WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2002-10-31✕
Overview 5,522 matches · 47 in Waratek scope · 2 protected · 32 exploited · 1 CISA KEV · 1,682 public PoC · 92 EPSS ≥ 0.5
5,522matches 47in Waratek scope0.9% 2protected0.0% 32exploited0.6% 1CISA KEV0.0% 1,682public PoC30.5% 92EPSS ≥ 0.51.7%
Protected by Waratek 2 0.0% Rule in development 0 0.0% Mitigation candidate 12 0.2% No exploit published 33 0.6% Outside Waratek scope 28 0.5% Not applicable 5,406 97.9% Withdrawn CVE 41 0.7%
Critical 26 0.5% High 2,725 49.3% Medium 2,221 40.2% Low 509 9.2% None 0 0.0% Unknown 41 0.7%
blocked by ARMR today 2 0.0% partly blocked 0 0.0% not blocked 5,520 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 32 0.6% Working exploit published 1,659 30.0% Proof of concept only 0 0.0% Forecast only 15 0.3% No public exploit 3,816 69.1%
split by peak 1,679 / year
Withdrawn CVE: 41Not applicable: 5,406Outside Waratek scope: 28No exploit published: 33Mitigation candidate: 12Protected by Waratek: 2 Unknown: 41Low: 509Medium: 2,221High: 2,725Critical: 26 not blocked: 5,520blocked by ARMR today: 2 No public exploit: 3,816Forecast only: 15Working exploit published: 1,659Exploited: 32
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19893 Not applicable3 High2 Medium1 not blocked3 No public exploit3 199011 Not applicable11 High8 Medium2 Low1 not blocked11 Working exploit published1 No public exploit10 199115 Not applicable15 High11 Medium4 not blocked15 Working exploit published2 No public exploit13 199214 Not applicable13 Withdrawn CVE1 High12 Low1 Unknown1 not blocked14 No public exploit14 199313 Not applicable13 High8 Medium3 Low2 not blocked13 No public exploit13 199426 Not applicable25 Withdrawn CVE1 High14 Medium10 Low1 Unknown1 not blocked26 Working exploit published6 No public exploit20 199525 Not applicable25 Critical1 High17 Medium6 Low1 not blocked25 Working exploit published5 No public exploit20 199675 No exploit published1 Not applicable73 Withdrawn CVE1 Critical1 High43 Medium21 Low9 Unknown1 not blocked75 Working exploit published18 Forecast only1 No public exploit56 1997253 Not applicable252 Withdrawn CVE1 Critical1 High143 Medium89 Low19 Unknown1 not blocked253 Exploited2 Working exploit published73 Forecast only2 No public exploit176 1998247 Not applicable246 Withdrawn CVE1 Critical1 High137 Medium85 Low23 Unknown1 not blocked247 Exploited1 Working exploit published50 No public exploit196 1999923 No exploit published2 Outside Waratek scope1 Not applicable891 Withdrawn CVE29 Critical3 High423 Medium357 Low111 Unknown29 not blocked923 Exploited2 Working exploit published282 No public exploit639 20001,020 Mitigation candidate6 No exploit published6 Outside Waratek scope2 Not applicable1,005 Withdrawn CVE1 Critical2 High454 Medium467 Low96 Unknown1 not blocked1,020 Exploited5 Working exploit published427 Forecast only1 No public exploit587 20011,679 Protected by Waratek1 Mitigation candidate2 No exploit published10 Outside Waratek scope14 Not applicable1,649 Withdrawn CVE3 Critical12 High776 Medium706 Low182 Unknown3 blocked by ARMR today1 not blocked1,678 Exploited14 Working exploit published480 Forecast only2 No public exploit1,183 20021,216 Protected by Waratek1 Mitigation candidate4 No exploit published14 Outside Waratek scope11 Not applicable1,183 Withdrawn CVE3 Critical5 High675 Medium470 Low63 Unknown3 blocked by ARMR today1 not blocked1,215 Exploited8 Working exploit published314 Forecast only9 No public exploit885
19881990199219941996199820002002
5,522 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 56 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2002-1003 High 2002-10-04 Not applicable No public exploit Buffer overflow in MyWebServer 1.02 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVE-2002-1002 Medium 2002-10-04 Not applicable No public exploit Buffer overflow in Novell iManager (eMFrame 1.2.1) allows remote attackers to cause a denial of service (crash) via a long user name.
CVE-2002-1001 High 2002-10-04 Not applicable Working exploit published Buffer overflows in AnalogX Proxy before 4.12 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a long HTTP request to TCP port 6588 or (2) a SOCKS 4A request to TCP port 1080 with a long DNS hostname.
CVE-2002-1000 High 2002-10-04 Not applicable No public exploit Buffer overflow in AnalogX SimpleServer:Shout 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long request to TCP port 8001.
