| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2002-1403 | 0.00 | — | 0.00 | Jan 17, 2003 | dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script. | |||
| CVE-2003-0001 | 0.09 | — | 0.73 | Jan 17, 2003 | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. | |||
| CVE-2003-0012 | 0.00 | — | 0.00 | Jan 17, 2003 | The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data. | |||
| CVE-2003-0013 | 0.00 | — | 0.02 | Jan 17, 2003 | The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a… | |||
| CVE-2003-0025 | 0.02 | — | 0.24 | Jan 17, 2003 | Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3. | |||
| CVE-2003-0026 | 0.02 | — | 0.19 | Jan 17, 2003 | Multiple stack-based buffer overflows in the error handling routines of the minires library, as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10, allow remote attackers to execute arbitrary code via a DHCP message containing a long hostname. | |||
| CVE-2003-0031 | 0.00 | — | 0.02 | Jan 17, 2003 | Multiple buffer overflows in libmcrypt before 2.5.5 allow attackers to cause a denial of service (crash). | |||
| CVE-2003-0032 | 0.00 | — | 0.02 | Jan 17, 2003 | Memory leak in libmcrypt before 2.5.5 allows attackers to cause a denial of service (memory exhaustion) via a large number of requests to the application, which causes libmcrypt to dynamically load algorithms via libtool. | |||
| CVE-2003-0014 | 0.00 | — | 0.00 | Jan 11, 2003 | gsinterf.c in bmv 1.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2002-0626 | 0.00 | — | 0.02 | Jan 7, 2003 | Polycom ViewStation before 7.2.4 has a default null password for the administrator account, which allows arbitrary users to conduct unauthorized activities. | |||
| CVE-2002-0627 | 0.00 | — | 0.02 | Jan 7, 2003 | The Web server for Polycom ViewStation before 7.2.4 allows remote attackers to bypass authentication and read files via Unicode encoded requests. | |||
| CVE-2002-0628 | Hig | 0.49 | 7.5 | 0.02 | Jan 7, 2003 | The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack. | ||
| CVE-2002-0629 | 0.00 | — | 0.02 | Jan 7, 2003 | The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via multiple connections to the server. | |||
| CVE-2002-0630 | 0.00 | — | 0.02 | Jan 7, 2003 | The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via long or malformed ICMP packets. | |||
| CVE-2003-1071 | 0.03 | — | 0.01 | Jan 3, 2003 | rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header. | |||
| CVE-2002-1378 | 0.01 | — | 0.07 | Jan 2, 2003 | Multiple buffer overflows in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allow remote attackers to execute arbitrary code via (1) long -t or -r parameters to slurpd, (2) a malicious ldapfilter.conf file that is not properly handled by getfilter functions, (3) a malicious… | |||
| CVE-2002-1379 | 0.00 | — | 0.03 | Jan 2, 2003 | OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges. | |||
| CVE-2002-1384 | 0.00 | — | 0.01 | Jan 2, 2003 | Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf. | |||
| CVE-2002-1386 | 0.00 | — | 0.00 | Jan 2, 2003 | Buffer overflow in traceroute-nanog (aka traceroute-ng) may allow local users to execute arbitrary code via a long hostname argument. | |||
| CVE-2002-1387 | 0.00 | — | 0.00 | Jan 2, 2003 | The spray mode in traceroute-nanog (aka traceroute-ng) may allow local users to overwrite arbitrary memory locations via an array index overflow using the nprobes (number of probes) argument. | |||
| CVE-2002-1388 | 0.00 | — | 0.01 | Jan 2, 2003 | Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages. | |||
| CVE-2002-1389 | 0.00 | — | 0.00 | Jan 2, 2003 | Buffer overflow in typespeed 0.4.2 and earlier allows local users to gain privileges via long input. | |||
| CVE-2002-1571 | 0.00 | — | 0.00 | Dec 31, 2002 | The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on processors that do not clear all relevant SSE registers. | |||
| CVE-2002-1572 | 0.00 | — | 0.02 | Dec 31, 2002 | Signed integer overflow in the bttv_read function in the bttv driver (bttv-driver.c) in Linux kernel before 2.4.20 has unknown impact and attack vectors. | |||
| CVE-2002-1573 | 0.00 | — | 0.02 | Dec 31, 2002 | Unspecified vulnerability in the pcilynx ieee1394 firewire driver (pcilynx.c) in Linux kernel before 2.4.20 has unknown impact and attack vectors, related to "wrap handling." | |||
| CVE-2002-1617 | 0.00 | — | 0.01 | Dec 31, 2002 | Multiple buffer overflows in HP Tru64 UNIX 5.x allow local users to execute arbitrary code via (1) a long -contextDir argument to dtaction, (2) a long -p argument to dtprintinfo, (3) a long -customization argument to dxterm, or (4) a long DISPLAY environment variable to dtterm. | |||
