CVEs

343,049 total · page 6735 of 6,861

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2002-1707	PhpBB phpBB		0.00	—	0.01	Dec 31, 2002	install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_dir parameter to reference a URL on a remote web server that contains the code.
CVE-2002-1708	Basilix Webmail		0.03	—	0.04	Dec 31, 2002	Cross-site scripting vulnerability (XSS) in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the (1) subject or (2) message fields.
CVE-2002-1709	Basilix Webmail		0.00	—	0.01	Dec 31, 2002	SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable.
CVE-2002-1710	Basilix Webmail		0.00	—	0.00	Dec 31, 2002	The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file.
CVE-2002-1711	Basilix BasiliX		0.00	—	0.00	Dec 31, 2002	BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments.
CVE-2002-1712	Microsoft Windows 2000		0.05	—	0.29	Dec 31, 2002	Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the ACK and FIN bits set to the NetBIOS port (TCP/139), as demonstrated by stream3.
CVE-2002-1713	Mandrake Linux Mandrake-Security package (msec)	Med	0.36	5.5	0.00	Dec 31, 2002	The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read other user's files.
CVE-2002-1714	Microsoft Internet Explorer		0.05	—	0.19	Dec 31, 2002	Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type "text/html" with the DATA field that identifies the HTML document that contains the object, which may cause infinite recursion.
CVE-2002-1715	SSH SSH		0.03	—	0.01	Dec 31, 2002	SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access.
CVE-2002-1716	Microsoft Office		0.01	—	0.14	Dec 31, 2002	The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability.
CVE-2002-1717	Microsoft Internet Information Server		0.01	—	0.16	Dec 31, 2002	Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.
CVE-2002-1718	Microsoft Internet Information Server		0.01	—	0.14	Dec 31, 2002	Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
CVE-2002-1719	Bavo Bavo		0.00	—	0.02	Dec 31, 2002	Unknown vulnerability in Bavo 0.3 allows remote attackers to modify posted messages.
CVE-2002-1720	Outfront Spooky Login		0.03	—	0.03	Dec 31, 2002	SQL injection vulnerability in Spooky Login 2.0 through 2.5 allows remote attackers to bypass authentication and gain privileges via the password field.
CVE-2002-1721	Paul L Daniels Altermime	Hig	0.49	7.5	0.02	Dec 31, 2002	Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the FFGET_FILE variable with a (null) byte.
CVE-2002-1722	Logitech Itouch Keyboard		0.00	—	0.00	Dec 31, 2002	Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have been assigned to a button.
CVE-2002-1723	Powerboards Powerboards		0.00	—	0.01	Dec 31, 2002	Powerboards 2.2b allows remote attackers to view the full path to the backend database by sending a cookie containing a non-existent username to profiles.php, which displays the full path in the error message.
CVE-2002-1724	PHPImageView PHPImageView		0.00	—	0.01	Dec 31, 2002	Cross-site scripting vulnerability (XSS) in phpimageview.php for PHPImageView 1.0 allows remote attackers to execute arbitrary script as other users via the pic parameter.
CVE-2002-1725	PHPImageView PHPImageView		0.00	—	0.01	Dec 31, 2002	phpimageview.php in PHPImageView 1.0 allows remote attackers to obtain sensitive information via the pw=show option, which invokes the phpinfo function.
CVE-2002-1726	Brokenbytes Photodb		0.00	—	0.02	Dec 31, 2002	secure_inc.php in PhotoDB 1.4 allows remote attackers to bypass authentication via a URL with a large Time parameter, non-empty rmtusername and rmtpassword parameter, and an accesslevel parameter that is lower than the access level of the requested page.
CVE-2002-1727	Asksam Systems Web Publisher		0.03	—	0.04	Dec 31, 2002	Cross-site scripting vulnerability (XSS) in (1) as_web.exe and (2) as_web4.exe in askSam Web Publisher 1 and 4 allows remote attackers to execute arbitrary script as other users via a URL.
