CVE Daily
← All years

All CVEs — 2002

Page 2/2.

Browse all CVEs by publication year. Use filters to refine.

CVSS ≥ 0.0
2002-12-31
Medium

CVE-2002-1682

NewsReactor 1.0 uses a weak encryption scheme, which could allow local users to decrypt the passwords and gain access to other users' newsgroup accounts.

CVSS: 5.5 CWE: CWE-326
Read more
Medium

CVE-2002-1696

Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Alw…

CVSS: 5.5 CWE: CWE-312
Read more
High

CVE-2002-1697

Electronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, which could allow remote attackers to gain s…

CVSS: 7.5 CWE: CWE-326
Read more
Medium

CVE-2002-1700

Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HT…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2002-1706

Cisco IOS software 11.3 through 12.2 running on Cisco uBR7200 and uBR7100 series Universal Broadband Routers allows remote attackers to modify Data Over Cable Service Interface Specification (DOCSIS)…

CVSS: 7.5 CWE: CWE-347
Read more
Medium

CVE-2002-1713

The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read other user's files.

CVSS: 5.5 CWE: CWE-276
Read more
Medium

CVE-2002-1717

Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (…

CVSS: 5.0 CWE: CWE-200
Read more
Medium

CVE-2002-1718

Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that cont…

CVSS: 5.0 CWE: CWE-200
Read more
High

CVE-2002-1721

Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the FFGET_FILE variable with a (null) byte.

CVSS: 7.5 CWE: CWE-193
Read more
Medium

CVE-2002-1739

Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords.

CVSS: 5.5 CWE: CWE-326
Read more
High

CVE-2002-1745

Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html,…

CVSS: 7.5 CWE: CWE-193
Read more
Medium

CVE-2002-2276

Ultimate PHP Board (UPB) 1.0 allows remote attackers to view the physical path of the message board via a direct request to add.php, which leaks the path in an error message.

CVSS: 5.0 CWE: CWE-200
Read more
High

CVE-2002-1752

csChatRBox.cgi in CGIScript.net csChat-R-Box allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2002-1753

csNewsPro.cgi in CGIScript.net csNews Professional (csNewsPro) allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2002-1796

ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, which allows local users to load unauthorized Chai services.

CVSS: 7.8 CWE: CWE-347
Read more
High

CVE-2002-1979

WatchGuard SOHO products running firmware 5.1.6 and earlier, and Vclass/RSSA using 3.2 SP1 and earlier, allows remote attackers to bypass firewall rules by sending a PASV command string as the argume…

CVSS: 7.5 CWE: CWE-20
Read more
High

CVE-2002-1750

csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2002-2019

PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) 2.1 allows remote attackers to execute arbitrary PHP code via the include_file parameter.

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2002-2256

Directory traversal vulnerability in pWins Webserver 0.2.5 and earlier allows remote attackers to read arbitrary files via Unicode characters.

CVSS: 5.0 CWE: CWE-22
Read more
Low

CVE-2002-2244

Akfingerd 0.5 and earlier versions allow local users to cause a denial of service (crash) via a .plan with a symlink to /dev/urandom or other device, then disconnecting while data is being transferre…

CVSS: 2.1 CWE: CWE-362
Read more
Critical

CVE-2002-2248

Buffer overflow in the sun.awt.windows.WDefaultFontCharset Java class implementation in Netscape 4.0 allows remote attackers to execute arbitrary code via an applet that calls the WDefaultFontCharset…

CVSS: 10.0 CWE: CWE-119
Read more
High

CVE-2002-2249

PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to (1) backend.php, (2) screen.php, or (3) admin/module…

CVSS: 7.5 CWE: CWE-94
Read more
Critical

CVE-2002-2250

Multiple buffer overflows in Sybase Adaptive Server 12.0 and 12.5 allow remote attackers to execute arbitrary code via (1) a long parameter to the xp_freedll extended stored procedure or (2) a long d…

CVSS: 10.0 CWE: CWE-119
Read more
Critical

CVE-2002-2251

Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code via a long argument.

CVSS: 10.0 CWE: CWE-119
Read more
High

CVE-2002-2252

SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a base64-encoded user parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Critical

CVE-2002-2253

Multiple buffer overflows in Cyrus Sieve / libSieve 2.1.2 and earlier allow remote attackers to execute arbitrary code via (1) a long header name, (2) a long IMAP flag, or (3) a script that generates…

CVSS: 10.0 CWE: CWE-119
Read more
Medium

CVE-2002-2255

Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the search_username parameter in…

CVSS: 4.3 CWE: CWE-79
Read more
Critical

CVE-2002-2257

Stack-based buffer overflow in the parse_field function in cgi_lib.c for LIBCGI 1.0.2 and 1.0.3 allows remote attackers to execute arbitrary code via a long argument.

