Uncategorized 2002

Medium

CVE-2002-1909

Click2Learn Ingenium Learning Management System 5.1 and 6.1 stores the hashed administrative password in a config.txt file under the htdocs directory, which allows remote attackers to obtain the admi…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1908

Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.

CVSS: 5.0CWE: N/A

Read more

Low

CVE-2002-1892

NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.

CVSS: 2.1CWE: N/A

Read more

Medium

CVE-2002-1893

Cross-site scripting (XSS) vulnerability in ArGoSoft Mail Server Pro 1.8.1.9 allows remote attackers to inject arbitrary web script or HTML via the e-mail message.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1894

Cross-site scripting (XSS) vulnerability in viewtopic.php in phpBB 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1895

The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET request…

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1896

Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.

CVSS: 7.2CWE: N/A

Read more

Medium

CVE-2002-1897

MyWebServer LLC MyWebServer 1.0.2 allows remote attackers to cause a denial of service (crash) via a long HTTP request, possibly triggering a buffer overflow.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1899

Cross-site scripting (XSS) vulnerability in IceWarp Web Mail 3.3.3 and 3.4.5 allows remote attackers to inject arbitrary web script or HTML via the "Full Name" (addressname) parameter.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1900

Cross-site scripting (XSS) vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1804

Cross-site scripting (XSS) vulnerability in NPDS 4.8 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1902

CGIForum 1.0 through 1.05 allows remote attackers to cause a denial of service (infinite recursion) by creating a message board post that is a child of an outdated parent.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1903

Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information.

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1904

Buffer overflow in the Log function in util.c in GazTek ghttpd 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long HTTP GET request.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1905

Buffer overflow in the web server of Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1906

The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) by sending incomplete HTTP requests and leaving the connections open.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1907

TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1932

Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events (clear log manually)" option is set, does not notify the administrator when the l…

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1933

The terminal services screensaver for Microsoft Windows 2000 does not automatically lock the terminal window if the window is minimized, which could allow local users to gain access to the terminal s…

CVSS: 7.2CWE: N/A

Read more

Medium

CVE-2002-1934

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 2.0.1 leaks sensitive information during boot-up, which allows attackers to obtain the MD5 hash of the Admin password, MD5 hash of the phys…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1955

Iomega NAS A300U uses cleartext LANMAN authentication when mounting CIFS/SMB drives, which allows remote attackers to perform a man-in-the-middle attack.

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1957

Buffer overflow in the netlog function in pen.c for Pen 0.9.1 and 0.9.2 allows remote attackers to execute arbitrary commands via malformed log messages.

CVSS: 7.5CWE: N/A

Read more

Critical

CVE-2002-1959

Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.

CVSS: 10.0CWE: N/A

Read more

Medium

CVE-2002-1960

Cross-site scripting (XSS) vulnerability in Cybozu Share360 1.1 allows remote attackers to inject arbitrary web script or HTML via an HTML link.

CVSS: 4.3CWE: N/A

Read more

High

CVE-2002-1961

Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL whose hostname portion uses a fully qualified domain name (FQDN) that ends in a "." (dot).

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1962

Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL with an IP address instead of a hostname.

CVSS: 7.5CWE: N/A

Read more

Low

CVE-2002-1963

Linux kernel 2.4.1 through 2.4.19 sets root's NR_RESERVED_FILES limit to 10 files, which allows local users to cause a denial of service (resource exhaustion) by opening 10 setuid binaries.

CVSS: 2.1CWE: N/A

Read more

High

CVE-2002-1964

Unknown vulnerability in WesMo phpEventCalendar 1.1 allows remote attackers to execute arbitrary commands via unknown attack vectors.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1965

Cross-site scripting (XSS) vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to inject arbitrary web script or HTML via the (1) Javascript events, as demonstrated v…

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1966

Directory traversal vulnerability in magiccard.cgi in My Postcards Platinum 5.0 and 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1967

Buffer overflow in XiRCON 1.0 Beta 4 allows remote attackers to cause a denial of service (disconnect) via a long (1) ctcp, (2) primsg, (3) msg, or (4) notice command.

CVSS: 5.0CWE: N/A

Read more

Low

CVE-2002-1968

Com21 DOXport 1100 series cable modem running firmware 2.1.1.106, and possibly other versions before 2.1.1.108.003, downloads a DOCSIS configuration file from a TFTP server running on the internal ne…

CVSS: 2.1CWE: N/A

Read more

Medium

CVE-2002-1969

Magic Notebook 1.0b and 1.1b allows remote attackers to cause a denial of service (crash) via an invalid username during login.