CVE-2002-1728	Asksam Systems Web Publisher		0.00	—	0.02	Dec 31, 2002	askSam Web Publisher 1.0 and 4.0 allows remote attackers to determine the full path to the web root directory via a request for a file that does not exist, which generates an error message that reveals the full path.
CVE-2002-1729	Aspjar Aspjar Guestbook		0.00	—	0.01	Dec 31, 2002	Cross-site scripting vulnerability (XSS) in ASPjar Guestbook 1.00 allows remote attackers to execute arbitrary script as other users via the "web site" parameter in a guestbook message.
CVE-2002-1730	Aspjar Aspjar Guestbook		0.00	—	0.01	Dec 31, 2002	ASPjar Guestbook 1.00 allows remote attackers to delete arbitrary messages accessing the delete.asp administrative script with certain cookie values set to "true".
CVE-2002-1731	IBM AS/400		0.03	—	0.01	Dec 31, 2002	The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF.
CVE-2002-1732	Actinic Actinic Catalog		0.00	—	0.01	Dec 31, 2002	Multiple cross-site scripting (XSS) vulnerabilities in Actinic Catalog 4.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string argument to certain .pl files, (2) the REFPAGE parameter to ca000007.pl, (3) PRODREF parameter to ss000007.pl, or…
CVE-2002-1733	Prospero Technologies Prospero Message Board		0.00	—	0.01	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in the web-based message board in Prospero Technologies allows remote attackers to inject arbitrary web script or HTML via a message board post.
CVE-2002-1734	NewsPro NewsPro		0.00	—	0.03	Dec 31, 2002	NewsPro 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to "logged,true".
CVE-2002-1735	Davin Mccall Dlogin		0.00	—	0.00	Dec 31, 2002	Buffer overflow in dlogin 1.0a could allow local users to gain privileges via unknown attack vectors.
CVE-2002-1736	CGINews CGINews		0.00	—	0.01	Dec 31, 2002	Unknown vulnerability in CGINews before 1.06 allow remote attackers to read arbitrary files via "unfiltered user input."
CVE-2002-1737	Astaro Security Linux		0.00	—	0.00	Dec 31, 2002	Astaro Security Linux 2.016 creates world-writable files and directories, which allows local users to overwrite arbitrary files.
CVE-2002-1738	Alt N Mdaemon		0.00	—	0.01	Dec 31, 2002	Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send anonymous email.
CVE-2002-1739	Alt N Mdaemon	Med	0.36	5.5	0.00	Dec 31, 2002	Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords.
CVE-2002-1740	Alt N Mdaemon		0.03	—	0.01	Dec 31, 2002	Buffer overflow in WorldClient.cgi in WorldClient in Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to execute arbitrary code via a long folder name (NewFolder parameter).
CVE-2002-1741	Alt N Worldclient		0.03	—	0.01	Dec 31, 2002	Directory traversal vulnerability in WorldClient.cgi in WorldClient for Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to delete arbitrary files via a ".." (dot dot) in the Attachments parameter.
CVE-2002-1742	Paul Kulchenko SOAP Lite		0.00	—	0.02	Dec 31, 2002	SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.
CVE-2002-1743	AOL Icq		0.00	—	0.02	Dec 31, 2002	AOL ICQ 2002a Build 3722 allows remote attackers to cause a denial of service (crash) via a malformed .hpf file.
CVE-2002-1744	Microsoft IIS		0.08	—	0.64	Dec 31, 2002	Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).
CVE-2002-1745	Microsoft IIS	Hig	0.50	7.5	0.18	Dec 31, 2002	Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
CVE-2002-1746	Maxim Krasnyansky Vtun		0.00	—	0.01	Dec 31, 2002	Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets.
CVE-2002-1747	Maxim Krasnyansky Vtun		0.00	—	0.01	Dec 31, 2002	Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB.
CVE-2002-1748	Open Source Development Network Slashcode		0.00	—	0.01	Dec 31, 2002	Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts.