CVSS: 10.0 CWE: CWE-119
Read more
High

CVE-2002-2239

The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed…

CVSS: 7.8 CWE: CWE-20
Read more
Medium

CVE-2002-2258

Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-numeric value in the Content-Length header, which causes an acc…

CVSS: 5.0 CWE: CWE-119
Read more
High

CVE-2002-2259

Buffer overflow in the French documentation patch for Gnuplot 3.7 in SuSE Linux before 8.0 allows local users to execute arbitrary code as root via unknown attack vectors.

CVSS: 7.2 CWE: CWE-119
Read more
Medium

CVE-2002-2260

Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page.

CVSS: 4.3 CWE: CWE-79
Read more
Critical

CVE-2002-2268

Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.

CVSS: 9.4 CWE: CWE-119
Read more
Critical

CVE-2002-2269

Directory traversal vulnerability in Webster HTTP Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

CVSS: 9.4 CWE: CWE-22
Read more
Medium

CVE-2002-2271

Buffer overflow in BigFun 1.51b IRC client, when the Direct Client Connection (DCC) option is used, allows remote attackers to cause a denial of service (crash) via a long string.

CVSS: 5.0 CWE: CWE-119
Read more
High

CVE-2002-2272

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a…

CVSS: 7.8 CWE: CWE-119
Read more
Medium

CVE-2002-2273

Cross-site scripting (XSS) vulnerability in Webster HTTP Server allows remote attackers to inject arbitrary web script or HTML via the URL.

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2002-2240

Directory traversal vulnerability in MyServer 0.11 and 0.2 allows remote attackers to read arbitrary files via a ".." (dot dot) in an HTTP GET request.

CVSS: 5.0 CWE: CWE-22
Read more
Medium

CVE-2002-2246

Cross-site scripting (XSS) vulnerability in VisNetic Website before 3.5.15 allows remote attackers to inject arbitrary web script or HTML via the HTTP referer header (HTTP_REFERER) to a non-existent…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2002-2238

Directory traversal vulnerability in the Kunani ODBC FTP Server 1.0.10 allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in a GET request.

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2002-2226

Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2002-2058

TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 has…

CVSS: 7.5 CWE: CWE-327
Read more
High

CVE-2002-2067

East-Tec Eraser 2002 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be del…

CVSS: 7.5 CWE: CWE-459
Read more
High

CVE-2002-2068

Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.

CVSS: 7.5 CWE: CWE-459
Read more
High

CVE-2002-2069

PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.

CVSS: 7.5 CWE: CWE-459
Read more
High

CVE-2002-2070

SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be…

CVSS: 7.5 CWE: CWE-459
Read more
Medium

CVE-2002-2094

Joe Testa hellbent 01 allows remote attackers to determine the full path of the web root directory via a GET request with a relative path that includes the root's parent, which generates a 403 error…

CVSS: 5.0 CWE: CWE-203
Read more
Medium

CVE-2002-2237

tftp32 TFTP server 2.21 and earlier allows remote attackers to cause a denial of service via a GET request with a DOS device name such as com1 or aux.

CVSS: 5.0 CWE: CWE-20
Read more
Medium

CVE-2002-2154

Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences.

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2002-2196

Samba before 2.2.5 does not properly terminate the enum_csc_policy data structure, which may allow remote attackers to execute arbitrary code via a buffer overflow attack.

CVSS: 7.5 CWE: CWE-119
Read more
Critical

CVE-2002-2119

Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing.

CVSS: 9.8 CWE: CWE-178
Read more
Critical

CVE-2002-2227

Buffer underflow in ssldump 0.9b2 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted SSLv2 challenge value.

CVSS: 10.0 CWE: CWE-787
Read more
High

CVE-2002-2232

Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command.

CVSS: 8.5 CWE: CWE-119
Read more
Medium

CVE-2002-2228

MailScanner before 4.0 5-1 and before 3.2 6-1 allows remote attackers to bypass protection via attachments with a filename with (1) extra leading spaces, (2) extra trailing spaces, or (3) alternate c…

CVSS: 6.4 CWE: CWE-20
Read more
High

CVE-2002-2233

Directory traversal vulnerability in Enceladus Server Suite 3.9 allows remote attackers to list arbitrary directories and possibly cause a denial of service via "@" (at) characters in a CD (CWD) comm…

CVSS: 8.3 CWE: CWE-22
Read more
Critical

CVE-2002-2236

Format string vulnerability in the awp_log function in apt-www-proxy 0.1 allows remote attackers to execute arbitrary code.

