negative content-length value
CVE-2002-1829: Cross-site scripting (XSS) vulnerability in codeparse.php in Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to inject arbitrary web script or HTML via (1) myhome.php, (2) an onerror attribute in an IMG tag (a variant of CVE-2002-0330), or (3) a glow tag.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2002-1830: Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to bypass authentication and access modifier options via a direct request to moderator.php with the action and ismod parameters.
Key phrases: bypass authentication, bypass authentication and access modifier options via a
CVE-2002-1831: Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-encoded spaces (%20) in the Invitation-Cookie field.
Key phrases: denial of service (crash), cause a denial of service (crash), hex-encoded spaces
CVE-2002-1832: Unknown vulnerability in the "ipopts decode" functionality in Firestorm IDS 0.4.0 through 0.4.2 allows remote attackers to cause a denial of service (crash) via certain IP options.
Key phrases: denial of service (crash), cause a denial of service (crash), unknown
CVE-2002-1833: The default configurations for DocuTech 6110 and DocuTech 6115 have a default administrative password of (1) "service!" on Solaris 8.0 or (2) "administ" on Windows NT, which allows remote attackers to gain privileges.
Key phrases: gain privileges
CVE-2002-1834: The default configuration of Xerox DocuTech 6110 and DocuTech 6115 allows remote attackers to connect to the web server and (1) submit print jobs directly into the "print now" queue or (2) read the scanner job history.
Key phrases: connect to the web server and (1
CVE-2002-1835: The default configuration of Xerox DocuTech 6110 and DocuTech 6115 running Solaris 8.0 has a large number of unnecessary services enabled such as RPC and sprayd, which could allow remote attackers to obtain access to the device.
Key phrases: obtain access, obtain access to the device, rpc, sprayd
CVE-2002-1836: The default configuration of Xerox DocuTech 6110 and DocuTech 6115 exports certain NFS shares to the world with world writable permissions, which may allow remote attackers to modify sensitive files.
Key phrases: modify sensitive files, world writable permissions
CVE-2002-1837: The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album parameter, which generates different error messages depending on whether the directory exists or not.
Key phrases: determine the existence of arbitrary directories via "
CVE-2002-1838: Charities.cron 1.0.2 through 1.6.0 allows local users to write to arbitrary files via a symlink attack on temporary files.
Key phrases: write to arbitrary files via a symlink attack
CVE-2002-1839: Trend Micro InterScan VirusWall for Windows NT 3.52 does not record the sender's IP address in the headers for a mail message when it is passed from VirusWall to the MTA, which allows remote attackers to hide the origin of the message.
Key phrases: hide the origin of the message
CVE-2002-1840: irssi IRC client 0.8.4, when downloaded after 14-March-2002, could contain a backdoor in the configuration file, which allows remote attackers to access the system.
Key phrases: access the system, backdoor
CVE-2002-1841: The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and execute arbitrary PHP files with extensions such as .php4.
Key phrases: execute arbitrary PHP files, upload and execute arbitrary PHP files with extensions, file upload
CVE-2002-1842: Perlbot 1.0 beta allows remote attackers to execute arbitrary commands via shell metacharacters in (1) a word that is being spell checked or (2) an e-mail address.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in (
CVE-2002-1843: Perlbot 1.9.2 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the $text variable in SpelCheck.pm or (2) the $filename variable in HTMLPlog.pm.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in (
CVE-2002-1844: Microsoft Windows Media Player (WMP) 6.3, when installed on Solaris, installs executables with world-writable permissions, which allows local users to delete or modify the executables to gain privileges.
Key phrases: gain privileges, delete or modify the executables to gain privileges, world-writable permissions
CVE-2002-1845: Cross-site scripting (XSS) vulnerability in index.php in Yet Another Bulletin Board (YaBB) 1.40 and 1.41 allows remote attackers to inject arbitrary web script or HTML via the password (passwrd) parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1846: Yet Another Bulletin Board (YaBB) 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by stealing the cookie of another user, modifying the expiretime setting, and submitting the change in a profile2 action to index.php.
Key phrases: modify passwords by stealing the cookie of another, steal cookie
CVE-2002-1847: Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. NOTE: since the only known attack vector requires command line access, this may not be a vulnerability.