CVE-2002-1749	Microsoft Windows 2000		0.00	—	0.01	Dec 31, 2002	Windows 2000 Terminal Services, when using the disconnect feature of the client, does not properly lock itself if it is left idle until the screen saver activates and the user disconnects, which could allow attackers to gain administrator privileges.
CVE-2002-1750	Cgiscript.net Csguestbook		0.00	—	0.02	Dec 31, 2002	csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1751	Cgiscript.net Cslivesupport		0.00	—	0.02	Dec 31, 2002	csLiveSupport.cgi in CGIScript.net csLiveSupport allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1752	Cgiscript.net Cschat R Box		0.00	—	0.03	Dec 31, 2002	csChatRBox.cgi in CGIScript.net csChat-R-Box allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1753	Cgiscript.net Csnews Professional		0.02	—	0.26	Dec 31, 2002	csNewsPro.cgi in CGIScript.net csNews Professional (csNewsPro) allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1754	Novell Netware Client		0.00	—	0.00	Dec 31, 2002	Buffer overflow in Novell NetWare Client 4.80 through 4.83 allows local users to cause a denial of service (crash) by using ping, traceroute, or a similar utility to force the client to resolve a large hostname.
CVE-2002-1755	Tinc Tinc		0.00	—	0.01	Dec 31, 2002	tinc 1.0pre3 and 1.0pre4 VPN does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on CBC.
CVE-2002-1756	Acdsee Acdsee		0.00	—	0.02	Dec 31, 2002	ACDSee 4.0 allows remote attackers to cause a denial of service (crash) via an .ais file with a long file description field, which is not properly handled when the file properties of the file are viewed.

CVE-2002-1707Dec 31, 2002
PhpBB
phpBB
risk 0.00cvss —epss 0.01
install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_dir parameter to reference a URL on a remote web server that contains the code.
CVE-2002-1708Dec 31, 2002
Basilix
Webmail
risk 0.03cvss —epss 0.04
Cross-site scripting vulnerability (XSS) in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the (1) subject or (2) message fields.
CVE-2002-1709Dec 31, 2002
Basilix
Webmail
risk 0.00cvss —epss 0.01
SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable.
CVE-2002-1710Dec 31, 2002
Basilix
Webmail
risk 0.00cvss —epss 0.00
The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file.
CVE-2002-1711Dec 31, 2002
Basilix
BasiliX
risk 0.00cvss —epss 0.00
BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments.
CVE-2002-1712Dec 31, 2002
Microsoft
Windows 2000
risk 0.05cvss —epss 0.29
Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the ACK and FIN bits set to the NetBIOS port (TCP/139), as demonstrated by stream3.
CVE-2002-1713MedDec 31, 2002
Mandrake Linux
Mandrake-Security package (msec)
risk 0.36cvss 5.5epss 0.00
The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read other user's files.
CVE-2002-1714Dec 31, 2002
Microsoft
Internet Explorer
risk 0.05cvss —epss 0.19
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type "text/html" with the DATA field that identifies the HTML document that contains the object, which may cause infinite recursion.
CVE-2002-1715Dec 31, 2002
SSH
SSH
risk 0.03cvss —epss 0.01
SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access.
CVE-2002-1716Dec 31, 2002
Microsoft
Office
risk 0.01cvss —epss 0.14
The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability.
CVE-2002-1717Dec 31, 2002
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.16
Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.
CVE-2002-1718Dec 31, 2002
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.14
Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
CVE-2002-1719Dec 31, 2002
Bavo
Bavo
risk 0.00cvss —epss 0.02
Unknown vulnerability in Bavo 0.3 allows remote attackers to modify posted messages.
CVE-2002-1720Dec 31, 2002
Outfront
Spooky Login
risk 0.03cvss —epss 0.03
SQL injection vulnerability in Spooky Login 2.0 through 2.5 allows remote attackers to bypass authentication and gain privileges via the password field.
