2002 CVEs (page 10)
Page 10 of 24 — CVEs published in 2002, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2002-1746 | | 2002-12-31 | Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets. | |
CVE-2002-1745 | High | 7.5 | 2002-12-31 | Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing wi… |
CVE-2002-1744 | | 2002-12-31 | Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary fil… | |
CVE-2002-1743 | | 2002-12-31 | AOL ICQ 2002a Build 3722 allows remote attackers to cause a denial of service (crash) via a malformed .hpf file. | |
CVE-2002-1742 | | 2002-12-31 | SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module… | |
CVE-2002-1741 | | 2002-12-31 | Directory traversal vulnerability in WorldClient.cgi in WorldClient for Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to delete arbitrary f… | |
CVE-2002-1740 | | 2002-12-31 | Buffer overflow in WorldClient.cgi in WorldClient in Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to execute arbitrary code via a long fol… | |
CVE-2002-1739 | Medium | 5.5 | 2002-12-31 | Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords. |
CVE-2002-1738 | | 2002-12-31 | Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send an… | |
CVE-2002-1737 | | 2002-12-31 | Astaro Security Linux 2.016 creates world-writable files and directories, which allows local users to overwrite arbitrary files. | |
CVE-2002-1736 | | 2002-12-31 | Unknown vulnerability in CGINews before 1.06 allow remote attackers to read arbitrary files via "unfiltered user input." | |
CVE-2002-1735 | | 2002-12-31 | Buffer overflow in dlogin 1.0a could allow local users to gain privileges via unknown attack vectors. | |
CVE-2002-1734 | | 2002-12-31 | NewsPro 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to "logged,true". | |
CVE-2002-1733 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in the web-based message board in Prospero Technologies allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2002-1732 | | 2002-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in Actinic Catalog 4.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query st… | |
CVE-2002-1731 | | 2002-12-31 | The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF. | |
CVE-2002-1730 | | 2002-12-31 | ASPjar Guestbook 1.00 allows remote attackers to delete arbitrary messages accessing the delete.asp administrative script with certain cookie values set to "tr… | |
CVE-2002-1729 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in ASPjar Guestbook 1.00 allows remote attackers to execute arbitrary script as other users via the "web site" paramet… | |
CVE-2002-1728 | | 2002-12-31 | askSam Web Publisher 1.0 and 4.0 allows remote attackers to determine the full path to the web root directory via a request for a file that does not exist, whi… | |
CVE-2002-1727 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in (1) as_web.exe and (2) as_web4.exe in askSam Web Publisher 1 and 4 allows remote attackers to execute arbitrary scr… | |
CVE-2002-1726 | | 2002-12-31 | secure_inc.php in PhotoDB 1.4 allows remote attackers to bypass authentication via a URL with a large Time parameter, non-empty rmtusername and rmtpassword par… | |
CVE-2002-1725 | | 2002-12-31 | phpimageview.php in PHPImageView 1.0 allows remote attackers to obtain sensitive information via the pw=show option, which invokes the phpinfo function. | |
CVE-2002-1724 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in phpimageview.php for PHPImageView 1.0 allows remote attackers to execute arbitrary script as other users via the pi… | |
CVE-2002-1723 | | 2002-12-31 | Powerboards 2.2b allows remote attackers to view the full path to the backend database by sending a cookie containing a non-existent username to profiles.php… | |
CVE-2002-1722 | | 2002-12-31 | Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have… | |
CVE-2002-1721 | High | 7.5 | 2002-12-31 | Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the… |
CVE-2002-1720 | | 2002-12-31 | SQL injection vulnerability in Spooky Login 2.0 through 2.5 allows remote attackers to bypass authentication and gain privileges via the password field. | |
CVE-2002-1719 | | 2002-12-31 | Unknown vulnerability in Bavo 0.3 allows remote attackers to modify posted messages. | |
CVE-2002-1718 | | 2002-12-31 | Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using a… | |
CVE-2002-1717 | | 2002-12-31 | Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/b… | |
CVE-2002-1716 | | 2002-12-31 | The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability. | |
CVE-2002-1715 | | 2002-12-31 | SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable d… | |
