CVEs

343,040 total · page 6738 of 6,861

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2002-1866	Simple Web Server SWS		0.00	—	0.02	Dec 31, 2002	Simple Web Server (SWS) 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages, which could allow remote attackers to cause a denial of service (file descriptor exhaustion) via multiple requests for pages that do not exist.
CVE-2002-1867	Bizdesign Imagefolio		0.00	—	0.02	Dec 31, 2002	The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an administrative account, or (2) admin/nph-build.cgi, which allows remote attackers to cause a denial of service (CPU…
CVE-2002-1868	C Ares Dispair		0.03	—	0.05	Dec 31, 2002	Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields.
CVE-2002-1869	Heysoft Eventsave\+	Low	0.21	3.3	0.00	Dec 31, 2002	Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.
CVE-2002-1870	Sws Sws Simple Web Server		0.00	—	0.03	Dec 31, 2002	Simple Web Server (SWS) 0.0.4 through 0.1.0 does not properly handle when the recv function call fails, which may allow remote attackers to overwrite program data or perform actions on an uninitialized heap, leading to a denial of service and possibly code execution.
CVE-2002-1871	Sun Corporation Solaris		0.00	—	0.00	Dec 31, 2002	pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" (question mark) in the (1) mode, (2) owner, or (3) group fields, which allows attackers to elevate privileges.
CVE-2002-1872	Microsoft SQL Server	Hig	0.49	7.5	0.06	Dec 31, 2002	Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.
CVE-2002-1873	Microsoft Exchange 2000		0.01	—	0.14	Dec 31, 2002	Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.
CVE-2002-1874	Astrocam Astrocam		0.00	—	0.03	Dec 31, 2002	astrocam.cgi in AstroCam 0.9-1-1 through 1.4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request. NOTE: earlier disclosures stated that the affected versions were 1.7.1 through 2.1.2, but the vendor explicitly stated that these…
CVE-2002-1875	Entercept Entercept Agent		0.00	—	0.00	Dec 31, 2002	Entercept Agent 2.5 agent for Windows, released before May 21, 2002, allows local administrative users to obtain the entercept agent password, which could allow the administrators to log on as the entercept_agent account and conceal their identity.
CVE-2002-1876	Microsoft Exchange 2000		0.00	—	0.05	Dec 31, 2002	Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS.
CVE-2002-1877	Netgear Fm114p		0.00	—	0.02	Dec 31, 2002	NETGEAR FM114P allows remote attackers to bypass access restrictions for web sites via a URL that uses the IP address instead of the hostname.
CVE-2002-1878	W Agora W Agora		0.03	—	0.03	Dec 31, 2002	PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the inc_dir parameter.
CVE-2002-1879	Lokwa Lokwabb		0.00	—	0.01	Dec 31, 2002	SQL injection vulnerability in LokwaBB 1.2.2 allows remote attackers to execute arbitrary SQL commands via the (1) member parameter to member.php or (2) loser parameter to misc.php.
CVE-2002-1880	Lokwa Lokwabb		0.00	—	0.01	Dec 31, 2002	LokwaBB 1.2.2 allows remote attackers to read arbitrary messages by modifying the pmid parameter to pm.php.
CVE-2002-1881	Macromedia Flash Player		0.00	—	0.02	Dec 31, 2002	Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service (web browser crash) via malformed content in a Flash Shockwave (.SWF) file, as demonstrated by by ROT13 encoding the body of the file but not the headers.
CVE-2002-1882	Oracle Corporation E Business Suite		0.00	—	0.05	Dec 31, 2002	Unknown vulnerability in AolSecurityPrivate.class in Oracle E-Business Suite 11i 11.1 through 11.6 allows remote attackers to bypass user authentication checks via unknown attack vectors.
CVE-2002-1883	Trolltech Qt Assistant		0.00	—	0.02	Dec 31, 2002	Trolltech Qt Assistant 1.0 in Trolltech Qt 3.0.3, when loaded from the Designer, opens port 7358 for interprocess communication, which allows remote attackers to open arbitrary HTML pages and cause a denial of service.