CVSS: 10.0 CWE: CWE-20
Read more
Medium

CVE-2002-2231

Cross-site scripting (XSS) vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) a javascript: URL in a photo URL or (2) an X-Forwarded-For: header.

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2002-2230

Cross-site scripting (XSS) vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via a private message with a javascript: URL in the IMG tag, in which the UR…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2002-2229

Directory traversal vulnerability in Sapio Design Ltd. WebReflex 1.53 allows remote attackers to read arbitrary files via a .. in an HTTP request.

CVSS: 5.0 CWE: CWE-22
Read more
Medium

CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap…

CVSS: 5.3 CWE: CWE-219
Read more
2002-12-26
High

CVE-2002-1372

Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of serv…

CVSS: 7.5 CWE: CWE-252
Read more
2002-12-23
Critical

CVE-2002-1357

Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute a…

CVSS: 10.0 CWE: CWE-119
Read more
Critical

CVE-2002-1358

Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as dem…

CVSS: 10.0 CWE: CWE-20
Read more
Critical

CVE-2002-1359

Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer ove…

CVSS: 10.0 CWE: CWE-20
Read more
Critical

CVE-2002-1360

Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a deni…

CVSS: 10.0 CWE: CWE-20
Read more
High

CVE-2002-1365

Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrar…

CVSS: 7.5 CWE: CWE-119
Read more
2002-12-18
Critical

CVE-2002-1347

Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonica…

CVSS: 9.8 CWE: CWE-131
Read more
2002-10-28
High

CVE-2002-1222

Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reset) via a long HTTP request.

CVSS: 7.1 CWE: CWE-119
Read more
High

CVE-2002-1200

Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during m…

CVSS: 7.5 CWE: CWE-119
Read more
2002-10-11
High

CVE-2002-0969

Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini ini…

CVSS: 7.8 CWE: CWE-120
Read more
Medium

CVE-2002-1175

The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a…

CVSS: 5.0 CWE: CWE-20
Read more
High

CVE-2002-1174

Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readh…

CVSS: 7.5 CWE: CWE-119
Read more
2002-10-04
Medium

CVE-2002-0862

The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Ma…

CVSS: 6.8 CWE: CWE-295
Read more
High

CVE-2002-0999

Multiple SQL injection vulnerabilities in CARE 2002 before beta 1.0.02 allow remote attackers to perform unauthorized database operations.

CVSS: 7.5 CWE: CWE-89
Read more
2002-09-24
High

CVE-2002-0985

Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th…

CVSS: 7.5 CWE: CWE-88
Read more
2002-09-05
Medium

CVE-2002-0725

NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trai…

CVSS: 5.5 CWE: CWE-59
Read more
2002-08-12
High

CVE-2002-0649

Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary cod…

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2002-0844

Off-by-one overflow in the CVS PreservePermissions of rcs.c for CVSD before 1.11.2 allows local users to execute arbitrary code.

CVSS: 7.8 CWE: CWE-193
Read more
Medium

CVE-2002-0824

BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device.

CVSS: 6.9 CWE: CWE-59
Read more
High

CVE-2002-0813

Heap-based buffer overflow in the TFTP server capability in Cisco IOS 11.1, 11.2, and 11.3 allows remote attackers to cause a denial of service (reset) or modify configuration via a long filename.

CVSS: 7.1 CWE: CWE-119
Read more
Medium

CVE-2002-0812

Information leak in Compaq WL310, and the Orinoco Residential Gateway access point it is based on, uses a system identification string as a default SNMP read/write community string, which allows remo…

CVSS: 6.4 CWE: CWE-200
Read more
Medium

CVE-2002-0793

Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d ar…

CVSS: 5.5 CWE: CWE-59
Read more
Medium

CVE-2002-0788

An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext temporary files that cannot be wiped or deleted due to str…

CVSS: 5.5 CWE: CWE-459
Read more
High

CVE-2002-0698

Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained thr…

CVSS: 7.5 CWE: CWE-120
Read more
Low

CVE-2002-0507

An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a previous user via several submissions of an OWA Authentication…

CVSS: 2.1 CWE: CWE-287
Read more
Medium

CVE-2002-0515

IPFilter 3.4.25 and earlier sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attackers to identify filtered ports by comparing TTLs.