Key phrases: execute arbitrary commands, execute arbitrary commands via a long mp3 filename, buffer overflow
CVE-2002-1848: TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which could allow local users to access passwords.
Key phrases: access passwords, unencrypted passwords
CVE-2002-1849: ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back button, then logging into the same chat room as a different user, which fills the chat room with invalid users.
Key phrases: cause a denial of service by repeatedly logging, invalid users
CVE-2002-1850: mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
Key phrases: denial of service (hang and memory consumption), cause a denial of service (hang and, read write deadlock
CVE-2002-1851: Buffer overflow in WS_FTP Pro 7.5 allows remote attackers to execute code on a client system via unknown attack vectors.
Key phrases: execute code on a client system via unknown, buffer overflow, unknown attack vectors
CVE-2002-1852: Cross-site scripting (XSS) vulnerability in Monkey 0.5.0 allows remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) a parameter to test2.pl.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2002-1853: Cross-site scripting (XSS) vulnerability in MyNewsGroups 0.4 and 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the subject of a newsgroup post, which is not properly handled by (1) myarticles.php, (2) search.php, (3) stats.php, or (4) standard.lib.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1854: Rlaj whois CGI script (whois.cgi) 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2002-1855: Macromedia JRun 3.0 through 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
Key phrases: retrieve files in the WEB-INF directory
CVE-2002-1856: HP Application Server 8.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
Key phrases: retrieve files in the WEB-INF directory
CVE-2002-1857: jo! jo Webserver 1.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
Key phrases: retrieve files in the WEB-INF directory
CVE-2002-1858: Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
Key phrases: retrieve files in the WEB-INF directory
CVE-2002-1859: Orion Application Server 1.5.3, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
Key phrases: retrieve files in the WEB-INF directory
CVE-2002-1860: Pramati Server 3.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
Key phrases: retrieve files in the WEB-INF directory
CVE-2002-1861: Sybase Enterprise Application Server 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
Key phrases: retrieve files in the WEB-INF directory
CVE-2002-1862: SmartMail Server 2.0 allows remote attackers to cause a denial of service (crash) by sending data and closing the connection before all the data has been sent.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1863: Iomega Network Attached Storage (NAS) A300U, and possibly other models, does not allow the FTP service to be disabled, which allows local users to access home directories via FTP even when access to all shared directories have been disabled.
Key phrases: be disabled, access home directories via FTP even when access, ftp service
CVE-2002-1864: Directory traversal vulnerability in Simple Web Server (SWS) 0.0.4 through 0.1.0 allows remote attackers to read arbitrary files via a ".." (dot dot) in an HTTP request.
Key phrases: read arbitrary files, read arbitrary files via a "..", directory traversal
CVE-2002-1865: Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.56b5 and (2) Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 through 1.42.7 and Linksys WAP11 1.3 and 1.4, allows remote attackers to cause a denial of service (crash) via a long header, as demonstrated using the Host header.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1866: Simple Web Server (SWS) 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages, which could allow remote attackers to cause a denial of service (file descriptor exhaustion) via multiple requests for pages that do not exist.
Key phrases: denial of service (file descriptor exhaustion), cause a denial of service (file descriptor
CVE-2002-1867: The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an administrative account, or (2) admin/nph-build.cgi, which allows remote attackers to cause a denial of service (CPU consumption).
Key phrases: denial of service (CPU consumption), create an administrative account, cause a denial of service (CPU consumption, admin nph-build.cgi
CVE-2002-1868: Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields.
Key phrases: execute arbitrary shell commands, execute arbitrary shell commands via certain form fields, dispair and
CVE-2002-1869: Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.
Key phrases: prevent events from being recorded by opening the, file write
CVE-2002-1870: Simple Web Server (SWS) 0.0.4 through 0.1.0 does not properly handle when the recv function call fails, which may allow remote attackers to overwrite program data or perform actions on an uninitialized heap, leading to a denial of service and possibly code execution.
Key phrases: overwrite program data or perform actions on an, uninitialized heap, denial of service, code execution
CVE-2002-1871: pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" (question mark) in the (1) mode, (2) owner, or (3) group fields, which allows attackers to elevate privileges.
Key phrases: elevate privileges, setuid setgid root
CVE-2002-1872: Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.