CVE-2002-1884	Py Membres Py Membres		0.03	—	0.03	Dec 31, 2002	index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin".
CVE-2002-1885	Powerphlogger Powerphlogger		0.04	—	0.07	Dec 31, 2002	PHP remote file inclusion vulnerability in showhits.php3 for PowerPhlogger (PPhlogger) 2.0.9 through 2.2.2 allows remote attackers to execute arbitrary PHP code via the rel_path parameter.
CVE-2002-1886	Tightauction Tightauction		0.03	—	0.03	Dec 31, 2002	TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain the database username and password.
CVE-2002-1887	Gregory Kokanosky Phpmynewsletter		0.03	—	0.03	Dec 31, 2002	PHP remote file inclusion vulnerability in customize.php for phpMyNewsletter 0.6.10 allows remote attackers to execute arbitrary PHP code via the l parameter.
CVE-2002-1888	Commonname Commonname Toolbar		0.00	—	0.00	Dec 31, 2002	CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allows those organizations to obtain internal server names.
CVE-2002-1889	Logsurfer Logsurfer		0.00	—	0.02	Dec 31, 2002	Off-by-one buffer overflow in the context_action function in context.c of Logsurfer 1.41 through 1.5a allows remote attackers to cause a denial of service (crash) via a malformed log entry.
CVE-2002-1890	Red Hat Rhmask		0.00	—	0.00	Dec 31, 2002	rhmask 1.0-9 in Red Hat Linux 7.1 allows local users to overwrite arbitrary files via a symlink attack on the mask file.
CVE-2002-1891	Ayman Akt Ircit		0.03	—	0.05	Dec 31, 2002	Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.
CVE-2002-1892	Netgear Fvs318		0.00	—	0.01	Dec 31, 2002	NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.
CVE-2002-1893	Argosoft Argosoft Mail Server		0.00	—	0.01	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in ArGoSoft Mail Server Pro 1.8.1.9 allows remote attackers to inject arbitrary web script or HTML via the e-mail message.
CVE-2002-1894	PhpBB phpBB		0.00	—	0.02	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in viewtopic.php in phpBB 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.
CVE-2002-1895	Apache Tomcat		0.00	—	0.04	Dec 31, 2002	The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
CVE-2002-1896	Alsaplayer Alsaplayer		0.03	—	0.02	Dec 31, 2002	Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.
CVE-2002-1897	Mywebserver Mywebserver		0.03	—	0.03	Dec 31, 2002	MyWebServer LLC MyWebServer 1.0.2 allows remote attackers to cause a denial of service (crash) via a long HTTP request, possibly triggering a buffer overflow.
CVE-2002-1898	Apple Inc. Terminal		0.03	—	0.03	Dec 31, 2002	Terminal 1.3 in Apple Mac OS X 10.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link, which is executed by Terminal.app window.
CVE-2002-1899	IceWarp WebMail		0.00	—	0.01	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in IceWarp Web Mail 3.3.3 and 3.4.5 allows remote attackers to inject arbitrary web script or HTML via the "Full Name" (addressname) parameter.
CVE-2002-1900	Pinboard Pinboard		0.00	—	0.01	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists.
CVE-2002-1901	Bodo Bauer Bbgallery		0.00	—	0.01	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in Bodo Bauer BBGallery 1.0 allows remote attackers to inject arbitrary web script or HTML via image tags.
CVE-2002-1902	Markus Triska Cgiforum		0.00	—	0.02	Dec 31, 2002	CGIForum 1.0 through 1.05 allows remote attackers to cause a denial of service (infinite recursion) by creating a message board post that is a child of an outdated parent.
CVE-2002-1903	University of Washington Pine		0.00	—	0.01	Dec 31, 2002	Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information.
CVE-2002-1904	Gaztek Ghttpd		0.03	—	0.06	Dec 31, 2002	Buffer overflow in the Log function in util.c in GazTek ghttpd 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVE-2002-1905	Polycom Viavideo		0.04	—	0.08	Dec 31, 2002	Buffer overflow in the web server of Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
CVE-2002-1906	Polycom Viavideo		0.04	—	0.07	Dec 31, 2002	The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) by sending incomplete HTTP requests and leaving the connections open.
