2002 CVEs (page 8)
Page 8 of 24 — CVEs published in 2002, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2002-1946 | Medium | 5.5 | 2002-12-31 | Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software 1.2.000, when the "Save Password" option is used, stores the password with a weak encryption sch… |
CVE-2002-1945 | | 2002-12-31 | Buffer overflow in SmartMail Server 1.0 Beta 10 allows remote attackers to cause a denial of service (crash) via a long request to (1) TCP port 25 (SMTP) or (2… | |
CVE-2002-1944 | | 2002-12-31 | Motorola Surfboard 4200 cable modem allows remote attackers to cause a denial of service (crash) by performing a SYN scan using a tool such as nmap. | |
CVE-2002-1943 | | 2002-12-31 | SafeTP 1.46, when network address translation (NAT) is being used, leaks the internal IP address of the FTP server in a response to a passive mode (PASV) file… | |
CVE-2002-1942 | | 2002-12-31 | Imatix Xitami 2.5 b5 does not properly terminate certain Keep-Alive connections that have been broken or closed early, which allows remote attackers to cause a… | |
CVE-2002-1941 | | 2002-12-31 | Buffer overflow in RadioBird WebServer 4 Everyone 1.28 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request with the Host h… | |
CVE-2002-1940 | | 2002-12-31 | LCC-Win32 3.2 compiler, when running on Windows 95, 98, or ME, writes portions of previously used memory after the import table, which could allow attackers to… | |
CVE-2002-1939 | | 2002-12-31 | FlashFXP 1.4 prints FTP passwords in plaintext when there are transfers in the queue, which allows attackers to obtain FTP passwords of other users by editing… | |
CVE-2002-1938 | | 2002-12-31 | Virgil CGI Scanner 0.9 allows remote attackers to execute arbitrary commands via the (1) tar (TARGET) or (2) zielport (ZIELPORT) parameters. | |
CVE-2002-1937 | | 2002-12-31 | Symantec Firewall/VPN Appliance 100 through 200R hardcodes the administrator's MAC address inside the firewall's configuration, which allows remote attackers t… | |
CVE-2002-1936 | | 2002-12-31 | UTStarcom BAS 1000 3.1.10 creates several default or back door accounts and passwords, which allows remote attackers to gain access via (1) field account with… | |
CVE-2002-1935 | | 2002-12-31 | Pingtel Xpressa 1.2.5 through 2.0.1 uses predictable (1) Call-ID, (2) CSeq, and (3) "To" and "From" SIP URL values in a Session Identification Protocol (SIP) r… | |
CVE-2002-1934 | | 2002-12-31 | Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 2.0.1 leaks sensitive information during boot-up, which allows attackers to obtain the MD5 hash of… | |
CVE-2002-1933 | | 2002-12-31 | The terminal services screensaver for Microsoft Windows 2000 does not automatically lock the terminal window if the window is minimized, which could allow loca… | |
CVE-2002-1932 | | 2002-12-31 | Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events (clear log manually)" option is set, does… | |
CVE-2002-1931 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in PHP Arena paFileDB 1.1.3 and 2.1.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in… | |
CVE-2002-1930 | | 2002-12-31 | Buffer overflow in AN HTTPd 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username. | |
CVE-2002-1929 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in pafiledb.php in PHP Arena paFileDB 1.1.3 through 3.0 allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2002-1928 | | 2002-12-31 | 602Pro LAN SUITE 2002 allows remote attackers to view the directory tree via an HTTP GET request with a trailing "~" (tilde) or ".bak" extension. | |
CVE-2002-1927 | | 2002-12-31 | Aquonics File Manager 1.5 allows users with edit privileges to modify user accounts by editing the userlist.cgi file. | |
CVE-2002-1926 | | 2002-12-31 | Directory traversal vulnerability in source.php in Aquonics File Manager 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP que… | |
CVE-2002-1925 | | 2002-12-31 | Tiny Personal Firewall 3.0 through 3.0.6 allows remote attackers to cause a denial of service (crash) by via SYN, UDP, ICMP and TCP portscans when the administ… | |
CVE-2002-1924 | | 2002-12-31 | PowerChute plus 5.0.2 creates a "Pwrchute" directory during installation that is shared and world writeable, which could allow remote attackers to modify or cr… | |
CVE-2002-1923 | | 2002-12-31 | The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows, does not have logging enabled, which could allow remote attackers to condu… | |
CVE-2002-1922 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in global.php in Jelsoft vBulletin 2.0.0 through 2.2.8 allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2002-1921 | | 2002-12-31 | The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote a… | |
CVE-2002-1920 | | 2002-12-31 | Buffer overflow in FtpXQ 2.5 allows remote attackers to cause a denial of service (crash) via a MKD command with a long directory name. | |
CVE-2002-1919 | | 2002-12-31 | SQL injection vulnerability in shopadmin.asp in VP-ASP 4.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user… | |