Key phrases: sniff and decrypt the password, weak password encryption (xor), decrypt password
CVE-2002-1873: Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.
Key phrases: denial of service (crash or memory consumption), cause a denial of service (crash or, malformed msrpc calls
CVE-2002-1874: astrocam.cgi in AstroCam 0.9-1-1 through 1.4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request.  NOTE: earlier disclosures stated that the affected versions were 1.7.1 through 2.1.2, but the vendor explicitly stated that these were incorrect.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in an, disclosure
CVE-2002-1875: Entercept Agent 2.5 agent for Windows, released before May 21, 2002, allows local administrative users to obtain the entercept agent password, which could allow the administrators to log on as the entercept_agent account and conceal their identity.
Key phrases: obtain the entercept agent password, log on as the entercept_agent account and conceal
CVE-2002-1876: Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS.
Key phrases: cause a denial of service via a large
CVE-2002-1877: NETGEAR FM114P allows remote attackers to bypass access restrictions for web sites via a URL that uses the IP address instead of the hostname.
Key phrases: bypass access restrictions, bypass access restrictions for web sites via a
CVE-2002-1878: PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the inc_dir parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the inc_dir parameter, php remote file inclusion, arbitrary php code
CVE-2002-1879: SQL injection vulnerability in LokwaBB 1.2.2 allows remote attackers to execute arbitrary SQL commands via the (1) member parameter to member.php or (2) loser parameter to misc.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection
CVE-2002-1880: LokwaBB 1.2.2 allows remote attackers to read arbitrary messages by modifying the pmid parameter to pm.php.
Key phrases: read arbitrary messages, read arbitrary messages by modifying the pmid parameter
CVE-2002-1881: Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service (web browser crash) via malformed content in a Flash Shockwave (.SWF) file, as demonstrated by by ROT13 encoding the body of the file but not the headers.
Key phrases: denial of service (web browser crash), cause a denial of service (web browser, malformed content
CVE-2002-1882: Unknown vulnerability in AolSecurityPrivate.class in Oracle E-Business Suite 11i 11.1 through 11.6 allows remote attackers to bypass user authentication checks via unknown attack vectors.
Key phrases: bypass user authentication, bypass user authentication checks via unknown attack vectors
CVE-2002-1883: Trolltech Qt Assistant 1.0 in Trolltech Qt 3.0.3, when loaded from the Designer, opens port 7358 for interprocess communication, which allows remote attackers to open arbitrary HTML pages and cause a denial of service.
Key phrases: open arbitrary HTML pages, open arbitrary HTML pages and cause a denial, arbitrary html pages, denial of service
CVE-2002-1884: index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin".
Key phrases: log in as an administrator by setting the
CVE-2002-1885: PHP remote file inclusion vulnerability in showhits.php3 for PowerPhlogger (PPhlogger) 2.0.9 through 2.2.2 allows remote attackers to execute arbitrary PHP code via the rel_path parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the rel_path parameter, php remote file inclusion, arbitrary php code
CVE-2002-1886: TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain the database username and password.
Key phrases: obtain the database, obtain the database username and password, insufficient access control
CVE-2002-1887: PHP remote file inclusion vulnerability in customize.php for phpMyNewsletter 0.6.10 allows remote attackers to execute arbitrary PHP code via the l parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the l parameter, php remote file inclusion, arbitrary php code
CVE-2002-1888: CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allows those organizations to obtain internal server names.
Key phrases: obtain internal server names.
CVE-2002-1889: Off-by-one buffer overflow in the context_action function in context.c of Logsurfer 1.41 through 1.5a allows remote attackers to cause a denial of service (crash) via a malformed log entry.
Key phrases: denial of service (crash), cause a denial of service (crash), off-by-one buffer overflow
CVE-2002-1890: rhmask 1.0-9 in Red Hat Linux 7.1 allows local users to overwrite arbitrary files via a symlink attack on the mask file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2002-1891: Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.
Key phrases: execute arbitrary code, execute arbitrary code via a long invite request, buffer overflow
CVE-2002-1892: NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.