CVE-2002-1721HigDec 31, 2002
Paul L Daniels
Altermime
risk 0.49cvss 7.5epss 0.02
Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the FFGET_FILE variable with a (null) byte.
CVE-2002-1722Dec 31, 2002
Logitech
Itouch Keyboard
risk 0.00cvss —epss 0.00
Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have been assigned to a button.
CVE-2002-1723Dec 31, 2002
Powerboards
Powerboards
risk 0.00cvss —epss 0.01
Powerboards 2.2b allows remote attackers to view the full path to the backend database by sending a cookie containing a non-existent username to profiles.php, which displays the full path in the error message.
CVE-2002-1724Dec 31, 2002
PHPImageView
PHPImageView
risk 0.00cvss —epss 0.01
Cross-site scripting vulnerability (XSS) in phpimageview.php for PHPImageView 1.0 allows remote attackers to execute arbitrary script as other users via the pic parameter.
CVE-2002-1725Dec 31, 2002
PHPImageView
PHPImageView
risk 0.00cvss —epss 0.01
phpimageview.php in PHPImageView 1.0 allows remote attackers to obtain sensitive information via the pw=show option, which invokes the phpinfo function.
CVE-2002-1726Dec 31, 2002
Brokenbytes
Photodb
risk 0.00cvss —epss 0.02
secure_inc.php in PhotoDB 1.4 allows remote attackers to bypass authentication via a URL with a large Time parameter, non-empty rmtusername and rmtpassword parameter, and an accesslevel parameter that is lower than the access level of the requested page.
CVE-2002-1727Dec 31, 2002
Asksam Systems
Web Publisher
risk 0.03cvss —epss 0.04
Cross-site scripting vulnerability (XSS) in (1) as_web.exe and (2) as_web4.exe in askSam Web Publisher 1 and 4 allows remote attackers to execute arbitrary script as other users via a URL.
CVE-2002-1728Dec 31, 2002
Asksam Systems
Web Publisher
risk 0.00cvss —epss 0.02
askSam Web Publisher 1.0 and 4.0 allows remote attackers to determine the full path to the web root directory via a request for a file that does not exist, which generates an error message that reveals the full path.
CVE-2002-1729Dec 31, 2002
Aspjar
Aspjar Guestbook
risk 0.00cvss —epss 0.01
Cross-site scripting vulnerability (XSS) in ASPjar Guestbook 1.00 allows remote attackers to execute arbitrary script as other users via the "web site" parameter in a guestbook message.
CVE-2002-1730Dec 31, 2002
Aspjar
Aspjar Guestbook
risk 0.00cvss —epss 0.01
ASPjar Guestbook 1.00 allows remote attackers to delete arbitrary messages accessing the delete.asp administrative script with certain cookie values set to "true".
CVE-2002-1731Dec 31, 2002
IBM
AS/400
risk 0.03cvss —epss 0.01
The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF.
CVE-2002-1732Dec 31, 2002
Actinic
Actinic Catalog
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Actinic Catalog 4.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string argument to certain .pl files, (2) the REFPAGE parameter to ca000007.pl, (3) PRODREF parameter to ss000007.pl, or…
CVE-2002-1733Dec 31, 2002
Prospero Technologies
Prospero Message Board
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the web-based message board in Prospero Technologies allows remote attackers to inject arbitrary web script or HTML via a message board post.
CVE-2002-1734Dec 31, 2002
NewsPro
NewsPro
risk 0.00cvss —epss 0.03
NewsPro 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to "logged,true".
CVE-2002-1735Dec 31, 2002
Davin Mccall
Dlogin
risk 0.00cvss —epss 0.00
Buffer overflow in dlogin 1.0a could allow local users to gain privileges via unknown attack vectors.
CVE-2002-1736Dec 31, 2002
CGINews
CGINews
risk 0.00cvss —epss 0.01
Unknown vulnerability in CGINews before 1.06 allow remote attackers to read arbitrary files via "unfiltered user input."