CVSS: 5.0CWE: N/A

Read more

Low

CVE-2002-1970

SnortCenter 0.9.5, when configured to push Snort rules, stores the rules in a temporary file with world-readable and world-writable permissions, which allows local users to obtain usernames and passw…

CVSS: 2.1CWE: N/A

Read more

Critical

CVE-2002-1971

The ping utility in networking_utils.php in Sourcecraft Networking_Utils 1.0 allows remote attackers to read arbitrary files via shell metacharacters in the Domain name or IP address argument.

CVSS: 10.0CWE: N/A

Read more

Medium

CVE-2002-1972

Unknown vulnerability in Parallel port powerSwitch (aka pp_powerSwitch) 0.1 does not properly enforce access controls, which allows local users to access arbitrary ports.

CVSS: 4.6CWE: N/A

Read more

Low

CVE-2002-1956

ROX Filer 1.1.9 and 1.2 is installed with world writable permissions, which allows local users to write to arbitrary files.

CVSS: 2.1CWE: N/A

Read more

Medium

CVE-2002-1954

Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the query string argument, as demonstrated using soinf…

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1935

Pingtel Xpressa 1.2.5 through 2.0.1 uses predictable (1) Call-ID, (2) CSeq, and (3) "To" and "From" SIP URL values in a Session Identification Protocol (SIP) request, which allows remote attackers to…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1953

Heap-based buffer overflow in the goim handler of AOL Instant Messenger (AIM) 4.4 through 4.8.2616 allows remote attackers to cause a denial of service (crash) via escaping of the screen name paramet…

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1936

UTStarcom BAS 1000 3.1.10 creates several default or back door accounts and passwords, which allows remote attackers to gain access via (1) field account with a password of "*field", (2) guru account…

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1937

Symantec Firewall/VPN Appliance 100 through 200R hardcodes the administrator's MAC address inside the firewall's configuration, which allows remote attackers to spoof the administrator's MAC address…

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1938

Virgil CGI Scanner 0.9 allows remote attackers to execute arbitrary commands via the (1) tar (TARGET) or (2) zielport (ZIELPORT) parameters.

CVSS: 7.5CWE: N/A

Read more

Low

CVE-2002-1939

FlashFXP 1.4 prints FTP passwords in plaintext when there are transfers in the queue, which allows attackers to obtain FTP passwords of other users by editing the queue properties.

CVSS: 2.1CWE: N/A

Read more

Medium

CVE-2002-1940

LCC-Win32 3.2 compiler, when running on Windows 95, 98, or ME, writes portions of previously used memory after the import table, which could allow attackers to gain sensitive information. NOTE: it h…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1941

Buffer overflow in RadioBird WebServer 4 Everyone 1.28 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request with the Host header set.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1942

Imatix Xitami 2.5 b5 does not properly terminate certain Keep-Alive connections that have been broken or closed early, which allows remote attackers to cause a denial of service (crash) via a large n…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1943

SafeTP 1.46, when network address translation (NAT) is being used, leaks the internal IP address of the FTP server in a response to a passive mode (PASV) file transfer request.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1944

Motorola Surfboard 4200 cable modem allows remote attackers to cause a denial of service (crash) by performing a SYN scan using a tool such as nmap.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1945

Buffer overflow in SmartMail Server 1.0 Beta 10 allows remote attackers to cause a denial of service (crash) via a long request to (1) TCP port 25 (SMTP) or (2) TCP port 110 (POP3).

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1947

Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session.

CVSS: 6.4CWE: N/A

Read more

High

CVE-2002-1948

Multiple buffer overflows in Gringotts 0.5.9 allows local users to execute arbitrary commands via unknown attack vectors.

CVSS: 7.2CWE: N/A

Read more

Medium

CVE-2002-1950

Cross-site scripting (XSS) vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML via the (1) the email parameter of add.php or (2) the banner URL (banurl paramet…

CVSS: 4.3CWE: N/A

Read more

High

CVE-2002-1951

Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirectories.

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1952

phpRank 1.8 does not properly check the return codes for MySQL operations when authenticating users, which could allow remote attackers to authenticate using a NULL password when database errors occu…

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1891

Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1901

Cross-site scripting (XSS) vulnerability in Bodo Bauer BBGallery 1.0 allows remote attackers to inject arbitrary web script or HTML via image tags.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1889

Off-by-one buffer overflow in the context_action function in context.c of Logsurfer 1.41 through 1.5a allows remote attackers to cause a denial of service (crash) via a malformed log entry.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1825

Format string vulnerability in PerlRTE_example1.pl in WASD 7.1, 7.2.0 through 7.2.3, and 8.0.0 allows remote attackers to execute arbitrary commands or crash the server via format strings in the $nam…

CVSS: 6.4CWE: N/A

Read more

Low

CVE-2002-1827

Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock on the (1) alias, (2) map, (3) statistics, and (4) pid files.

