2002 CVEs (page 22)
Page 22 of 24 — CVEs published in 2002, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2002-0260 | | 2002-05-29 | Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, which is not properly h… | |
CVE-2002-0259 | | 2002-05-29 | InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache directory, or (2) m… | |
CVE-2002-0258 | | 2002-05-29 | Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access… | |
CVE-2002-0257 | | 2002-05-29 | Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fie… | |
CVE-2002-0256 | | 2002-05-29 | The telnet port in Arescom NetDSL 1000 router allows remote attackers to cause a denial of service via a series of connections with long strings, which causes… | |
CVE-2002-0255 | | 2002-05-29 | The default configuration of Arescom NetDSL 800 does not require authentication, which allows remote attackers to cause a denial of service or reconfigure the… | |
CVE-2002-0254 | | 2002-05-29 | ICQ 2001b Build 3659 allows remote attackers to cause a denial of service (crash) via a malformed picture that contains large height and width values, which ca… | |
CVE-2002-0253 | | 2002-05-29 | PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trai… | |
CVE-2002-0252 | | 2002-05-29 | Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME… | |
CVE-2002-0251 | | 2002-05-29 | Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string of… | |
CVE-2002-0250 | | 2002-05-29 | Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authenti… | |
CVE-2002-0249 | | 2002-05-29 | PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a requ… | |
CVE-2002-0248 | | 2002-05-29 | wmtv 0.6.5 and earlier allows local users to modify arbitrary files via a symlink attack on a configuration file. | |
CVE-2002-0247 | | 2002-05-29 | Buffer overflows in wmtv 0.6.5 and earlier may allow local users to gain privileges. | |
CVE-2002-0246 | | 2002-05-29 | Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying the LC_MESSAGE enviro… | |
CVE-2002-0245 | | 2002-05-29 | Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a nonexistent file w… | |
CVE-2002-0244 | | 2002-05-29 | Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir. | |
CVE-2002-0243 | | 2002-05-29 | Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from th… | |
CVE-2002-0242 | | 2002-05-29 | Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output f… | |
CVE-2002-0241 | | 2002-05-29 | NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (N… | |
CVE-2002-0240 | | 2002-05-29 | PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server… | |
CVE-2002-0239 | | 2002-05-29 | Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) -hfn argument. | |
CVE-2002-0238 | | 2002-05-29 | Cross-site scripting vulnerability in web administration interface for NetGear RT314 and RT311 Gateway Routers allows remote attackers to execute arbitrary scr… | |
CVE-2002-0237 | | 2002-05-29 | Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to caus… | |
CVE-2002-0236 | | 2002-05-29 | Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct H… | |
CVE-2002-0235 | | 2002-05-29 | Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by sub… | |
CVE-2002-0234 | | 2002-05-29 | NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trusted network to cause… | |
CVE-2002-0233 | | 2002-05-29 | Directory traversal vulnerability in eshare Expressions 4 Web server allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request. | |
CVE-2002-0232 | | 2002-05-29 | Directory traversal vulnerability in Multi Router Traffic Grapher (MRTG) allows remote attackers to read portions of arbitrary files via a .. (dot dot) in the… | |
CVE-2002-0193 | | 2002-05-29 | Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that… | |
CVE-2002-0191 | | 2002-05-29 | Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script containing the cssText… | |
CVE-2002-0190 | | 2002-05-29 | Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that… | |
CVE-2002-0189 | | 2002-05-29 | Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a loc… | |
CVE-2002-0188 | | 2002-05-29 | Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that… | |
CVE-2002-0178 | | 2002-05-29 | uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could… | |
CVE-2002-0174 | | 2002-05-29 | nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file. | |
CVE-2002-0169 | | 2002-05-29 | The default stylesheet for DocBook on Red Hat Linux 6.2 through 7.2 is installed with an insecure option enabled, which could allow users to overwrite files ou… | |