CVE-2002-1918 | | 2002-12-31 | Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown attack vec… | |
CVE-2002-1917 | | 2002-12-31 | CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injec… | |
CVE-2002-1916 | | 2002-12-31 | Pirch and RusPirch, when auto-log is enabled, allows remote attackers to cause a denial of service (crash) via a nickname containing an MS-DOS device name such… | |
CVE-2002-1915 | Medium | 5.5 | 2002-12-31 | tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculo… |
CVE-2002-1914 | Medium | 5.5 | 2002-12-31 | dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file. |
CVE-2002-1913 | | 2002-12-31 | phptonuke.php in myPHPNuke 1.8.8 allows remote attackers to read arbitrary files via a full pathname in the filnavn variable. | |
CVE-2002-1912 | High | 7.5 | 2002-12-31 | SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Ethernet interface when the buffers are full, which allows remote attackers to cause a… |
CVE-2002-1911 | | 2002-12-31 | ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large… | |
CVE-2002-1910 | High | 7.5 | 2002-12-31 | Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), which allows attackers to obtain passwor… |
CVE-2002-1909 | | 2002-12-31 | Click2Learn Ingenium Learning Management System 5.1 and 6.1 stores the hashed administrative password in a config.txt file under the htdocs directory, which al… | |
CVE-2002-1908 | | 2002-12-31 | Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large n… | |
CVE-2002-1907 | | 2002-12-31 | TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request. | |
CVE-2002-1906 | | 2002-12-31 | The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) by sending incomplete HTTP requests and… | |
CVE-2002-1905 | | 2002-12-31 | Buffer overflow in the web server of Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request. | |
CVE-2002-1904 | | 2002-12-31 | Buffer overflow in the Log function in util.c in GazTek ghttpd 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long HTTP GET request. | |
CVE-2002-1903 | | 2002-12-31 | Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information. | |
CVE-2002-1902 | | 2002-12-31 | CGIForum 1.0 through 1.05 allows remote attackers to cause a denial of service (infinite recursion) by creating a message board post that is a child of an outd… | |
CVE-2002-1901 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in Bodo Bauer BBGallery 1.0 allows remote attackers to inject arbitrary web script or HTML via image tags. | |
CVE-2002-1900 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists. | |
CVE-2002-1899 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in IceWarp Web Mail 3.3.3 and 3.4.5 allows remote attackers to inject arbitrary web script or HTML via the "Full Name"… | |
CVE-2002-1898 | | 2002-12-31 | Terminal 1.3 in Apple Mac OS X 10.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link, which is executed by Te… | |
CVE-2002-1897 | | 2002-12-31 | MyWebServer LLC MyWebServer 1.0.2 allows remote attackers to cause a denial of service (crash) via a long HTTP request, possibly triggering a buffer overflow. | |
CVE-2002-1896 | | 2002-12-31 | Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argume… | |
CVE-2002-1895 | | 2002-12-31 | The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash… | |
CVE-2002-1894 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in viewtopic.php in phpBB 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the highlight param… | |
CVE-2002-1893 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in ArGoSoft Mail Server Pro 1.8.1.9 allows remote attackers to inject arbitrary web script or HTML via the e-mail mess… | |
CVE-2002-1892 | | 2002-12-31 | NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local u… | |
CVE-2002-1891 | | 2002-12-31 | Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request. | |
CVE-2002-1890 | | 2002-12-31 | rhmask 1.0-9 in Red Hat Linux 7.1 allows local users to overwrite arbitrary files via a symlink attack on the mask file. | |
CVE-2002-1889 | | 2002-12-31 | Off-by-one buffer overflow in the context_action function in context.c of Logsurfer 1.41 through 1.5a allows remote attackers to cause a denial of service (cra… | |
CVE-2002-1888 | | 2002-12-31 | CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allo… | |
CVE-2002-1887 | | 2002-12-31 | PHP remote file inclusion vulnerability in customize.php for phpMyNewsletter 0.6.10 allows remote attackers to execute arbitrary PHP code via the l parameter. | |
CVE-2002-1886 | | 2002-12-31 | TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain the database username… | |
CVE-2002-1885 | | 2002-12-31 | PHP remote file inclusion vulnerability in showhits.php3 for PowerPhlogger (PPhlogger) 2.0.9 through 2.2.2 allows remote attackers to execute arbitrary PHP cod… | |
CVE-2002-1884 | | 2002-12-31 | index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin". | |
CVE-2002-1883 | | 2002-12-31 | Trolltech Qt Assistant 1.0 in Trolltech Qt 3.0.3, when loaded from the Designer, opens port 7358 for interprocess communication, which allows remote attackers… | |