CVE-2002-1907	Telcondex Simplewebserver		0.03	—	0.03	Dec 31, 2002	TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
CVE-2002-1908	Microsoft IIS		0.01	—	0.14	Dec 31, 2002	Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.
CVE-2002-1909	Click2learn Ingenium Learning Management System		0.00	—	0.01	Dec 31, 2002	Click2Learn Ingenium Learning Management System 5.1 and 6.1 stores the hashed administrative password in a config.txt file under the htdocs directory, which allows remote attackers to obtain the administrative password.
CVE-2002-1910	Click2learn Ingenium Learning Management System	Hig	0.52	7.5	0.03	Dec 31, 2002	Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), which allows attackers to obtain passwords.
CVE-2002-1911	Zonelabs Zonealarm		0.03	—	0.03	Dec 31, 2002	ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of SYN packets (SYN flood). NOTE: the vendor was not able to reproduce the issue.
CVE-2002-1912	Skystream Emr5000	Hig	0.49	7.5	0.03	Dec 31, 2002	SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Ethernet interface when the buffers are full, which allows remote attackers to cause a denial of service (null pointer exception and kernel panic) via a large number of packets.
CVE-2002-1913	Myphpnuke Myphpnuke		0.00	—	0.02	Dec 31, 2002	phptonuke.php in myPHPNuke 1.8.8 allows remote attackers to read arbitrary files via a full pathname in the filnavn variable.
CVE-2002-1914	dump Dump	Med	0.36	5.5	0.00	Dec 31, 2002	dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file.
CVE-2002-1915	FreeBSD FreeBSD	Med	0.36	5.5	0.00	Dec 31, 2002	tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.

CVE-2002-1866Dec 31, 2002
Simple Web Server
SWS
risk 0.00cvss —epss 0.02
Simple Web Server (SWS) 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages, which could allow remote attackers to cause a denial of service (file descriptor exhaustion) via multiple requests for pages that do not exist.
CVE-2002-1867Dec 31, 2002
Bizdesign
Imagefolio
risk 0.00cvss —epss 0.02
The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an administrative account, or (2) admin/nph-build.cgi, which allows remote attackers to cause a denial of service (CPU…
CVE-2002-1868Dec 31, 2002
C Ares
Dispair
risk 0.03cvss —epss 0.05
Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields.
CVE-2002-1869LowDec 31, 2002
Heysoft
Eventsave\+
risk 0.21cvss 3.3epss 0.00
Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.
CVE-2002-1870Dec 31, 2002
Sws
Sws Simple Web Server
risk 0.00cvss —epss 0.03
Simple Web Server (SWS) 0.0.4 through 0.1.0 does not properly handle when the recv function call fails, which may allow remote attackers to overwrite program data or perform actions on an uninitialized heap, leading to a denial of service and possibly code execution.
CVE-2002-1871Dec 31, 2002
Sun Corporation
Solaris
risk 0.00cvss —epss 0.00
pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" (question mark) in the (1) mode, (2) owner, or (3) group fields, which allows attackers to elevate privileges.
CVE-2002-1872HigDec 31, 2002
Microsoft
SQL Server
risk 0.49cvss 7.5epss 0.06
Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.
CVE-2002-1873Dec 31, 2002
Microsoft
Exchange 2000
risk 0.01cvss —epss 0.14
Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.
CVE-2002-1874Dec 31, 2002
Astrocam
Astrocam
risk 0.00cvss —epss 0.03
astrocam.cgi in AstroCam 0.9-1-1 through 1.4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request. NOTE: earlier disclosures stated that the affected versions were 1.7.1 through 2.1.2, but the vendor explicitly stated that these…
CVE-2002-1875Dec 31, 2002
Entercept
Entercept Agent
risk 0.00cvss —epss 0.00
Entercept Agent 2.5 agent for Windows, released before May 21, 2002, allows local administrative users to obtain the entercept agent password, which could allow the administrators to log on as the entercept_agent account and conceal their identity.