CVE-2002-1737Dec 31, 2002
Astaro
Security Linux
risk 0.00cvss —epss 0.00
Astaro Security Linux 2.016 creates world-writable files and directories, which allows local users to overwrite arbitrary files.
CVE-2002-1738Dec 31, 2002
Alt N
Mdaemon
risk 0.00cvss —epss 0.01
Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send anonymous email.
CVE-2002-1739MedDec 31, 2002
Alt N
Mdaemon
risk 0.36cvss 5.5epss 0.00
Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords.
CVE-2002-1740Dec 31, 2002
Alt N
Mdaemon
risk 0.03cvss —epss 0.01
Buffer overflow in WorldClient.cgi in WorldClient in Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to execute arbitrary code via a long folder name (NewFolder parameter).
CVE-2002-1741Dec 31, 2002
Alt N
Worldclient
risk 0.03cvss —epss 0.01
Directory traversal vulnerability in WorldClient.cgi in WorldClient for Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to delete arbitrary files via a ".." (dot dot) in the Attachments parameter.
CVE-2002-1742Dec 31, 2002
Paul Kulchenko
SOAP Lite
risk 0.00cvss —epss 0.02
SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.
CVE-2002-1743Dec 31, 2002
AOL
Icq
risk 0.00cvss —epss 0.02
AOL ICQ 2002a Build 3722 allows remote attackers to cause a denial of service (crash) via a malformed .hpf file.
CVE-2002-1744Dec 31, 2002
Microsoft
IIS
risk 0.08cvss —epss 0.64
Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).
CVE-2002-1745HigDec 31, 2002
Microsoft
IIS
risk 0.50cvss 7.5epss 0.18
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
CVE-2002-1746Dec 31, 2002
Maxim Krasnyansky
Vtun
risk 0.00cvss —epss 0.01
Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets.
CVE-2002-1747Dec 31, 2002
Maxim Krasnyansky
Vtun
risk 0.00cvss —epss 0.01
Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB.
CVE-2002-1748Dec 31, 2002
Open Source Development Network
Slashcode
risk 0.00cvss —epss 0.01
Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts.
CVE-2002-1749Dec 31, 2002
Microsoft
Windows 2000
risk 0.00cvss —epss 0.01
Windows 2000 Terminal Services, when using the disconnect feature of the client, does not properly lock itself if it is left idle until the screen saver activates and the user disconnects, which could allow attackers to gain administrator privileges.
CVE-2002-1750Dec 31, 2002
Cgiscript.net
Csguestbook
risk 0.00cvss —epss 0.02
csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1751Dec 31, 2002
Cgiscript.net
Cslivesupport
risk 0.00cvss —epss 0.02
csLiveSupport.cgi in CGIScript.net csLiveSupport allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1752Dec 31, 2002
Cgiscript.net
Cschat R Box
risk 0.00cvss —epss 0.03
csChatRBox.cgi in CGIScript.net csChat-R-Box allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1753Dec 31, 2002
Cgiscript.net
Csnews Professional
risk 0.02cvss —epss 0.26
csNewsPro.cgi in CGIScript.net csNews Professional (csNewsPro) allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
CVE-2002-1754Dec 31, 2002
Novell
Netware Client
risk 0.00cvss —epss 0.00
Buffer overflow in Novell NetWare Client 4.80 through 4.83 allows local users to cause a denial of service (crash) by using ping, traceroute, or a similar utility to force the client to resolve a large hostname.
CVE-2002-1755Dec 31, 2002
Tinc
Tinc
risk 0.00cvss —epss 0.01
tinc 1.0pre3 and 1.0pre4 VPN does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on CBC.
CVE-2002-1756Dec 31, 2002
Acdsee
Acdsee
risk 0.00cvss —epss 0.02
ACDSee 4.0 allows remote attackers to cause a denial of service (crash) via an .ais file with a long file description field, which is not properly handled when the file properties of the file are viewed.