CVE-2002-1882 | | 2002-12-31 | Unknown vulnerability in AolSecurityPrivate.class in Oracle E-Business Suite 11i 11.1 through 11.6 allows remote attackers to bypass user authentication checks… | |
CVE-2002-1881 | | 2002-12-31 | Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service (web browser crash) via malformed content in a Flash Shoc… | |
CVE-2002-1880 | | 2002-12-31 | LokwaBB 1.2.2 allows remote attackers to read arbitrary messages by modifying the pmid parameter to pm.php. | |
CVE-2002-1879 | | 2002-12-31 | SQL injection vulnerability in LokwaBB 1.2.2 allows remote attackers to execute arbitrary SQL commands via the (1) member parameter to member.php or (2) loser… | |
CVE-2002-1878 | | 2002-12-31 | PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the inc_dir parameter. | |
CVE-2002-1877 | | 2002-12-31 | NETGEAR FM114P allows remote attackers to bypass access restrictions for web sites via a URL that uses the IP address instead of the hostname. | |
CVE-2002-1876 | | 2002-12-31 | Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the lice… | |
CVE-2002-1875 | | 2002-12-31 | Entercept Agent 2.5 agent for Windows, released before May 21, 2002, allows local administrative users to obtain the entercept agent password, which could allo… | |
CVE-2002-1874 | | 2002-12-31 | astrocam.cgi in AstroCam 0.9-1-1 through 1.4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request. NOTE: earlie… | |
CVE-2002-1873 | | 2002-12-31 | Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumpt… | |
CVE-2002-1872 | High | 7.5 | 2002-12-31 | Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt… |
CVE-2002-1871 | | 2002-12-31 | pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" (question mark) in the (1) mode, (2) owner, or (3) gr… | |
CVE-2002-1870 | | 2002-12-31 | Simple Web Server (SWS) 0.0.4 through 0.1.0 does not properly handle when the recv function call fails, which may allow remote attackers to overwrite program d… | |
CVE-2002-1869 | Low | 3.3 | 2002-12-31 | Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent event… |
CVE-2002-1868 | | 2002-12-31 | Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields. | |
CVE-2002-1867 | | 2002-12-31 | The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an… | |
CVE-2002-1866 | | 2002-12-31 | Simple Web Server (SWS) 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages, which could allow remote attackers to cause a denial of ser… | |
CVE-2002-1865 | | 2002-12-31 | Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.56b5 and (2) Linksys Etherfast BEFW11S4 Wireless… | |
CVE-2002-1864 | | 2002-12-31 | Directory traversal vulnerability in Simple Web Server (SWS) 0.0.4 through 0.1.0 allows remote attackers to read arbitrary files via a ".." (dot dot) in an HTT… | |
CVE-2002-1863 | | 2002-12-31 | Iomega Network Attached Storage (NAS) A300U, and possibly other models, does not allow the FTP service to be disabled, which allows local users to access home… | |
CVE-2002-1862 | | 2002-12-31 | SmartMail Server 2.0 allows remote attackers to cause a denial of service (crash) by sending data and closing the connection before all the data has been sent. | |
CVE-2002-1861 | | 2002-12-31 | Sybase Enterprise Application Server 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java clas… | |
CVE-2002-1860 | | 2002-12-31 | Pramati Server 3.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configurat… | |
CVE-2002-1859 | | 2002-12-31 | Orion Application Server 1.5.3, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files an… | |
CVE-2002-1858 | | 2002-12-31 | Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF direc… | |
CVE-2002-1857 | | 2002-12-31 | jo! jo Webserver 1.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configur… | |
CVE-2002-1856 | | 2002-12-31 | HP Application Server 8.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and con… | |
CVE-2002-1855 | | 2002-12-31 | Macromedia JRun 3.0 through 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files a… | |
CVE-2002-1854 | | 2002-12-31 | Rlaj whois CGI script (whois.cgi) 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field. | |
CVE-2002-1853 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in MyNewsGroups 0.4 and 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the subject of a news… | |
CVE-2002-1852 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in Monkey 0.5.0 allows remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) a parameter to t… | |
CVE-2002-1851 | | 2002-12-31 | Buffer overflow in WS_FTP Pro 7.5 allows remote attackers to execute code on a client system via unknown attack vectors. | |
CVE-2002-1850 | High | 7.5 | 2002-12-31 | mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CG… |
CVE-2002-1849 | | 2002-12-31 | ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly loggi… | |
CVE-2002-1848 | | 2002-12-31 | TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which could allow local use… | |
CVE-2002-1847 | | 2002-12-31 | Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 fil… |