Key phrases: obtain sensitive information, readable format
CVE-2002-1893: Cross-site scripting (XSS) vulnerability in ArGoSoft Mail Server Pro 1.8.1.9 allows remote attackers to inject arbitrary web script or HTML via the e-mail message.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1894: Cross-site scripting (XSS) vulnerability in viewtopic.php in phpBB 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1895: The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
Key phrases: denial of service (crash), cause a denial of service (crash), http get requests
CVE-2002-1896: Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long (1, buffer overflow
CVE-2002-1897: MyWebServer LLC MyWebServer 1.0.2 allows remote attackers to cause a denial of service (crash) via a long HTTP request, possibly triggering a buffer overflow.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1898: Terminal 1.3 in Apple Mac OS X 10.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link, which is executed by Terminal.app window.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in a
CVE-2002-1899: Cross-site scripting (XSS) vulnerability in IceWarp Web Mail 3.3.3 and 3.4.5 allows remote attackers to inject arbitrary web script or HTML via the "Full Name" (addressname) parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1900: Cross-site scripting (XSS) vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via tasklists, cross-site scripting (xss)
CVE-2002-1901: Cross-site scripting (XSS) vulnerability in Bodo Bauer BBGallery 1.0 allows remote attackers to inject arbitrary web script or HTML via image tags.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via image, cross-site scripting (xss)
CVE-2002-1902: CGIForum 1.0 through 1.05 allows remote attackers to cause a denial of service (infinite recursion) by creating a message board post that is a child of an outdated parent.
Key phrases: denial of service (infinite recursion), cause a denial of service (infinite recursion, outdated parent
CVE-2002-1903: Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information.
Key phrases: obtain sensitive information
CVE-2002-1904: Buffer overflow in the Log function in util.c in GazTek ghttpd 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long HTTP GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP GET, buffer overflow
CVE-2002-1905: Buffer overflow in the web server of Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1906: The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) by sending incomplete HTTP requests and leaving the connections open.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, incomplete http requests, connections open
CVE-2002-1907: TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1908: Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2002-1909: Click2Learn Ingenium Learning Management System 5.1 and 6.1 stores the hashed administrative password in a config.txt file under the htdocs directory, which allows remote attackers to obtain the administrative password.
Key phrases: obtain the administrative password
CVE-2002-1910: Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), which allows attackers to obtain passwords.
Key phrases: obtain passwords, weak encryption
CVE-2002-1911: ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of SYN packets (SYN flood).  NOTE: the vendor was not able to reproduce the issue.
Key phrases: denial of service (CPU and memory consumption), cause a denial of service (CPU and, syn flood
CVE-2002-1912: SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Ethernet interface when the buffers are full, which allows remote attackers to cause a denial of service (null pointer exception and kernel panic) via a large number of packets.
Key phrases: denial of service (null pointer exception and kernel panic), cause a denial of service (null pointer
CVE-2002-1913: phptonuke.php in myPHPNuke 1.8.8 allows remote attackers to read arbitrary files via a full pathname in the filnavn variable.
Key phrases: read arbitrary files, read arbitrary files via a full pathname in
CVE-2002-1914: dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file.
Key phrases: denial of service (execution prevention), cause a denial of service (execution prevention
CVE-2002-1915: tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.
Key phrases: denial of service (execution prevention), cause a denial of service (execution prevention
CVE-2002-1916: Pirch and RusPirch, when auto-log is enabled, allows remote attackers to cause a denial of service (crash) via a nickname containing an MS-DOS device name such as AUX, which is inserted into a filename for saving queries.
Key phrases: denial of service (crash), cause a denial of service (crash), auto-log
CVE-2002-1917: CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC mail header.
Key phrases: obtain e-mail addresses by injecting a CRLF, crlf injection
CVE-2002-1918: Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown attack vectors.  NOTE: due to the lack of details available regarding this issue, perhaps it should be REJECTED.
Key phrases: have unknown impact with unknown attack vectors, buffer overflow
CVE-2002-1919: SQL injection vulnerability in shopadmin.asp in VP-ASP 4.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password fields.
Key phrases: execute arbitrary SQL commands, bypass authentication, execute arbitrary SQL commands and bypass authentication via, sql injection
CVE-2002-1920: Buffer overflow in FtpXQ 2.5 allows remote attackers to cause a denial of service (crash) via a MKD command with a long directory name.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1921: The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote attackers to connect to the database.
