CVEs

342,793 total · page 6765 of 6,856

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2002-0287	Powie Pforum	0.00	—	0.02	May 31, 2002	pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default.
CVE-2002-0288	Bbshareware.com Phusion Webserver	0.04	—	0.09	May 31, 2002	Directory traversal vulnerability in Phusion web server 1.0 allows remote attackers to read arbitrary files via a ... (triple dot dot) in the HTTP request.
CVE-2002-0289	Bbshareware.com Phusion Webserver	0.04	—	0.13	May 31, 2002	Buffer overflow in Phusion web server 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long HTTP request.
CVE-2002-0290	Netwin Webnews	0.00	—	0.03	May 31, 2002	Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument.
CVE-2002-0291	Dino Dino's web server	0.00	—	0.03	May 31, 2002	Dino's Webserver 1.2 allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via several large HTTP requests within a short time.
CVE-2002-0292	Open Source Development Network Slashcode	0.00	—	0.01	May 31, 2002	Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field.
CVE-2002-0293	Alcatel Lucent Omnipcx	0.00	—	0.00	May 31, 2002	FTP service in Alcatel OmniPCX 4400 allows the "halt" user to gain root privileges by modifying root's .profile file.
CVE-2002-0294	Alcatel Lucent Omnipcx	0.00	—	0.00	May 31, 2002	Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system.
CVE-2002-0295	Alcatel Lucent Omnipcx	0.00	—	0.00	May 31, 2002	Alcatel OmniPCX 4400 installs files with world-writable permissions, which allows local users to reconfigure the system and possibly gain privileges.
CVE-2002-0296	Tarantella Tarantella Enterprise	0.03	—	0.01	May 31, 2002	The installation of Tarantella Enterprise 3 allows local users to overwrite arbitrary files via a symlink attack on the "spinning" temporary file.
CVE-2002-0297	ScriptEase MiniWeb Server	0.00	—	0.02	May 31, 2002	Buffer overflow in ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.
CVE-2002-0298	ScriptEase MiniWeb Server	0.00	—	0.01	May 31, 2002	ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) via certain HTTP GET requests containing (1) a %2e%2e (encoded dot-dot), (2) several /../ (dot dot) sequences, (3) a missing URI, or (4) several ../ in a URI that does not begin with a /…
CVE-2002-0299	Cnet Catchup	0.00	—	0.02	May 31, 2002	CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such as .BAT), which is executed during a scan.
CVE-2002-0300	Gnujsp Gnujsp	0.04	—	0.07	May 31, 2002	gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the…
CVE-2002-0301	Citrix Systems Nfuse	0.00	—	0.02	May 31, 2002	Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters.
CVE-2002-0302	Symantec Enterprise Firewall	0.00	—	0.01	May 31, 2002	The Notify daemon for Symantec Enterprise Firewall (SEF) 6.5.x drops large alerts when SNMP is used as the transport, which could prevent some alerts from being sent in the event of an attack.
CVE-2002-0303	Novell Groupwise	0.00	—	0.00	May 31, 2002	GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of other users by logging in without a password.
CVE-2002-0304	Summit Computer Networks Lil HTTP Server	0.00	—	0.02	May 31, 2002	Lil HTTP Server 2.1 allows remote attackers to read password-protected files via a /./ in the HTTP request.
CVE-2002-0305	Zero One Tech P100s	0.00	—	0.01	May 31, 2002	Zero One Tech (ZOT) P100s print server does not properly disable the SNMP service or change the default password, which could leave the server open to attack without the administrator's knowledge.
CVE-2002-0306	Avengers News System Avengers News System	0.00	—	0.03	May 31, 2002	ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the p (plugin) parameter.
CVE-2002-0307	Avengers News System ANS	0.00	—	0.02	May 31, 2002	Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existence of arbitrary files or execute any Perl program on the system via a .. (dot dot) in the p parameter, which reads the target file and…
CVE-2002-0308	Stefan Holmberg Admentor	0.00	—	0.03	May 31, 2002	admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments.
CVE-2002-0309	Symantec Enterprise Firewall	0.00	—	0.02	May 31, 2002	SMTP proxy in Symantec Enterprise Firewall (SEF) 6.5.x includes the firewall's physical interface name and address in an SMTP protocol exchange when NAT translation is made to an address other than the firewall, which could allow remote attackers to determine certain firewall…
CVE-2002-0310	Netwin Webnews	0.00	—	0.02	May 31, 2002	Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations (1) testweb/newstest, (2) alwn3845/imaptest, (3)…
CVE-2002-0311	Caldera Unixware	0.03	—	0.05	May 31, 2002	Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell metacharacters in the -c argument for (1) in scoadminreg.cgi or (2) service_action.cgi.