| CVE-2002-1622 | 0.00 | — | 0.03 | Dec 31, 2002 | Buffer overflow in certain RPC routines in IBM AIX 4.3 may allow attackers to execute arbitrary code, related to a "variable data type." | |||
| CVE-2002-1623 | 0.04 | — | 0.49 | Dec 31, 2002 | The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses… | |||
| CVE-2002-1624 | 0.00 | — | 0.04 | Dec 31, 2002 | Buffer overflow in Lotus Domino web server before R5.0.10, when logging to DOMLOG.NSF, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP Authenticate header containing certain non-ASCII characters. | |||
| CVE-2002-1625 | 0.00 | — | 0.02 | Dec 31, 2002 | Macromedia Flash Player 6 does not terminate connections when the user leaves the web page, which allows remote attackers to cause a denial of service (bandwidth, resource, and CPU consumption) via the (1) loadMovie or (2) loadSound commands, which continue to execute until the… | |||
| CVE-2002-1626 | 0.00 | — | 0.02 | Dec 31, 2002 | Directory traversal vulnerability in Mike Spice My Calendar before 1.5 allows remote attackers to write arbitrary files via .. (dot dot) sequences in a URL. | |||
| CVE-2002-1627 | 0.00 | — | 0.02 | Dec 31, 2002 | Directory traversal vulnerability in quiz.cgi for Mike Spice Quiz Me! before 0.6 allows remote attackers to write arbitrary files via .. (dot dot) sequences in the quiz parameter. | |||
| CVE-2002-1628 | 0.00 | — | 0.03 | Dec 31, 2002 | Directory traversal vulnerability in vote.cgi for Mike Spice Mike's Vote CGI before 1.3 allows remote attackers to write arbitrary files via .. (dot dot) sequences in the type parameter. | |||
| CVE-2002-1629 | 0.00 | — | 0.04 | Dec 31, 2002 | Multi-Tech ProxyServer products MTPSR1-100, MTPSR1-120, MTPSR1-202ST, MTPSR2-201, and MTPSR3-200 ship with a null password, which allows remote attackers to gain administrative privileges via Telnet or HTTP. | |||
| CVE-2002-1630 | 0.01 | — | 0.07 | Dec 31, 2002 | The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails. | |||
| CVE-2002-1631 | 0.01 | — | 0.08 | Dec 31, 2002 | SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter. | |||
| CVE-2002-1632 | 0.00 | — | 0.05 | Dec 31, 2002 | Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2. | |||
| CVE-2002-1633 | 0.00 | — | 0.01 | Dec 31, 2002 | Multiple buffer overflows in QNX 4.25 may allow local users to execute arbitrary code via long command line arguments to (1) sample, (2) ex, (3) du, (4) find, (5) lex, (6) mkdir, (7) rm, (8) serserv, (9) tcpserv, (10) termdef, (11) time, (12) unzip, (13) use, (14) wcc, (15)… | |||
| CVE-2002-1634 | 0.04 | — | 0.17 | Dec 31, 2002 | Novell NetWare 5.1 installs sample applications that allow remote attackers to obtain sensitive information via (1) ndsobj.nlm, (2) allfield.jse, (3) websinfo.bas, (4) ndslogin.pl, (5) volscgi.pl, (6) lancgi.pl, (7) test.jse, or (8) env.pl. | |||
| CVE-2002-1635 | 0.00 | — | 0.04 | Dec 31, 2002 | The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of… | |||
| CVE-2002-1636 | 0.00 | — | 0.02 | Dec 31, 2002 | Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web script or HTML via the cbuf parameter to htp.print. | |||
| CVE-2002-1646 | 0.00 | — | 0.04 | Dec 31, 2002 | SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server. | |||
| CVE-2002-1647 | 0.00 | — | 0.02 | Dec 31, 2002 | The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL. | |||
| CVE-2002-1648 | 0.00 | — | 0.03 | Dec 31, 2002 | Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified send_to and subject parameters. | |||
| CVE-2002-1649 | 0.00 | — | 0.01 | Dec 31, 2002 | Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag. | |||
| CVE-2002-1650 | 0.00 | — | 0.04 | Dec 31, 2002 | The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter. | |||
| CVE-2002-1651 | 0.00 | — | 0.01 | Dec 31, 2002 | Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients, possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions. | |||
| CVE-2002-1652 | 0.04 | — | 0.08 | Dec 31, 2002 | Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long query parameter. | |||
| CVE-2002-1653 | 0.00 | — | 0.01 | Dec 31, 2002 | Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encryption despite intended configuration, and may allow remote attackers to sniff sensitive information. | |||
| CVE-2002-1654 | 0.00 | — | 0.03 | Dec 31, 2002 | iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force… |
- CVE-2002-1403Jan 17, 2003risk 0.00cvss —epss 0.00
dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script.