Key phrases: connect to the database, bind address, loopback interface
CVE-2002-1922: Cross-site scripting (XSS) vulnerability in global.php in Jelsoft vBulletin 2.0.0 through 2.2.8 allows remote attackers to inject arbitrary web script or HTML via the (1) $scriptpath or (2) $url variables.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1923: The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows, does not have logging enabled, which could allow remote attackers to conduct activities without detection.
Key phrases: conduct activities without detection
CVE-2002-1924: PowerChute plus 5.0.2 creates a "Pwrchute" directory during installation that is shared and world writeable, which could allow remote attackers to modify or create files in that directory.
Key phrases: modify or create files in that directory, world writeable
CVE-2002-1925: Tiny Personal Firewall 3.0 through 3.0.6 allows remote attackers to cause a denial of service (crash) by via SYN, UDP, ICMP and TCP portscans when the administrator selects the Log tab of the Personal Firewall Agent module.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1926: Directory traversal vulnerability in source.php in Aquonics File Manager 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP query string.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2002-1927: Aquonics File Manager 1.5 allows users with edit privileges to modify user accounts by editing the userlist.cgi file.
Key phrases: modify user accounts by editing the userlist.cgi file
CVE-2002-1928: 602Pro LAN SUITE 2002 allows remote attackers to view the directory tree via an HTTP GET request with a trailing "~" (tilde) or ".bak" extension.
Key phrases: view the directory tree via an HTTP GET
CVE-2002-1929: Cross-site scripting (XSS) vulnerability in pafiledb.php in PHP Arena paFileDB 1.1.3 through 3.0 allows remote attackers to inject arbitrary web script or HTML via the query string in the (1) rate, (2) email, or (3) download actions.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1930: Buffer overflow in AN HTTPd 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username.
Key phrases: execute arbitrary code, execute arbitrary code via a SOCKS4 request with, buffer overflow
CVE-2002-1931: Cross-site scripting (XSS) vulnerability in PHP Arena paFileDB 1.1.3 and 2.1.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the search string.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2002-1932: Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events (clear log manually)" option is set, does not notify the administrator when the log reaches its maximum size, which allows local users and remote attackers to avoid detection.
Key phrases: avoid detection
CVE-2002-1933: The terminal services screensaver for Microsoft Windows 2000 does not automatically lock the terminal window if the window is minimized, which could allow local users to gain access to the terminal server window.
Key phrases: gain access, gain access to the terminal server window
CVE-2002-1934: Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 2.0.1 leaks sensitive information during boot-up, which allows attackers to obtain the MD5 hash of the Admin password, MD5 hash of the physical password, and other registration information.
Key phrases: obtain the MD5 hash of the Admin password, sensitive information
CVE-2002-1935: Pingtel Xpressa 1.2.5 through 2.0.1 uses predictable (1) Call-ID, (2) CSeq, and (3) "To" and "From" SIP URL values in a Session Identification Protocol (SIP) request, which allows remote attackers to avoid registering with the SIP registrar.
Key phrases: avoid registering with the SIP registrar
CVE-2002-1936: UTStarcom BAS 1000 3.1.10 creates several default or back door accounts and passwords, which allows remote attackers to gain access via (1) field account with a password of "*field", (2) guru account with a password of "*3noguru", (3) snmp account with a password of "snmp", or (4) dbase account with a password of "dbase".
Key phrases: gain access, gain access via (1) field account, back door accounts
CVE-2002-1937: Symantec Firewall/VPN Appliance 100 through 200R hardcodes the administrator's MAC address inside the firewall's configuration, which allows remote attackers to spoof the administrator's MAC address and perform an ARP poisoning man-in-the-middle attack to obtain the administrator's password.
Key phrases: obtain the administrator's password, spoof the administrator's MAC address and perform, arp poisoning man-in-the-middle, hardcoded, spoofing, man in the middle
CVE-2002-1938: Virgil CGI Scanner 0.9 allows remote attackers to execute arbitrary commands via the (1) tar (TARGET) or (2) zielport (ZIELPORT) parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via the (1)
CVE-2002-1939: FlashFXP 1.4 prints FTP passwords in plaintext when there are transfers in the queue, which allows attackers to obtain FTP passwords of other users by editing the queue properties.