CVE-2002-0033	Sun Corporation Solaris	0.05	—	0.23	May 29, 2002	Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.
CVE-2002-0155	Microsoft Msn Messenger	0.02	—	0.24	May 29, 2002	Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX.
CVE-2002-0169	Red Hat Docbook Stylesheets	0.00	—	0.00	May 29, 2002	The default stylesheet for DocBook on Red Hat Linux 6.2 through 7.2 is installed with an insecure option enabled, which could allow users to overwrite files outside of the current directory from an untrusted document by using a full pathname as an element identifier.
CVE-2002-0174	Sgi Irix	0.00	—	0.00	May 29, 2002	nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file.
CVE-2002-0178	sharutils uudecode	0.00	—	0.01	May 29, 2002	uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands.
CVE-2002-0188	Microsoft Internet Explorer	0.01	—	0.16	May 29, 2002	Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than…
CVE-2002-0189	Microsoft Internet Explorer	0.04	—	0.14	May 29, 2002	Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability.
CVE-2002-0190	Microsoft Internet Explorer	0.02	—	0.24	May 29, 2002	Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability.
CVE-2002-0191	Microsoft Internet Explorer	0.05	—	0.30	May 29, 2002	Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script containing the cssText property of the stylesheet object, aka "Local Information Disclosure through HTML Object" vulnerability.
CVE-2002-0193	Microsoft Internet Explorer	0.06	—	0.33	May 29, 2002	Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than…
CVE-2002-0232	Mrtg Multi Router Traffic Grapher Cgi	0.00	—	0.02	May 29, 2002	Directory traversal vulnerability in Multi Router Traffic Grapher (MRTG) allows remote attackers to read portions of arbitrary files via a .. (dot dot) in the cfg parameter for (1) 14all.cgi, (2) 14all-1.1.cgi, (3) traffic.cgi, or (4) mrtg.cgi.
CVE-2002-0233	Eshare Eshare Expressions	0.00	—	0.02	May 29, 2002	Directory traversal vulnerability in eshare Expressions 4 Web server allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request.
CVE-2002-0234	Netscreen Screenos	0.00	—	0.00	May 29, 2002	NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trusted network to cause a denial of service (resource exhaustion) via a port scan to an external network, which consumes all available…
CVE-2002-0235	Castelle Faxpress	0.00	—	0.01	May 29, 2002	Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error…
CVE-2002-0236	Lucent Vitalanalysis	0.04	—	0.07	May 29, 2002	Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.
CVE-2002-0237	Iss Blackice Defender	0.00	—	0.04	May 29, 2002	Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a flood of large ICMP ping packets.
CVE-2002-0238	Netgear Rt314	0.00	—	0.02	May 29, 2002	Cross-site scripting vulnerability in web administration interface for NetGear RT314 and RT311 Gateway Routers allows remote attackers to execute arbitrary script on another client via a URL that contains the script.
CVE-2002-0239	Hanterm Hanterm Xf	0.03	—	0.01	May 29, 2002	Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) -hfn argument.
CVE-2002-0240	PHP PHP	0.01	—	0.08	May 29, 2002	PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
CVE-2002-0241	Cisco Systems, Inc. Secure Access Control Server	0.00	—	0.02	May 29, 2002	NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.
CVE-2002-0242	Microsoft Internet Explorer	0.01	—	0.11	May 29, 2002	Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.
CVE-2002-0243	Opera Opera	0.00	—	0.01	May 29, 2002	Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.
CVE-2002-0244	Atheos Atheos	0.03	—	0.03	May 29, 2002	Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir.
CVE-2002-0245	Lotus Domino	0.00	—	0.03	May 29, 2002	Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a nonexistent file with a .pl (Perl) extension, which leaks the pathname in the error message, or (2) make any request that causes an HTTP…
CVE-2002-0246	Caldera Unixware	0.03	—	0.01	May 29, 2002	Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying the LC_MESSAGE environment variable to read other message catalogs containing format strings from setuid programs such as vxprint.

CVE-2002-0287May 31, 2002
Powie
Pforum
risk 0.00cvss —epss 0.02
pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default.