CVE-2002-0999 High 2002-10-04 Not applicable No public exploit Multiple SQL injection vulnerabilities in CARE 2002 before beta 1.0.02 allow remote attackers to perform unauthorized database operations.
CVE-2002-0998 Medium 2002-10-04 Not applicable No public exploit Directory traversal vulnerability in cafenews.php for CARE 2002 before beta 1.0.02 allows remote attackers to read arbitrary files via .. (dot dot) sequences and null characters in the lang parameter, which is processed by a call to the include function.
CVE-2002-0997 Medium 2002-10-04 Not applicable No public exploit Buffer overflows in IMAP Agent (imapd) for Novell NetMail (NIMS) 3.0.3 before 3.0.3A allows remote attackers to cause a denial of service.
CVE-2002-0996 High 2002-10-04 Not applicable No public exploit Multiple buffer overflows in Novell NetMail (NIMS) 3.0.3 before 3.0.3C allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) WebAdmin or (2) ModWeb.
CVE-2002-0995 High 2002-10-04 Not applicable Working exploit published login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert," which adds the provided username to the adminUsers table.
CVE-2002-0994 High 2002-10-04 Not applicable Working exploit published SunPCi II VNC uses a weak authentication scheme, which allows remote attackers to obtain the VNC password by sniffing the random byte challenge, which is used as the key for encrypted communications.
CVE-2002-0993 Medium 2002-10-04 Not applicable No public exploit Unknown vulnerability in HP Instant Support Enterprise Edition (ISEE) product U2512A for HP-UX 11.00 and 11.11 may allow authenticated users to access restricted files.
CVE-2002-0992 Low 2002-10-04 Not applicable No public exploit Unknown vulnerability in IPV6 functionality for DCE daemons (1) dced or (2) rpcd on HP-UX 11.11 allows attackers to cause a denial of service (crash) via an attack that modifies internal data.
CVE-2002-0991 High 2002-10-04 Not applicable Working exploit published Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier, based on the Sharity package, allows local users to gain root privileges via long (1) -U, (2) -D, (3) -P, (4) -S, (5) -N, or (6) -u parameters.
CVE-2002-0968 High 2002-10-04 Not applicable Working exploit published Buffer overflow in AnalogX SimpleServer:WWW 1.16 and earlier allows remote attackers to cause a denial of service (crash) and execute code via a long HTTP request method name.
CVE-2002-0967 High 2002-10-04 Not applicable No public exploit Buffer overflow in eDonkey 2000 35.16.60 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long "ed2k:" URL.
CVE-2002-0966 High 2002-10-04 Not applicable No public exploit Buffer overflow in 4D web server 6.7.3 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.
CVE-2002-0965 High 2002-10-04 Not applicable Working exploit published Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file.
CVE-2002-0964 Medium 2002-10-04 Not applicable Working exploit published Half-Life Server 1.1.1.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via multiple responses to the initial challenge with different cd_key values, which reaches the player limit and prevents other players from connecting until the original responses have timed out.
CVE-2002-0963 Medium 2002-10-04 Not applicable No public exploit SQL injection vulnerability in comment.php for GeekLog 1.3.5 and earlier allows remote attackers to obtain sensitive user information via the pid parameter.
CVE-2002-0962 High 2002-10-04 Not applicable Working exploit published Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via (1) the url variable in the Link field of a calendar event, (2) the topic parameter in index.php, or (3) the title parameter in comment.php.
CVE-2002-0961 High 2002-10-04 Not applicable Working exploit published Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other users, e.g. by deleting clients via dltclnt.php, possibly in a SQL injection attack.
CVE-2002-0960 High 2002-10-04 Not applicable No public exploit Multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allows remote attackers to execute arbitrary script as other CBMS users.
CVE-2002-0959 High 2002-10-04 Not applicable Working exploit published Cross-site scripting vulnerability in Splatt Forum 3.0 allows remote attackers to execute arbitrary script as other users via an [img] tag with a closing quote followed by the script.
CVE-2002-0958 High 2002-10-04 Not applicable No public exploit Cross-site scripting vulnerability in browse.php for PHP(Reactor) 1.2.7 allows remote attackers to execute script as other users via the go parameter in the comments section.
CVE-2002-0957 Medium 2002-10-04 Not applicable No public exploit The default configuration of BlackICE Agent 3.1.eal and 3.1.ebh has a high tcp.maxconnections setting, which could allow remote attackers to cause a denial of service (memory consumption) via a large number of connections to the BlackICE system that consumes more resources than intended by the user.
CVE-2002-0956 High 2002-10-04 Not applicable No public exploit BlackICE Agent 3.1.eal does not always reactivate after a system standby, which could allow remote attackers and local users to bypass intended firewall restrictions.
