2002 CVEs (page 19)
Page 19 of 24 — CVEs published in 2002, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2002-0411 | | 2002-08-12 | Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email messa… | |
CVE-2002-0391 | Critical | 9.8 | 2002-08-12 | Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remo… |
CVE-2002-1616 | | 2002-08-01 | Multiple buffer overflows in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allow local users to gain root privileges via (1) su, (2) chsh, (3) passwd, (4) chfn… | |
CVE-2002-1446 | | 2002-08-01 | The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later returns the CKR_OK status… | |
CVE-2002-1450 | | 2002-07-31 | IBM UniVerse with UV/ODBC allows attackers to cause a denial of service (client crash or server CPU consumption) via a query with an invalid link between table… | |
CVE-2002-1449 | | 2002-07-31 | eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by readi… | |
CVE-2002-0717 | | 2002-07-26 | PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in… | |
CVE-2002-0716 | | 2002-07-26 | Format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 allows local users to gain privileges via format string specifiers in the file name a… | |
CVE-2002-0715 | | 2002-07-26 | Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password. | |
CVE-2002-0714 | | 2002-07-26 | FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to b… | |
CVE-2002-0713 | | 2002-07-26 | Buffer overflows in Squid before 2.4.STABLE6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code (1) via the MSNT a… | |
CVE-2002-0704 | High | 7.5 | 2002-07-26 | The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error messages. |
CVE-2002-0703 | | 2002-07-26 | An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prevent a system from p… | |
CVE-2002-0702 | | 2002-07-26 | Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE option enabled… | |
CVE-2002-0663 | | 2002-07-26 | Buffer overflow in HTTP Proxy for Symantec Norton Personal Internet Firewall 3.0.4.91 and Norton Internet Security 2001 allows remote attackers to cause a deni… | |
CVE-2002-0450 | | 2002-07-26 | Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webp… | |
CVE-2002-0449 | | 2002-07-26 | Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to webplus.exe program… | |
CVE-2002-0448 | | 2002-07-26 | Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request that contains many "C:/" sequences. | |
CVE-2002-0447 | | 2002-07-26 | Directory traversal vulnerability in Xerver Free Web Server 2.10 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in an HTT… | |
CVE-2002-0446 | | 2002-07-26 | categorie.php3 in Black Tie Project (BTP) 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an invalid category ID… | |
CVE-2002-0445 | | 2002-07-26 | article.php in PHP FirstPost 0.1 allows allows remote attackers to obtain the full pathname of the server via an invalid post number in the post parameter, whi… | |
CVE-2002-0444 | | 2002-07-26 | Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the… | |
CVE-2002-0443 | | 2002-07-26 | Microsoft Windows 2000 allows local users to bypass the policy that prohibits reusing old passwords by changing the current password before it expires, which d… | |
CVE-2002-0442 | | 2002-07-26 | Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges. | |
CVE-2002-0441 | | 2002-07-26 | Directory traversal vulnerability in imlist.php for Php Imglist allows remote attackers to read arbitrary code via a .. (dot dot) in the cwd parameter. | |
CVE-2002-0440 | | 2002-07-26 | Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web servers to bypass conten… | |
CVE-2002-0439 | | 2002-07-26 | Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript and steal… | |
CVE-2002-0438 | | 2002-07-26 | ZyXEL ZyWALL 10 before 3.50 allows remote attackers to cause a denial of service via an ARP packet with the firewall's IP address and an incorrect MAC address… | |
CVE-2002-0437 | | 2002-07-26 | Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, a… | |
CVE-2002-0436 | | 2002-07-26 | sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address p… | |
CVE-2002-0435 | | 2002-07-26 | Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local users to delete di… | |
CVE-2002-0434 | | 2002-07-26 | Marcus S. Xenakis directory.php script allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter. | |
CVE-2002-0433 | | 2002-07-26 | Pi3Web 2.0.0 allows remote attackers to view restricted files via an HTTP request containing a "*" (wildcard or asterisk) character. | |
CVE-2002-0432 | | 2002-07-26 | Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and poss… | |
CVE-2002-0431 | | 2002-07-26 | XTux allows remote attackers to cause a denial of service (CPU consumption) via random inputs in the initial connection. | |
CVE-2002-0410 | | 2002-07-26 | send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that… | |
CVE-2002-0409 | | 2002-07-26 | orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the… | |
CVE-2002-0408 | | 2002-07-26 | htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of t… | |
CVE-2002-0407 | | 2002-07-26 | htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain cert… | |
CVE-2002-0406 | | 2002-07-26 | Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server without… | |
CVE-2002-0405 | | 2002-07-26 | Buffer overflow in Transsoft Broker FTP Server 5.0 evaluation allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CW… | |
CVE-2002-0398 | | 2002-07-26 | Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name. | |
CVE-2002-0397 | | 2002-07-26 | Red-M 1050 (Bluetooth Access Point) publicizes its name, IP address, and other information in UDP packets to a broadcast address, which allows any system on th… | |
CVE-2002-0396 | | 2002-07-26 | The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, which allows attackers to conne… | |
CVE-2002-0395 | | 2002-07-26 | The TFTP server for Red-M 1050 (Bluetooth Access Point) can not be disabled and makes it easier for remote attackers to crack the administration password via b… | |
CVE-2002-0394 | | 2002-07-26 | Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the sm… | |
CVE-2002-0393 | | 2002-07-26 | Buffer overflow in Red-M 1050 (Bluetooth Access Point) management web interface allows remote attackers to cause a denial of service and possibly execute arbit… | |
CVE-2002-0369 | | 2002-07-26 | Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that… | |