CVE-2002-0288May 31, 2002
Bbshareware.com
Phusion Webserver
risk 0.04cvss —epss 0.09
Directory traversal vulnerability in Phusion web server 1.0 allows remote attackers to read arbitrary files via a ... (triple dot dot) in the HTTP request.
CVE-2002-0289May 31, 2002
Bbshareware.com
Phusion Webserver
risk 0.04cvss —epss 0.13
Buffer overflow in Phusion web server 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long HTTP request.
CVE-2002-0290May 31, 2002
Netwin
Webnews
risk 0.00cvss —epss 0.03
Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument.
CVE-2002-0291May 31, 2002
Dino
Dino's web server
risk 0.00cvss —epss 0.03
Dino's Webserver 1.2 allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via several large HTTP requests within a short time.
CVE-2002-0292May 31, 2002
Open Source Development Network
Slashcode
risk 0.00cvss —epss 0.01
Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field.
CVE-2002-0293May 31, 2002
Alcatel Lucent
Omnipcx
risk 0.00cvss —epss 0.00
FTP service in Alcatel OmniPCX 4400 allows the "halt" user to gain root privileges by modifying root's .profile file.
CVE-2002-0294May 31, 2002
Alcatel Lucent
Omnipcx
risk 0.00cvss —epss 0.00
Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system.
CVE-2002-0295May 31, 2002
Alcatel Lucent
Omnipcx
risk 0.00cvss —epss 0.00
Alcatel OmniPCX 4400 installs files with world-writable permissions, which allows local users to reconfigure the system and possibly gain privileges.
CVE-2002-0296May 31, 2002
Tarantella
Tarantella Enterprise
risk 0.03cvss —epss 0.01
The installation of Tarantella Enterprise 3 allows local users to overwrite arbitrary files via a symlink attack on the "spinning" temporary file.
CVE-2002-0297May 31, 2002
ScriptEase
MiniWeb Server
risk 0.00cvss —epss 0.02
Buffer overflow in ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.
CVE-2002-0298May 31, 2002
ScriptEase
MiniWeb Server
risk 0.00cvss —epss 0.01
ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) via certain HTTP GET requests containing (1) a %2e%2e (encoded dot-dot), (2) several /../ (dot dot) sequences, (3) a missing URI, or (4) several ../ in a URI that does not begin with a /…
CVE-2002-0299May 31, 2002
Cnet
Catchup
risk 0.00cvss —epss 0.02
CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such as .BAT), which is executed during a scan.
CVE-2002-0300May 31, 2002
Gnujsp
Gnujsp
risk 0.04cvss —epss 0.07
gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the…
CVE-2002-0301May 31, 2002
Citrix Systems
Nfuse
risk 0.00cvss —epss 0.02
Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters.
CVE-2002-0302May 31, 2002
Symantec
Enterprise Firewall
risk 0.00cvss —epss 0.01
The Notify daemon for Symantec Enterprise Firewall (SEF) 6.5.x drops large alerts when SNMP is used as the transport, which could prevent some alerts from being sent in the event of an attack.
CVE-2002-0303May 31, 2002
Novell
Groupwise
risk 0.00cvss —epss 0.00
GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of other users by logging in without a password.
CVE-2002-0304May 31, 2002
Summit Computer Networks
Lil HTTP Server
risk 0.00cvss —epss 0.02
Lil HTTP Server 2.1 allows remote attackers to read password-protected files via a /./ in the HTTP request.
CVE-2002-0305May 31, 2002
Zero One Tech
P100s
risk 0.00cvss —epss 0.01
Zero One Tech (ZOT) P100s print server does not properly disable the SNMP service or change the default password, which could leave the server open to attack without the administrator's knowledge.
CVE-2002-0306May 31, 2002
Avengers News System
Avengers News System
risk 0.00cvss —epss 0.03
ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the p (plugin) parameter.
CVE-2002-0307May 31, 2002
Avengers News System
ANS
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existence of arbitrary files or execute any Perl program on the system via a .. (dot dot) in the p parameter, which reads the target file and…
CVE-2002-0308May 31, 2002
Stefan Holmberg
Admentor
risk 0.00cvss —epss 0.03
admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments.