CVE-2002-1714 | | 2002-12-31 | Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type "text/html" with the DATA field… | |
CVE-2002-1713 | Medium | 5.5 | 2002-12-31 | The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow… |
CVE-2002-1712 | | 2002-12-31 | Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the ACK and FI… | |
CVE-2002-1711 | | 2002-12-31 | BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments. | |
CVE-2002-1710 | | 2002-12-31 | The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, whi… | |
CVE-2002-1709 | | 2002-12-31 | SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable. | |
CVE-2002-1708 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into th… | |
CVE-2002-1707 | | 2002-12-31 | install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary P… | |
CVE-2002-1706 | High | 7.5 | 2002-12-31 | Cisco IOS software 11.3 through 12.2 running on Cisco uBR7200 and uBR7100 series Universal Broadband Routers allows remote attackers to modify Data Over Cable… |
CVE-2002-1705 | | 2002-12-31 | Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to cause a denial of service (crash) via a Cascading Style Sheet (CSS) with the p{cssText}… | |
CVE-2002-1704 | | 2002-12-31 | Zeroboard 4.1, when the "allow_url_fopen" and "register_globals" variables are enabled, allows remote attackers to execute arbitrary PHP code by modifying the… | |
CVE-2002-1703 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in auction.cgi for Mewsoft NetAuction 3.0 allows remote attackers to execute arbitrary script as other users via the T… | |
CVE-2002-1702 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in DeltaScripts PHP Classifieds 6.0.5 allows remote attackers to execute arbitrary script as other users via the URL p… | |
CVE-2002-1700 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as oth… | |
CVE-2002-1699 | | 2002-12-31 | SQL injection vulnerability in ASP Client Check (ASPCC) 1.3 and 1.5 allows remote attackers to bypass authentication and gain unauthorized access via the passw… | |
CVE-2002-1698 | | 2002-12-31 | Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument i… | |
CVE-2002-1697 | High | 7.5 | 2002-12-31 | Electronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, whic… |
CVE-2002-1696 | Medium | 5.5 | 2002-12-31 | Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when o… |
CVE-2002-1695 | | 2002-12-31 | Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file… | |
CVE-2002-1694 | | 2002-12-31 | Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to mo… | |
CVE-2002-1692 | | 2002-12-31 | Buffer overflow in backup utility of Microsoft Windows 95 allows attackers to execute arbitrary code by causing a filename with a long extension to be placed i… | |
CVE-2002-1691 | | 2002-12-31 | Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attackers to gain unauthorized access. | |
CVE-2002-1690 | | 2002-12-31 | Unknown vulnerability in AIX before 4.0 with unknown attack vectors and unknown impact, aka "security issue," as fixed by APAR IY28225. | |
CVE-2002-1689 | | 2002-12-31 | Unknown vulnerability in the login program on AIX before 4.0 could allow remote users to specify 100 or more environment variables when logging on, which excee… | |
CVE-2002-1688 | | 2002-12-31 | The browser history feature in Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to execute arbitrary script as other users and steal authent… | |
CVE-2002-1687 | | 2002-12-31 | Buffer overflow in the diagnostics library in AIX allows local users to "cause data and instructions to be overwritten" via a long DIAGNOSTICS environment vari… | |
CVE-2002-1686 | | 2002-12-31 | Buffer overflow in lscfg of unknown versions of AIX has unknown impact. | |
CVE-2002-1685 | | 2002-12-31 | Cross-site scripting vulnerability (XSS) in BadBlue Enterprise Edition and Personal Edition 1.7 and 1.7.2 allows remote attackers to execute arbitrary script a… | |
CVE-2002-1684 | | 2002-12-31 | Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attacke… | |
CVE-2002-1683 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in BadBlue Personal Edition 1.7.3 allows remote attackers to execute arbitrary script as other users by injecting scri… | |
CVE-2002-1682 | Medium | 5.5 | 2002-12-31 | NewsReactor 1.0 uses a weak encryption scheme, which could allow local users to decrypt the passwords and gain access to other users' newsgroup accounts. |
CVE-2002-1681 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in Slashcode CVS releases June 17 through July 1 2002 allows remote attackers to execute arbitrary script as other use… | |
CVE-2002-1680 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in CGI Online Worldweb Shopping 1.1 (a.k.a. COWS) allows remote attackers to execute arbitrary script as other users b… | |