CVE-2002-0155 | | 2002-05-29 | Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attacker… | |
CVE-2002-0033 | | 2002-05-29 | Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory an… | |
CVE-2002-1447 | | 2002-05-28 | Buffer overflow in the vpnclient program for UNIX VPN Client before 3.5.2 allows local users to gain administrative privileges via a long profile name in a con… | |
CVE-2002-1641 | | 2002-05-27 | Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server (9iAS) allow remote attackers to execute arbitrary code via unknown vectors. | |
CVE-2002-1280 | | 2002-05-17 | Memory leak in RealSecure Event Collector 6.5 allows attackers to cause a denial of service (memory consumption and crash). | |
CVE-2002-1056 | | 2002-05-16 | Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages i… | |
CVE-2002-0231 | | 2002-05-16 | Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname. | |
CVE-2002-0230 | | 2002-05-16 | Cross-site scripting vulnerability in fom.cgi of Faq-O-Matic 2.712 allows remote attackers to execute arbitrary Javascript on other clients via the cmd paramet… | |
CVE-2002-0229 | | 2002-05-16 | Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbi… | |
CVE-2002-0228 | | 2002-05-16 | Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and w… | |
CVE-2002-0227 | | 2002-05-16 | KICQ 2.0.0b1 allows remote attackers to cause a denial of service (crash) via a malformed message. | |
CVE-2002-0226 | | 2002-05-16 | retrieve_password.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to request a new password… | |
CVE-2002-0225 | | 2002-05-16 | tac_plus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and writable permissions… | |
CVE-2002-0224 | | 2002-05-16 | The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows… | |
CVE-2002-0223 | | 2002-05-16 | Infopop UBB.Threads 5.4 and Wired Community Software WWWThreads 5.0 through 5.0.9 allows remote attackers to upload arbitrary files by using a filename that co… | |
CVE-2002-0222 | | 2002-05-16 | Etype Eserv 2.97 allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command. | |
CVE-2002-0221 | | 2002-05-16 | Etype Eserv 2.97 allows remote attackers to cause a denial of service (resource exhaustion) via a large number of PASV commands that consume ports 1024 through… | |
CVE-2002-0220 | | 2002-05-16 | phpsmssend.php in PhpSmsSend 1.0 allows remote attackers to execute arbitrary commands via an SMS message containing shell metacharacters. | |
CVE-2002-0219 | | 2002-05-16 | Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code… | |
CVE-2002-0218 | | 2002-05-16 | Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute ar… | |
CVE-2002-0217 | | 2002-05-16 | Cross-site scripting (CSS) vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients vi… | |
CVE-2002-0216 | | 2002-05-16 | userinfo.php in XOOPS 1.0 RC1 allows remote attackers to obtain sensitive information via a SQL injection attack in the "uid" parameter. | |
CVE-2002-0215 | | 2002-05-16 | Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the full pathname of the agora.cgi file by requesting a non-existent .html… | |
CVE-2002-0214 | | 2002-05-16 | Compaq Intel PRO/Wireless 2011B LAN USB Device Driver 1.5.16.0 through 1.5.18.0 stores the 128-bit WEP (Wired Equivalent Privacy) key in plaintext in a registr… | |
CVE-2002-0213 | | 2002-05-16 | xkas in Xinet K-AShare 0.011.01 for IRIX allows local users to read arbitrary files via a symlink attack on the VOLICON file, which is copied to the .HSicon fi… | |
CVE-2002-0212 | | 2002-05-16 | The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to… | |
CVE-2002-0211 | | 2002-05-16 | Race condition in the installation script for Tarantella Enterprise 3 3.01 through 3.20 creates a world-writeable temporary "gunzip" program before executing i… | |
CVE-2002-0210 | | 2002-05-16 | setlicense for TOLIS Group Backup and Restore Utility (BRU) 17.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/brutest.$$ te… | |
CVE-2002-0209 | | 2002-05-16 | Nortel Alteon ACEdirector WebOS 9.0, with the Server Load Balancing (SLB) and Cookie-Based Persistence features enabled, allows remote attackers to determine t… | |
CVE-2002-0208 | | 2002-05-16 | PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows remote attackers to dete… | |
CVE-2002-0207 | | 2002-05-16 | Buffer overflow in Real Networks RealPlayer 8.0 and earlier allows remote attackers to execute arbitrary code via a header length value that exceeds the actual… | |
CVE-2002-0206 | | 2002-05-16 | index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by speci… | |