- CVE-2003-0001Jan 17, 2003risk 0.09cvss —epss 0.73
Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.
- CVE-2003-0012Jan 17, 2003risk 0.00cvss —epss 0.00
The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.
- CVE-2003-0013Jan 17, 2003risk 0.00cvss —epss 0.02
The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a…
- CVE-2003-0025Jan 17, 2003risk 0.02cvss —epss 0.24
Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3.
- CVE-2003-0026Jan 17, 2003risk 0.02cvss —epss 0.19
Multiple stack-based buffer overflows in the error handling routines of the minires library, as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10, allow remote attackers to execute arbitrary code via a DHCP message containing a long hostname.
- CVE-2003-0031Jan 17, 2003risk 0.00cvss —epss 0.02
Multiple buffer overflows in libmcrypt before 2.5.5 allow attackers to cause a denial of service (crash).
- CVE-2003-0032Jan 17, 2003risk 0.00cvss —epss 0.02
Memory leak in libmcrypt before 2.5.5 allows attackers to cause a denial of service (memory exhaustion) via a large number of requests to the application, which causes libmcrypt to dynamically load algorithms via libtool.
- CVE-2003-0014Jan 11, 2003risk 0.00cvss —epss 0.00
gsinterf.c in bmv 1.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2002-0626Jan 7, 2003risk 0.00cvss —epss 0.02
Polycom ViewStation before 7.2.4 has a default null password for the administrator account, which allows arbitrary users to conduct unauthorized activities.
- CVE-2002-0627Jan 7, 2003risk 0.00cvss —epss 0.02
The Web server for Polycom ViewStation before 7.2.4 allows remote attackers to bypass authentication and read files via Unicode encoded requests.
- risk 0.49cvss 7.5epss 0.02
The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack.
- CVE-2002-0629Jan 7, 2003risk 0.00cvss —epss 0.02
The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via multiple connections to the server.
- CVE-2002-0630Jan 7, 2003risk 0.00cvss —epss 0.02
The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via long or malformed ICMP packets.
- CVE-2003-1071Jan 3, 2003risk 0.03cvss —epss 0.01
rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header.
- CVE-2002-1378Jan 2, 2003risk 0.01cvss —epss 0.07
Multiple buffer overflows in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allow remote attackers to execute arbitrary code via (1) long -t or -r parameters to slurpd, (2) a malicious ldapfilter.conf file that is not properly handled by getfilter functions, (3) a malicious…
- CVE-2002-1379Jan 2, 2003risk 0.00cvss —epss 0.03
OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges.
- CVE-2002-1384Jan 2, 2003risk 0.00cvss —epss 0.01
Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf.
- CVE-2002-1386Jan 2, 2003risk 0.00cvss —epss 0.00
Buffer overflow in traceroute-nanog (aka traceroute-ng) may allow local users to execute arbitrary code via a long hostname argument.
- CVE-2002-1387Jan 2, 2003risk 0.00cvss —epss 0.00
The spray mode in traceroute-nanog (aka traceroute-ng) may allow local users to overwrite arbitrary memory locations via an array index overflow using the nprobes (number of probes) argument.
- CVE-2002-1388Jan 2, 2003risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages.
- CVE-2002-1389Jan 2, 2003risk 0.00cvss —epss 0.00
Buffer overflow in typespeed 0.4.2 and earlier allows local users to gain privileges via long input.
- CVE-2002-1571Dec 31, 2002risk 0.00cvss —epss 0.00
The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on processors that do not clear all relevant SSE registers.
- CVE-2002-1572Dec 31, 2002risk 0.00cvss —epss 0.02
Signed integer overflow in the bttv_read function in the bttv driver (bttv-driver.c) in Linux kernel before 2.4.20 has unknown impact and attack vectors.
- CVE-2002-1573Dec 31, 2002risk 0.00cvss —epss 0.02
Unspecified vulnerability in the pcilynx ieee1394 firewire driver (pcilynx.c) in Linux kernel before 2.4.20 has unknown impact and attack vectors, related to "wrap handling."