CVE-2002-1679 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 2.2.0 allows remote attackers to execute arbitrary script as other users by injecting script into… | |
CVE-2002-1678 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in memberlist.php in Jelsoft vBulletin 2.0 rc 2 through 2.2.4 allows remote attackers to steal authentication credenti… | |
CVE-2002-1677 | | 2002-12-31 | 14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, wh… | |
CVE-2002-1676 | | 2002-12-31 | BindView NetInventory 1.0, when used with NetRC 1.0, allows local users to read sensitive information (passwords) by deleting the HOSTCFG._NI file and forcing… | |
CVE-2002-1675 | | 2002-12-31 | Format string vulnerability in the Cio_PrintF function of cio_main.c in Unreal IRCd 3.1.1 allows remote attackers to cause a denial of service (crash) and poss… | |
CVE-2002-1674 | | 2002-12-31 | procfs on FreeBSD before 4.5 allows local users to cause a denial of service (kernel panic) by removing a file that the fstatfs function refers to. | |
CVE-2002-1673 | | 2002-12-31 | The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execu… | |
CVE-2002-1672 | | 2002-12-31 | Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's… | |
CVE-2002-1671 | | 2002-12-31 | Microsoft Internet Explorer 5.0, 5.01, and 5.5 allows remote attackers to monitor the contents of the clipboard via the getData method of the clipboardData obj… | |
CVE-2002-1670 | | 2002-12-31 | Microsoft Windows XP Professional upgrade edition overwrites previously installed patches for Internet Explorer 6.0, leaving Internet Explorer unpatched. | |
CVE-2002-1669 | | 2002-12-31 | pkg_add in FreeBSD 4.2 through 4.4 creates a temporary directory with world-searchable permissions, which may allow local users to modify world-writable parts… | |
CVE-2002-1668 | | 2002-12-31 | HP-UX 11.11 and earlier allows local users to cause a denial of service (kernel deadlock), due to a "file system weakness" that is possibly via an mmap() syste… | |
CVE-2002-1667 | | 2002-12-31 | The virtual memory management system in FreeBSD 4.5-RELEASE and earlier does not properly check the existence of a VM object during page invalidation, which al… | |
CVE-2002-1666 | | 2002-12-31 | Unknown vulnerability in Oracle E-Business Suite 11i.1 through 11i.6 allows remote attackers to execute unauthorized PL/SQL procedures by modifying the Oracle… | |
CVE-2002-1665 | | 2002-12-31 | Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a… | |
CVE-2002-1664 | | 2002-12-31 | Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensitive information. | |
CVE-2002-1663 | | 2002-12-31 | The Post_Method function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service (crash) via a POST request with a… | |
CVE-2002-1662 | | 2002-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11 allow remote attackers to execute arbitrary script on other clients via (1) sea… | |
CVE-2002-1661 | | 2002-12-31 | The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a denial of service (infinite loop) when leafnode requests a cross-posted art… | |
CVE-2002-1660 | | 2002-12-31 | calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter. | |
CVE-2002-1659 | | 2002-12-31 | user_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user_id variable. | |
CVE-2002-1658 | | 2002-12-31 | Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normal… | |
CVE-2002-1657 | High | 7.5 | 2002-12-31 | PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack. |
CVE-2002-1656 | | 2002-12-31 | X-News (x_news) 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via sniffing or the users.t… | |
CVE-2002-1655 | | 2002-12-31 | The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-h… | |
CVE-2002-1654 | | 2002-12-31 | iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-… | |
CVE-2002-1653 | | 2002-12-31 | Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encryption despite inte… | |
CVE-2002-1652 | | 2002-12-31 | Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long query… | |
CVE-2002-1651 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other… | |
CVE-2002-1650 | | 2002-12-31 | The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command… | |
CVE-2002-1649 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript… | |
CVE-2002-1648 | | 2002-12-31 | Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL… | |
CVE-2002-1647 | | 2002-12-31 | The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote… | |
CVE-2002-1646 | | 2002-12-31 | SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication sch… | |
CVE-2002-1636 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web scri… |