CVE-2002-0205 | | 2002-05-16 | Cross-site scripting (CSS) vulnerability in error.asp for Plumtree Corporate Portal 3.5 through 4.5 allows remote attackers to execute arbitrary script on othe… | |
CVE-2002-0204 | | 2002-05-16 | Buffer overflow in GNU Chess (gnuchess) 5.02 and earlier, if modified or used in a networked capacity contrary to its own design as a single-user application… | |
CVE-2002-0203 | | 2002-05-16 | ttawebtop.cgi in Tarantella Enterprise 3.20 on SPARC Solaris and Linux, and 3.1x and 3.0x including 3.11.903, allows remote attackers to view directory content… | |
CVE-2002-0202 | | 2002-05-16 | PaintBBS 1.2 installs certain files and directories with insecure permissions, which allows local users to (1) obtain the encrypted server password via the wor… | |
CVE-2002-0201 | | 2002-05-16 | Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET reque… | |
CVE-2002-0200 | | 2002-05-16 | Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name. | |
CVE-2002-0199 | | 2002-05-16 | Buffer overflow in admin.cgi for Nullsoft Shoutcast Server 1.8.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a… | |
CVE-2002-0198 | | 2002-05-16 | Buffer overflow in plDaniels ripMime 1.2.6 and earlier, as used in other programs such as xamime and inflex, allows remote attackers to execute arbitrary code… | |
CVE-2002-0197 | | 2002-05-16 | psyBNC 2.3 beta and earlier allows remote attackers to spoof encrypted, trusted messages by sending lines that begin with the "[B]" sequence, which makes the m… | |
CVE-2002-0196 | | 2002-05-16 | GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or wri… | |
CVE-2002-0185 | | 2002-05-16 | mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attac… | |
CVE-2002-0184 | High | 7.8 | 2002-05-16 | Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special c… |
CVE-2002-0173 | | 2002-05-16 | Buffer overflow in cpr for the eoe.sw.cpr SGI Checkpoint-Restart Software package on SGI IRIX 6.5.10 and earlier may allow local users to gain root privileges. | |
CVE-2002-0172 | | 2002-05-16 | /dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions (644), which could allow a local user to cause a denial of service… | |
CVE-2002-0171 | | 2002-05-16 | IRISconsole 2.0 may allow users to log into the icadmin account with an incorrect password in some circumstances, which could allow users to gain privileges. | |
CVE-2002-0157 | | 2002-05-16 | Nautilus 1.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the .nautilus-metafile.xml metadata file. | |
CVE-2002-0154 | | 2002-05-16 | Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary c… | |
CVE-2002-1592 | | 2002-05-06 | The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full pa… | |
CVE-2002-1602 | | 2002-04-23 | Buffer overflow in the Braille module for GNU screen 3.9.11, when HAVE_BRAILLE is defined, allows local users to execute arbitrary code. | |
CVE-2002-1621 | | 2002-04-22 | Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code. | |
CVE-2002-0181 | | 2002-04-22 | Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of ot… | |
CVE-2002-0180 | | 2002-04-22 | Buffer overflow in Webalizer 2.01-06, when configured to use reverse DNS lookups, allows remote attackers to execute arbitrary code by connecting to the monito… | |
CVE-2002-0179 | | 2002-04-22 | Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code. | |
CVE-2002-0177 | | 2002-04-22 | Buffer overflows in icecast 1.3.11 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client. | |
CVE-2002-0176 | | 2002-04-22 | The printf wrappers in libsafe 2.0-11 and earlier do not properly handle argument indexing specifiers, which could allow attackers to exploit certain function… | |
CVE-2002-0175 | | 2002-04-22 | libsafe 2.0-11 and earlier allows attackers to bypass protection against format string vulnerabilities via format strings that use the "'" and "I" characters… | |
CVE-2002-0170 | | 2002-04-22 | Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the… | |
CVE-2002-0168 | | 2002-04-22 | Vulnerability in Imlib before 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments that a… | |
CVE-2002-0167 | | 2002-04-22 | Imlib before 1.9.13 sometimes uses the NetPBM package to load trusted images, which could allow attackers to cause a denial of service (crash) and possibly exe… | |
CVE-2002-0166 | | 2002-04-22 | Cross-site scripting vulnerability in analog before 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is ente… | |
CVE-2002-0160 | | 2002-04-22 | The administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers… |