- CVE-2002-1617Dec 31, 2002risk 0.00cvss —epss 0.01
Multiple buffer overflows in HP Tru64 UNIX 5.x allow local users to execute arbitrary code via (1) a long -contextDir argument to dtaction, (2) a long -p argument to dtprintinfo, (3) a long -customization argument to dxterm, or (4) a long DISPLAY environment variable to dtterm.
- CVE-2002-1622Dec 31, 2002risk 0.00cvss —epss 0.03
Buffer overflow in certain RPC routines in IBM AIX 4.3 may allow attackers to execute arbitrary code, related to a "variable data type."
- CVE-2002-1623Dec 31, 2002risk 0.04cvss —epss 0.49
The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses…
- CVE-2002-1624Dec 31, 2002risk 0.00cvss —epss 0.04
Buffer overflow in Lotus Domino web server before R5.0.10, when logging to DOMLOG.NSF, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP Authenticate header containing certain non-ASCII characters.
- CVE-2002-1625Dec 31, 2002risk 0.00cvss —epss 0.02
Macromedia Flash Player 6 does not terminate connections when the user leaves the web page, which allows remote attackers to cause a denial of service (bandwidth, resource, and CPU consumption) via the (1) loadMovie or (2) loadSound commands, which continue to execute until the…
- CVE-2002-1626Dec 31, 2002risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Mike Spice My Calendar before 1.5 allows remote attackers to write arbitrary files via .. (dot dot) sequences in a URL.
- CVE-2002-1627Dec 31, 2002risk 0.00cvss —epss 0.02
Directory traversal vulnerability in quiz.cgi for Mike Spice Quiz Me! before 0.6 allows remote attackers to write arbitrary files via .. (dot dot) sequences in the quiz parameter.
- CVE-2002-1628Dec 31, 2002risk 0.00cvss —epss 0.03
Directory traversal vulnerability in vote.cgi for Mike Spice Mike's Vote CGI before 1.3 allows remote attackers to write arbitrary files via .. (dot dot) sequences in the type parameter.
- CVE-2002-1629Dec 31, 2002risk 0.00cvss —epss 0.04
Multi-Tech ProxyServer products MTPSR1-100, MTPSR1-120, MTPSR1-202ST, MTPSR2-201, and MTPSR3-200 ship with a null password, which allows remote attackers to gain administrative privileges via Telnet or HTTP.
- CVE-2002-1630Dec 31, 2002risk 0.01cvss —epss 0.07
The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails.
- CVE-2002-1631Dec 31, 2002risk 0.01cvss —epss 0.08
SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.
- CVE-2002-1632Dec 31, 2002risk 0.00cvss —epss 0.05
Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.
- CVE-2002-1633Dec 31, 2002risk 0.00cvss —epss 0.01
Multiple buffer overflows in QNX 4.25 may allow local users to execute arbitrary code via long command line arguments to (1) sample, (2) ex, (3) du, (4) find, (5) lex, (6) mkdir, (7) rm, (8) serserv, (9) tcpserv, (10) termdef, (11) time, (12) unzip, (13) use, (14) wcc, (15)…
- CVE-2002-1634Dec 31, 2002risk 0.04cvss —epss 0.17
Novell NetWare 5.1 installs sample applications that allow remote attackers to obtain sensitive information via (1) ndsobj.nlm, (2) allfield.jse, (3) websinfo.bas, (4) ndslogin.pl, (5) volscgi.pl, (6) lancgi.pl, (7) test.jse, or (8) env.pl.
- CVE-2002-1635Dec 31, 2002risk 0.00cvss —epss 0.04
The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of…
- CVE-2002-1636Dec 31, 2002risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web script or HTML via the cbuf parameter to htp.print.
- CVE-2002-1646Dec 31, 2002risk 0.00cvss —epss 0.04
SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.
- CVE-2002-1647Dec 31, 2002risk 0.00cvss —epss 0.02
The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL.
- CVE-2002-1648Dec 31, 2002risk 0.00cvss —epss 0.03
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified send_to and subject parameters.
- CVE-2002-1649Dec 31, 2002risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript: URL in an IMG tag.
- CVE-2002-1650Dec 31, 2002risk 0.00cvss —epss 0.04
The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
- CVE-2002-1651Dec 31, 2002risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients, possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions.
- CVE-2002-1652Dec 31, 2002risk 0.04cvss —epss 0.08
Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long query parameter.
- CVE-2002-1653Dec 31, 2002risk 0.00cvss —epss 0.01
Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encryption despite intended configuration, and may allow remote attackers to sniff sensitive information.
- CVE-2002-1654Dec 31, 2002risk 0.00cvss —epss 0.03
iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force…