CVE-2002-0309May 31, 2002
Symantec
Enterprise Firewall
risk 0.00cvss —epss 0.02
SMTP proxy in Symantec Enterprise Firewall (SEF) 6.5.x includes the firewall's physical interface name and address in an SMTP protocol exchange when NAT translation is made to an address other than the firewall, which could allow remote attackers to determine certain firewall…
CVE-2002-0310May 31, 2002
Netwin
Webnews
risk 0.00cvss —epss 0.02
Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations (1) testweb/newstest, (2) alwn3845/imaptest, (3)…
CVE-2002-0311May 31, 2002
Caldera
Unixware
risk 0.03cvss —epss 0.05
Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell metacharacters in the -c argument for (1) in scoadminreg.cgi or (2) service_action.cgi.
CVE-2002-0033May 29, 2002
Sun Corporation
Solaris
risk 0.05cvss —epss 0.23
Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.
CVE-2002-0155May 29, 2002
Microsoft
Msn Messenger
risk 0.02cvss —epss 0.24
Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX.
CVE-2002-0169May 29, 2002
Red Hat
Docbook Stylesheets
risk 0.00cvss —epss 0.00
The default stylesheet for DocBook on Red Hat Linux 6.2 through 7.2 is installed with an insecure option enabled, which could allow users to overwrite files outside of the current directory from an untrusted document by using a full pathname as an element identifier.
CVE-2002-0174May 29, 2002
Sgi
Irix
risk 0.00cvss —epss 0.00
nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file.
CVE-2002-0178May 29, 2002
sharutils
uudecode
risk 0.00cvss —epss 0.01
uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands.
CVE-2002-0188May 29, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.16
Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than…
CVE-2002-0189May 29, 2002
Microsoft
Internet Explorer
risk 0.04cvss —epss 0.14
Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability.
CVE-2002-0190May 29, 2002
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.24
Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability.
CVE-2002-0191May 29, 2002
Microsoft
Internet Explorer
risk 0.05cvss —epss 0.30
Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script containing the cssText property of the stylesheet object, aka "Local Information Disclosure through HTML Object" vulnerability.
CVE-2002-0193May 29, 2002
Microsoft
Internet Explorer
risk 0.06cvss —epss 0.33
Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than…
CVE-2002-0232May 29, 2002
Mrtg
Multi Router Traffic Grapher Cgi
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Multi Router Traffic Grapher (MRTG) allows remote attackers to read portions of arbitrary files via a .. (dot dot) in the cfg parameter for (1) 14all.cgi, (2) 14all-1.1.cgi, (3) traffic.cgi, or (4) mrtg.cgi.
CVE-2002-0233May 29, 2002
Eshare
Eshare Expressions
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in eshare Expressions 4 Web server allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request.
CVE-2002-0234May 29, 2002
Netscreen
Screenos
risk 0.00cvss —epss 0.00
NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trusted network to cause a denial of service (resource exhaustion) via a port scan to an external network, which consumes all available…
CVE-2002-0235May 29, 2002
Castelle
Faxpress
risk 0.00cvss —epss 0.01
Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error…
CVE-2002-0236May 29, 2002
Lucent
Vitalanalysis
risk 0.04cvss —epss 0.07
Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.
CVE-2002-0237May 29, 2002
Iss
Blackice Defender
risk 0.00cvss —epss 0.04
Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a flood of large ICMP ping packets.
CVE-2002-0238May 29, 2002
Netgear
Rt314
risk 0.00cvss —epss 0.02
Cross-site scripting vulnerability in web administration interface for NetGear RT314 and RT311 Gateway Routers allows remote attackers to execute arbitrary script on another client via a URL that contains the script.
CVE-2002-0239May 29, 2002
Hanterm
Hanterm Xf
risk 0.03cvss —epss 0.01
Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) -hfn argument.
CVE-2002-0240May 29, 2002
PHP
PHP
risk 0.01cvss —epss 0.08
PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
CVE-2002-0241May 29, 2002
Cisco Systems, Inc.
Secure Access Control Server
risk 0.00cvss —epss 0.02
NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server.
CVE-2002-0242May 29, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.11
Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.
CVE-2002-0243May 29, 2002
Opera
Opera
risk 0.00cvss —epss 0.01
Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.
CVE-2002-0244May 29, 2002
Atheos
Atheos
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir.
CVE-2002-0245May 29, 2002
Lotus
Domino
risk 0.00cvss —epss 0.03
Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a nonexistent file with a .pl (Perl) extension, which leaks the pathname in the error message, or (2) make any request that causes an HTTP…
CVE-2002-0246May 29, 2002
Caldera
Unixware
risk 0.03cvss —epss 0.01
Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying the LC_MESSAGE environment variable to read other message catalogs containing format strings from setuid programs such as vxprint.