CVE-2002-1876Dec 31, 2002
Microsoft
Exchange 2000
risk 0.00cvss —epss 0.05
Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS.
CVE-2002-1877Dec 31, 2002
Netgear
Fm114p
risk 0.00cvss —epss 0.02
NETGEAR FM114P allows remote attackers to bypass access restrictions for web sites via a URL that uses the IP address instead of the hostname.
CVE-2002-1878Dec 31, 2002
W Agora
W Agora
risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the inc_dir parameter.
CVE-2002-1879Dec 31, 2002
Lokwa
Lokwabb
risk 0.00cvss —epss 0.01
SQL injection vulnerability in LokwaBB 1.2.2 allows remote attackers to execute arbitrary SQL commands via the (1) member parameter to member.php or (2) loser parameter to misc.php.
CVE-2002-1880Dec 31, 2002
Lokwa
Lokwabb
risk 0.00cvss —epss 0.01
LokwaBB 1.2.2 allows remote attackers to read arbitrary messages by modifying the pmid parameter to pm.php.
CVE-2002-1881Dec 31, 2002
Macromedia
Flash Player
risk 0.00cvss —epss 0.02
Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service (web browser crash) via malformed content in a Flash Shockwave (.SWF) file, as demonstrated by by ROT13 encoding the body of the file but not the headers.
CVE-2002-1882Dec 31, 2002
Oracle Corporation
E Business Suite
risk 0.00cvss —epss 0.05
Unknown vulnerability in AolSecurityPrivate.class in Oracle E-Business Suite 11i 11.1 through 11.6 allows remote attackers to bypass user authentication checks via unknown attack vectors.
CVE-2002-1883Dec 31, 2002
Trolltech
Qt Assistant
risk 0.00cvss —epss 0.02
Trolltech Qt Assistant 1.0 in Trolltech Qt 3.0.3, when loaded from the Designer, opens port 7358 for interprocess communication, which allows remote attackers to open arbitrary HTML pages and cause a denial of service.
CVE-2002-1884Dec 31, 2002
Py Membres
Py Membres
risk 0.03cvss —epss 0.03
index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin".
CVE-2002-1885Dec 31, 2002
Powerphlogger
Powerphlogger
risk 0.04cvss —epss 0.07
PHP remote file inclusion vulnerability in showhits.php3 for PowerPhlogger (PPhlogger) 2.0.9 through 2.2.2 allows remote attackers to execute arbitrary PHP code via the rel_path parameter.
CVE-2002-1886Dec 31, 2002
Tightauction
Tightauction
risk 0.03cvss —epss 0.03
TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain the database username and password.
CVE-2002-1887Dec 31, 2002
Gregory Kokanosky
Phpmynewsletter
risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in customize.php for phpMyNewsletter 0.6.10 allows remote attackers to execute arbitrary PHP code via the l parameter.
CVE-2002-1888Dec 31, 2002
Commonname
Commonname Toolbar
risk 0.00cvss —epss 0.00
CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allows those organizations to obtain internal server names.
CVE-2002-1889Dec 31, 2002
Logsurfer
Logsurfer
risk 0.00cvss —epss 0.02
Off-by-one buffer overflow in the context_action function in context.c of Logsurfer 1.41 through 1.5a allows remote attackers to cause a denial of service (crash) via a malformed log entry.
CVE-2002-1890Dec 31, 2002
Red Hat
Rhmask
risk 0.00cvss —epss 0.00
rhmask 1.0-9 in Red Hat Linux 7.1 allows local users to overwrite arbitrary files via a symlink attack on the mask file.
CVE-2002-1891Dec 31, 2002
Ayman Akt
Ircit
risk 0.03cvss —epss 0.05
Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.
CVE-2002-1892Dec 31, 2002
Netgear
Fvs318
risk 0.00cvss —epss 0.01
NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.
CVE-2002-1893Dec 31, 2002
Argosoft
Argosoft Mail Server
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in ArGoSoft Mail Server Pro 1.8.1.9 allows remote attackers to inject arbitrary web script or HTML via the e-mail message.
CVE-2002-1894Dec 31, 2002
PhpBB
phpBB
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in viewtopic.php in phpBB 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.