CVE-2002-0358 | | 2002-07-26 | MediaMail and MediaMail Pro in SGI IRIX 6.5.16 and earlier allows local users to force the program to dump core via certain arguments, which could allow the us… | |
CVE-2002-0032 | | 2002-07-26 | Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI. | |
CVE-2002-0031 | | 2002-07-26 | Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long arguments to (1) call… | |
CVE-2002-0014 | | 2002-07-26 | URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metac… | |
CVE-2002-1599 | | 2002-07-23 | DansGuardian before 2.4.5-1 allows remote attackers to bypass content filtering rules via hex-encoded URLs. | |
CVE-2002-0701 | | 2002-07-23 | ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which… | |
CVE-2002-0688 | | 2002-07-23 | ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitra… | |
CVE-2002-0687 | | 2002-07-23 | The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers. | |
CVE-2002-0686 | | 2002-07-23 | Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a lon… | |
CVE-2002-0685 | | 2002-07-23 | Heap-based buffer overflow in the message decoding functionality for PGP Outlook Encryption Plug-In, as used in NAI PGP Desktop Security 7.0.4, Personal Securi… | |
CVE-2002-0683 | | 2002-07-23 | Directory traversal vulnerability in Carello 1.3 allows remote attackers to execute programs on the server via a .. (dot dot) in the VBEXE parameter. | |
CVE-2002-0682 | | 2002-07-23 | Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ m… | |
CVE-2002-0681 | | 2002-07-23 | Cross-site scripting vulnerability in GoAhead Web Server 2.1 allows remote attackers to execute script as other web users via script in a URL that generates a… | |
CVE-2002-0680 | | 2002-07-23 | Directory traversal vulnerability in GoAhead Web Server 2.1 allows remote attackers to read arbitrary files via a URL with an encoded / (%5C) in a .. (dot dot)… | |
CVE-2002-0678 | | 2002-07-23 | CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRAN… | |
CVE-2002-0677 | | 2002-07-23 | CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file… | |
CVE-2002-0675 | | 2002-07-23 | Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not require administrative privileges to perform a firmware upgrade, which allows unau… | |
CVE-2002-0674 | | 2002-07-23 | Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not "time out" an inactive administrator session, which could allow other users to per… | |
CVE-2002-0673 | | 2002-07-23 | The enrollment process for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to the phone to log out th… | |
CVE-2002-0672 | | 2002-07-23 | Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to restore the phone to factory defaults without auth… | |
CVE-2002-0671 | Critical | 9.8 | 2002-07-23 | Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applic… |
CVE-2002-0670 | | 2002-07-23 | The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentica… | |
CVE-2002-0668 | | 2002-07-23 | The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to modify the Call Forwarding settings and… | |
CVE-2002-0667 | | 2002-07-23 | Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain acces… | |
CVE-2002-0643 | | 2002-07-23 | The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete t… | |
CVE-2002-0642 | | 2002-07-23 | The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000… | |
CVE-2002-0641 | | 2002-07-23 | Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with databas… | |
CVE-2002-0624 | | 2002-07-23 | Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote atta… | |
CVE-2002-0676 | | 2002-07-11 | SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by… | |
CVE-2002-0665 | | 2002-07-11 | Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL. | |
CVE-2002-0653 | High | 7.8 | 2002-07-11 | Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows loca… |
CVE-2002-0637 | | 2002-07-11 | InterScan VirusWall 3.52 build 1462 allows remote attackers to bypass virus protection via e-mail messages with headers that violate RFC specifications by havi… | |
CVE-2002-1448 | | 2002-07-08 | An undocumented SNMP read/write community string ('NoGaH$@!') in Avaya P330, P130, and M770-ATM Cajun products allows remote attackers to gain administrative p… | |
CVE-2002-0652 | | 2002-07-03 | xfsmd for IRIX 6.5 through 6.5.16 allows remote attackers to execute arbitrary code via shell metacharacters that are not properly filtered from several calls… | |
CVE-2002-0651 | | 2002-07-03 | Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of s… | |
CVE-2002-0640 | | 2002-07-03 | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge resp… | |
CVE-2002-0639 | Critical | 9.8 | 2002-07-03 | Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResp… |
CVE-2002-0631 | | 2002-07-03 | Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges. | |
CVE-2002-0623 | | 2002-07-03 | Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via long authentication… | |
CVE-2002-0622 | | 2002-07-03 | The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as inp… | |
CVE-2002-0621 | | 2002-07-03 | Buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000 allows remote attackers to cause the process to fai… | |
CVE-2002-0620 | | 2002-07-03 | Buffer overflow in the Profile Service of Microsoft Commerce Server 2000 allows remote attackers to cause the server to fail or run arbitrary code in the Local… | |
CVE-2002-0615 | | 2002-07-03 | The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well known location on the local file system, allowing attacker… | |
CVE-2002-0574 | | 2002-07-03 | Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that trigger a bug in ip_… | |
CVE-2002-0573 | | 2002-07-03 | Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in… | |
CVE-2002-0572 | | 2002-07-03 | FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the file descr… | |
CVE-2002-0571 | | 2002-07-03 | Oracle Oracle9i database server 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax. | |
CVE-2002-0570 | | 2002-07-03 | The encrypted loop device in Linux kernel 2.4.10 and earlier does not authenticate the entity that is encrypting data, which allows local users to modify encry… | |
CVE-2002-0569 | | 2002-07-03 | Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet (XSQLServle… | |
CVE-2002-0568 | | 2002-07-03 | Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames… | |
CVE-2002-0567 | | 2002-07-03 | Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrary functions by usin… | |
CVE-2002-0566 | | 2002-07-03 | PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Authorization header w… |