CVSS: 2.1CWE: N/A

Read more

Medium

CVE-2002-1828

Savant Webserver 3.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request with a negative Content-Length value.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1829

Cross-site scripting (XSS) vulnerability in codeparse.php in Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to inject arbitrary web script or HTML via (1) myhome.php, (2) an onerror a…

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1830

Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to bypass authentication and access modifier options via a direct request to moderator.php with the action and ismod parameters.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1831

Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-encoded spaces (%20) in the Invitation-Cookie fiel…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1832

Unknown vulnerability in the "ipopts decode" functionality in Firestorm IDS 0.4.0 through 0.4.2 allows remote attackers to cause a denial of service (crash) via certain IP options.

CVSS: 5.0CWE: N/A

Read more

Low

CVE-2002-1888

CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allows those organizations to obtain interna…

CVSS: 2.1CWE: N/A

Read more

Medium

CVE-2002-1834

The default configuration of Xerox DocuTech 6110 and DocuTech 6115 allows remote attackers to connect to the web server and (1) submit print jobs directly into the "print now" queue or (2) read the s…

CVSS: 6.4CWE: N/A

Read more

High

CVE-2002-1835

The default configuration of Xerox DocuTech 6110 and DocuTech 6115 running Solaris 8.0 has a large number of unnecessary services enabled such as RPC and sprayd, which could allow remote attackers to…

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1836

The default configuration of Xerox DocuTech 6110 and DocuTech 6115 exports certain NFS shares to the world with world writable permissions, which may allow remote attackers to modify sensitive files.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1837

The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album paramete…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1838

Charities.cron 1.0.2 through 1.6.0 allows local users to write to arbitrary files via a symlink attack on temporary files.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1839

Trend Micro InterScan VirusWall for Windows NT 3.52 does not record the sender's IP address in the headers for a mail message when it is passed from VirusWall to the MTA, which allows remote attacker…

CVSS: 5.0CWE: N/A

Read more

Critical

CVE-2002-1840

irssi IRC client 0.8.4, when downloaded after 14-March-2002, could contain a backdoor in the configuration file, which allows remote attackers to access the system.

CVSS: 10.0CWE: N/A

Read more

High

CVE-2002-1842

Perlbot 1.0 beta allows remote attackers to execute arbitrary commands via shell metacharacters in (1) a word that is being spell checked or (2) an e-mail address.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1826

grsecurity 1.9.4 for Linux kernel 2.4.18 allows local users to bypass read-only permissions by using mmap to directly map /dev/mem or /dev/kmem to kernel memory.

CVSS: 4.6CWE: N/A

Read more

Medium

CVE-2002-1824

Microsoft Internet Explorer 6.0, when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake, does not prompt the user before searching for and finding a newer cert…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1845

Cross-site scripting (XSS) vulnerability in index.php in Yet Another Bulletin Board (YaBB) 1.40 and 1.41 allows remote attackers to inject arbitrary web script or HTML via the password (passwrd) para…

CVSS: 4.3CWE: N/A

Read more

High

CVE-2002-1823

Buffer overflow in the HttpGetRequest function in Zeroo HTTP server 1.5 allows remote attackers to execute arbitrary code via a long HTTP request.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1805

Cross-site scripting (XSS) vulnerability in DaCode 1.2.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1806

Cross-site scripting (XSS) vulnerability in Drupal 4.0.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1807

Cross-site scripting (XSS) vulnerability in phpWebSite 0.8.3 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.

CVSS: 4.3CWE: N/A

Read more

Medium

CVE-2002-1808

Cross-site scripting (XSS) vulnerability in Meunity Community System 1.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag when creating a topic.

CVSS: 4.3CWE: N/A

Read more

High

CVE-2002-1809

The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL data…

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1811

Belkin F5D6130 Wireless Network Access Point running firmware AP14G8 allows remote attackers to cause a denial of service (connection loss) by sending several SNMP GetNextRequest requests.

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1812

Buffer overflow in gdam123 0.933 and 0.942 allows local users to execute arbitrary code via a long filename parameter.

CVSS: 7.2CWE: N/A

Read more

Low

CVE-2002-1813

Directory traversal vulnerability in AOL Instant Messenger (AIM) 4.8.2790 allows remote attackers to execute arbitrary programs by specifying the program in the href attribute of a link.

CVSS: 2.6CWE: N/A

Read more

Medium

CVE-2002-1814

Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via long command line arguments.

CVSS: 4.6CWE: N/A

Read more

Medium

CVE-2002-1815

Directory traversal vulnerability in source.php and source.cgi in Aquonics File Manager 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1817

Unknown vulnerability in Veritas Cluster Server (VCS) 1.2 for WindowsNT, Cluster Server 1.3.0 for Solaris, and Cluster Server 1.3.1 for HP-UX allows attackers to gain privileges via unknown attack ve…

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1818

ezhttpbench.php in eZ httpbench 1.1 allows remote attackers to read arbitrary files via a full pathname in the AnalyseSite parameter.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1819

Directory traversal vulnerability in TinyHTTPD 0.1 .0 allows remote attackers to read or execute arbitrary files via a ".." (dot dot) in the URL.