CVE-2002-1895Dec 31, 2002
Apache
Tomcat
risk 0.00cvss —epss 0.04
The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
CVE-2002-1896Dec 31, 2002
Alsaplayer
Alsaplayer
risk 0.03cvss —epss 0.02
Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.
CVE-2002-1897Dec 31, 2002
Mywebserver
Mywebserver
risk 0.03cvss —epss 0.03
MyWebServer LLC MyWebServer 1.0.2 allows remote attackers to cause a denial of service (crash) via a long HTTP request, possibly triggering a buffer overflow.
CVE-2002-1898Dec 31, 2002
Apple Inc.
Terminal
risk 0.03cvss —epss 0.03
Terminal 1.3 in Apple Mac OS X 10.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link, which is executed by Terminal.app window.
CVE-2002-1899Dec 31, 2002
IceWarp
WebMail
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IceWarp Web Mail 3.3.3 and 3.4.5 allows remote attackers to inject arbitrary web script or HTML via the "Full Name" (addressname) parameter.
CVE-2002-1900Dec 31, 2002
Pinboard
Pinboard
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists.
CVE-2002-1901Dec 31, 2002
Bodo Bauer
Bbgallery
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Bodo Bauer BBGallery 1.0 allows remote attackers to inject arbitrary web script or HTML via image tags.
CVE-2002-1902Dec 31, 2002
Markus Triska
Cgiforum
risk 0.00cvss —epss 0.02
CGIForum 1.0 through 1.05 allows remote attackers to cause a denial of service (infinite recursion) by creating a message board post that is a child of an outdated parent.
CVE-2002-1903Dec 31, 2002
University of Washington
Pine
risk 0.00cvss —epss 0.01
Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information.
CVE-2002-1904Dec 31, 2002
Gaztek
Ghttpd
risk 0.03cvss —epss 0.06
Buffer overflow in the Log function in util.c in GazTek ghttpd 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVE-2002-1905Dec 31, 2002
Polycom
Viavideo
risk 0.04cvss —epss 0.08
Buffer overflow in the web server of Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
CVE-2002-1906Dec 31, 2002
Polycom
Viavideo
risk 0.04cvss —epss 0.07
The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) by sending incomplete HTTP requests and leaving the connections open.
CVE-2002-1907Dec 31, 2002
Telcondex
Simplewebserver
risk 0.03cvss —epss 0.03
TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
CVE-2002-1908Dec 31, 2002
Microsoft
IIS
risk 0.01cvss —epss 0.14
Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.
CVE-2002-1909Dec 31, 2002
Click2learn
Ingenium Learning Management System
risk 0.00cvss —epss 0.01
Click2Learn Ingenium Learning Management System 5.1 and 6.1 stores the hashed administrative password in a config.txt file under the htdocs directory, which allows remote attackers to obtain the administrative password.
CVE-2002-1910HigDec 31, 2002
Click2learn
Ingenium Learning Management System
risk 0.52cvss 7.5epss 0.03
Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), which allows attackers to obtain passwords.
CVE-2002-1911Dec 31, 2002
Zonelabs
Zonealarm
risk 0.03cvss —epss 0.03
ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of SYN packets (SYN flood). NOTE: the vendor was not able to reproduce the issue.
CVE-2002-1912HigDec 31, 2002
Skystream
Emr5000
risk 0.49cvss 7.5epss 0.03
SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Ethernet interface when the buffers are full, which allows remote attackers to cause a denial of service (null pointer exception and kernel panic) via a large number of packets.
CVE-2002-1913Dec 31, 2002
Myphpnuke
Myphpnuke
risk 0.00cvss —epss 0.02
phptonuke.php in myPHPNuke 1.8.8 allows remote attackers to read arbitrary files via a full pathname in the filnavn variable.
CVE-2002-1914MedDec 31, 2002
dump
Dump
risk 0.36cvss 5.5epss 0.00
dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file.
CVE-2002-1915MedDec 31, 2002
FreeBSD
FreeBSD
risk 0.36cvss 5.5epss 0.00
tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.