CVSS: 5.0 CWE: CWE-203
Read more
Medium

CVE-2002-0514

PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default…

CVSS: 5.0 CWE: CWE-203
Read more
Critical

CVE-2002-0495

csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file th…

CVSS: 10.0 CWE: CWE-94
Read more
High

CVE-2002-0485

Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some…

CVSS: 7.5 CWE: CWE-178
Read more
Low

CVE-2002-0422

IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host hea…

CVSS: 2.6 CWE: CWE-200
Read more
Medium

CVE-2002-0419

Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which (2) in cert…

CVSS: 5.0 CWE: CWE-200
Read more
Critical

CVE-2002-0391

Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code b…

CVSS: 9.8 CWE: CWE-190
Read more
2002-07-26
High

CVE-2002-0704

The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.

CVSS: 7.5 CWE: CWE-212
Read more
2002-07-23
Critical

CVE-2002-0671

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attacke…

CVSS: 9.8 CWE: CWE-494
Read more
2002-07-11
High

CVE-2002-0653

Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the…

CVSS: 7.8 CWE: CWE-193
Read more
2002-07-03
Medium

CVE-2002-0563

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2…

CVSS: 5.0 CWE: CWE-287
Read more
Medium

CVE-2002-0574

Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that trigger a bug in ip_output() in which the reference count fo…

CVSS: 5.0 CWE: CWE-401
Read more
Critical

CVE-2002-0639

Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is usin…

CVSS: 9.8 CWE: CWE-190
Read more
2002-06-25
Medium

CVE-2002-0146

fetchmail email client before 5.9.10 does not properly limit the maximum number of messages available, which allows a remote IMAP server to overwrite memory via a message count that exceeds the bound…

CVSS: 5.0 CWE: CWE-20
Read more
High

CVE-2002-0367

smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges…

CVSS: 7.8 CWE: CWE-269
Read more
2002-06-18
Medium

CVE-2002-0368

The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with a malformed RFC message attribute, aka "Malformed Mail Attr…

CVSS: 5.0 CWE: CWE-400
Read more
High

CVE-2002-0401

SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL poin…

CVSS: 7.5 CWE: CWE-476
Read more
Medium

CVE-2002-0596

WebTrends Reporting Center 4.0d allows remote attackers to determine the real path of the web server via a GET request to get_od_toc.pl with an empty Profile parameter, which leaks the pathname in an…

CVSS: 5.0 CWE: CWE-200
Read more
2002-05-29
Medium

CVE-2002-0270

Opera, when configured with the "Determine action by MIME type" option disabled, interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attac…

CVSS: 4.3 CWE: CWE-79
Read more
2002-05-16
High

CVE-2002-0184

Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p (prompt) argument, w…

CVSS: 7.8 CWE: CWE-131
Read more
Medium

CVE-2002-0208

PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows remote attackers to determine that the system is running PGPfire.

CVSS: 5.0 CWE: CWE-203
Read more
2002-04-22
High

CVE-2002-0159

Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash…

CVSS: 7.5 CWE: CWE-134
Read more
2002-04-04
High

CVE-2002-0051

Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.

CVSS: 7.8 CWE: CWE-667
Read more
2002-03-21
High

CVE-2002-0061

Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat)…

CVSS: 7.5 CWE: CWE-78
Read more
2002-03-15
Critical

CVE-2002-0059

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow…

CVSS: 9.8 CWE: CWE-415
Read more
High

CVE-2002-0070

Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an applicati…

CVSS: 7.6 CWE: CWE-119
Read more
Low

CVE-2002-0080

rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files th…

CVSS: 2.1 CWE: CWE-269
Read more
Critical

CVE-2002-0083

Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.

CVSS: 9.8 CWE: CWE-193
Read more
2002-03-08
Medium

CVE-2002-0049

Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys.

CVSS: 6.4 CWE: CWE-269
Read more
High

CVE-2002-0053

Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malforme…

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2002-0054

SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to per…

CVSS: 7.5 CWE: CWE-294
Read more
Medium

CVE-2002-0055

SMTP service in Microsoft Windows 2000, Windows XP Professional, and Exchange 2000 allows remote attackers to cause a denial of service via a command with a malformed data transfer (BDAT) request.

CVSS: 5.0 CWE: CWE-669
Read more
High

CVE-2002-0062

Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to "routines for moving the physical cursor and scrolli…

CVSS: 7.2 CWE: CWE-120
Read more