Key phrases: obtain FTP passwords, obtain FTP passwords of other users by editing, plaintext
CVE-2002-1940: LCC-Win32 3.2 compiler, when running on Windows 95, 98, or ME, writes portions of previously used memory after the import table, which could allow attackers to gain sensitive information.  NOTE: it has been reported that this problem is due to the OS and not the application.
Key phrases: gain sensitive information
CVE-2002-1941: Buffer overflow in RadioBird WebServer 4 Everyone 1.28 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request with the Host header set.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1942: Imatix Xitami 2.5 b5 does not properly terminate certain Keep-Alive connections that have been broken or closed early, which allows remote attackers to cause a denial of service (crash) via a large number of concurrent sessions.
Key phrases: denial of service (crash), cause a denial of service (crash), keep-alive connections
CVE-2002-1943: SafeTP 1.46, when network address translation (NAT) is being used, leaks the internal IP address of the FTP server in a response to a passive mode (PASV) file transfer request.
CVE-2002-1944: Motorola Surfboard 4200 cable modem allows remote attackers to cause a denial of service (crash) by performing a SYN scan using a tool such as nmap.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2002-1945: Buffer overflow in SmartMail Server 1.0 Beta 10 allows remote attackers to cause a denial of service (crash) via a long request to (1) TCP port 25 (SMTP) or (2) TCP port 110 (POP3).
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2002-1946: Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software 1.2.000, when the "Save Password" option is used, stores the password with a weak encryption scheme (one-to-one mapping) in a registry key, which allows local users to obtain and decrypt the password.
Key phrases: obtain and decrypt the password, weak encryption, decrypt password
CVE-2002-1947: Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session.
Key phrases: eavesdrop or highjack the SSL session
CVE-2002-1948: Multiple buffer overflows in Gringotts 0.5.9 allows local users to execute arbitrary commands via unknown attack vectors.
Key phrases: execute arbitrary commands, execute arbitrary commands via unknown attack vectors, multiple buffer overflows
CVE-2002-1949: The Network Attached Storage (NAS) Administration Web Page for Iomega NAS A300U transmits passwords in cleartext, which allows remote attackers to sniff the administrative password.
Key phrases: sniff the administrative password, cleartext
CVE-2002-1950: Cross-site scripting (XSS) vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML via the (1) the email parameter of add.php or (2) the banner URL (banurl parameter) in the main list.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1951: Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirectories.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP GET, buffer overflow
CVE-2002-1952: phpRank 1.8 does not properly check the return codes for MySQL operations when authenticating users, which could allow remote attackers to authenticate using a NULL password when database errors occur or if the database is unavailable.
Key phrases: authenticate using a NULL password when database errors, null password
CVE-2002-1953: Heap-based buffer overflow in the goim handler of AOL Instant Messenger (AIM) 4.4 through 4.8.2616 allows remote attackers to cause a denial of service (crash) via escaping of the screen name parameter, which triggers the overflow when the user selects "Get Info" on the buddy.
Key phrases: denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, heap based buffer overflow
CVE-2002-1954: Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the query string argument, as demonstrated using soinfo.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2002-1955: Iomega NAS A300U uses cleartext LANMAN authentication when mounting CIFS/SMB drives, which allows remote attackers to perform a man-in-the-middle attack.
Key phrases: perform a man-in-the-, cleartext lanman authentication, man-in-the-middle, man in the middle
CVE-2002-1956: ROX Filer 1.1.9 and 1.2 is installed with world writable permissions, which allows local users to write to arbitrary files.
Key phrases: write to arbitrary files, world writable permissions
CVE-2002-1957: Buffer overflow in the netlog function in pen.c for Pen 0.9.1 and 0.9.2 allows remote attackers to execute arbitrary commands via malformed log messages.
Key phrases: execute arbitrary commands, execute arbitrary commands via malformed log messages, buffer overflow
CVE-2002-1958: Cross-site scripting (XSS) vulnerability in kmMail 1.0, 1.0a, and 1.0b allows remote attackers to inject arbitrary web script or HTML via (1) javascript in onmouseover or other attributes in "safe" HTML tags such as the "b" tag, or (2) the Subject field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2002-1959: Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in plugin