CVSS: 6.4CWE: N/A

Read more

Medium

CVE-2002-1821

Ultimate PHP Board (UPB) 1.0 and 1.0b allows remote authenticated users to gain privileges and perform unauthorized actions via direct requests to (1) admin_members.php, (2) admin_config.php, (3) adm…

CVSS: 4.6CWE: N/A

Read more

Medium

CVE-2002-1822

IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non…

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1843

Perlbot 1.9.2 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the $text variable in SpelCheck.pm or (2) the $filename variable in HTMLPlog.pm.

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1833

The default configurations for DocuTech 6110 and DocuTech 6115 have a default administrative password of (1) "service!" on Solaris 8.0 or (2) "administ" on Windows NT, which allows remote attackers t…

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1846

Yet Another Bulletin Board (YaBB) 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by steal…

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1866

Simple Web Server (SWS) 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages, which could allow remote attackers to cause a denial of service (file descriptor exhaustion) via mu…

CVSS: 5.0CWE: N/A

Read more

Critical

CVE-2002-1868

Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields.

CVSS: 10.0CWE: N/A

Read more

High

CVE-2002-1870

Simple Web Server (SWS) 0.0.4 through 0.1.0 does not properly handle when the recv function call fails, which may allow remote attackers to overwrite program data or perform actions on an uninitializ…

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1871

pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" (question mark) in the (1) mode, (2) owner, or (3) group fields, which allows attackers to el…

CVSS: 7.2CWE: N/A

Read more

Medium

CVE-2002-1875

Entercept Agent 2.5 agent for Windows, released before May 21, 2002, allows local administrative users to obtain the entercept agent password, which could allow the administrators to log on as the en…

CVSS: 4.6CWE: N/A

Read more

High

CVE-2002-1877

NETGEAR FM114P allows remote attackers to bypass access restrictions for web sites via a URL that uses the IP address instead of the hostname.

CVSS: 7.5CWE: CWE-264

Read more

Medium

CVE-2002-1878

PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the inc_dir parameter.

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1879

SQL injection vulnerability in LokwaBB 1.2.2 allows remote attackers to execute arbitrary SQL commands via the (1) member parameter to member.php or (2) loser parameter to misc.php.

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1847

Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. NOTE: since…

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1881

Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service (web browser crash) via malformed content in a Flash Shockwave (.SWF) file, as demonstrated by by…

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1882

Unknown vulnerability in AolSecurityPrivate.class in Oracle E-Business Suite 11i 11.1 through 11.6 allows remote attackers to bypass user authentication checks via unknown attack vectors.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1883

Trolltech Qt Assistant 1.0 in Trolltech Qt 3.0.3, when loaded from the Designer, opens port 7358 for interprocess communication, which allows remote attackers to open arbitrary HTML pages and cause a…

CVSS: 6.4CWE: N/A

Read more

High

CVE-2002-1884

index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin".

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1885

PHP remote file inclusion vulnerability in showhits.php3 for PowerPhlogger (PPhlogger) 2.0.9 through 2.2.2 allows remote attackers to execute arbitrary PHP code via the rel_path parameter.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1886

TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain the database username and password.

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1887

PHP remote file inclusion vulnerability in customize.php for phpMyNewsletter 0.6.10 allows remote attackers to execute arbitrary PHP code via the l parameter.

CVSS: 7.5CWE: N/A

Read more

High

CVE-2002-1867

The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an administrative account, or (2) admin/nph…

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1880

LokwaBB 1.2.2 allows remote attackers to read arbitrary messages by modifying the pmid parameter to pm.php.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1865

Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.56b5 and (2) Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 through 1.4…

CVSS: 5.0CWE: N/A

Read more

Low

CVE-2002-1848

TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which could allow local users to access passwords.

CVSS: 2.1CWE: N/A

Read more

Medium

CVE-2002-1864

Directory traversal vulnerability in Simple Web Server (SWS) 0.0.4 through 0.1.0 allows remote attackers to read arbitrary files via a ".." (dot dot) in an HTTP request.

CVSS: 5.0CWE: N/A

Read more

Medium

CVE-2002-1849

ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back bu…

CVSS: 5.0CWE: N/A

Read more

High

CVE-2002-1851

Buffer overflow in WS_FTP Pro 7.5 allows remote attackers to execute code on a client system via unknown attack vectors.

CVSS: 7.5CWE: N/A

Read more

Medium

CVE-2002-1853

Cross-site scripting (XSS) vulnerability in MyNewsGroups 0.4 and 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the subject of a newsgroup post, which is not properly handle…

CVSS: 4.3CWE: N/A

Read more