CVE-2002-0955 High 2002-10-04 Not applicable Working exploit published Cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier allows remote attackers to execute arbitrary script as other web site visitors via script in the num parameter, which is not filtered in the resulting error message.
CVE-2002-0954 High 2002-10-04 Not applicable No public exploit The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, which make it easier for an attacker to decrypt the passwords using brute force techniques.
CVE-2002-0953 High 2002-10-04 Not applicable Exploited globals.php in PHP Address before 0.2f, with the PHP allow_url_fopen and register_globals variables enabled, allows remote attackers to execute arbitrary PHP code via a URL to the code in the LangCookie parameter.
CVE-2002-0952 Medium 2002-10-04 Not applicable No public exploit Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service (reset) by sending IP packets with non-zero Type of Service (TOS) bits to the Timing Control Card (TCC) LAN interface.
CVE-2002-0951 High 2002-10-04 Not applicable Working exploit published SQL injection vulnerability in Ruslan <Body>Builder allows remote attackers to gain administrative privileges via a "'--" sequence in the username and password.
CVE-2002-0950 High 2002-10-04 Not applicable No public exploit Cross-site scripting vulnerability in TransWARE Active! mail 1.422 and 2.0 allows remote attackers to execute arbitrary code via a certain e-mail header, which is not properly filtered.
CVE-2002-0949 High 2002-10-04 Not applicable Working exploit published Telindus 1100 series ADSL router allows remote attackers to gain privileges to the device via a certain packet to UDP port 9833, which generates a reply that includes the router's password and other sensitive information in cleartext.
CVE-2002-0948 High 2002-10-04 Not applicable Working exploit published Scripts For Educators MakeBook 2.2 CGI program allows remote attackers to execute script as other visitors, or execute server-side includes (SSI) as the web server, via the (1) Name or (2) Email parameters, which are not properly filtered.
CVE-2002-0947 High 2002-10-04 Not applicable No public exploit Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary code via a long database name parameter.
CVE-2002-0946 Medium 2002-10-04 Not applicable Working exploit published Directory traversal vulnerability in SeaNox Devwex before 1.2002.0601 allows remote attackers to read arbitrary files via ..\ (dot dot) sequences in an HTTP request.
CVE-2002-0945 High 2002-10-04 Not applicable No public exploit Buffer overflow in SeaNox Devwex allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
CVE-2002-0944 High 2002-10-04 Not applicable No public exploit Cross-site scripting vulnerability in DeepMetrix LiveStats 5.03 through 6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via the (1) user-agent or (2) referrer, which are not filtered by the stats program.
CVE-2002-0943 Medium 2002-10-04 Not applicable No public exploit MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb.
CVE-2002-0942 High 2002-10-04 Not applicable Working exploit published Buffer overflows in Lugiment Log Explorer before 3.02 allow attackers with database permissions to execute arbitrary code via long arguments to the extended stored procedures (1) xp_logattach_StartProf, (2) xp_logattach_setport, or (3) xp_logattach.
CVE-2002-0941 Medium 2002-10-04 Not applicable No public exploit The ConsoleCallBack class for nCipher running under JRE 1.4.0 and 1.4.0_01, as used by the TrustedCodeTool and possibly other applications, may leak a passphrase when the user aborts an application that is prompting for the passphrase, which could allow attackers to gain privileges.
CVE-2002-0940 Medium 2002-10-04 Not applicable No public exploit domesticinstall.exe for nCipher MSCAPI CSP 5.50 and 5.54 does not use Operator Card Set protected keys when the user requests them but does not generate the Operator Card Set, which results in a lower protection level than specified by the user (module protection only).
CVE-2002-0939 Medium 2002-10-04 Not applicable No public exploit The Install Wizard for nCipher MSCAPI CSP 5.50 does not use Operator Card Set protected keys when the user requests them but does not generate the Operator Card Set, which results in a lower protection level than specified by the user (module protection only).
CVE-2002-0938 High 2002-10-04 Not applicable Working exploit published Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to setup.exe.
CVE-2002-0937 Medium 2002-10-04 Not applicable Working exploit published The Java Server Pages (JSP) engine in JRun allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).
CVE-2002-0936 Medium 2002-10-04 Mitigation candidate Working exploit published The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).
CVE-2002-0935 Medium 2002-10-04 No exploit published No public exploit Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
CVE-2002-0934 Medium 2002-10-04 Not applicable No public exploit Directory traversal vulnerability in Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) allows remote attackers to read or modify arbitrary files via an illegal character in the middle of a .. (dot dot) sequence in the parameters (1) _browser_out or (2) _out_file.
CVE-2002-0933 High 2002-10-04 Not applicable No public exploit Datalex PLC BookIt! Consumer before 2.2 stores usernames and passwords in plaintext in a cookie, which could allow remote attackers to gain privileges via Cross-site scripting or sniffing attacks.
CVE-2002-0932 Medium 2002-10-04 Not applicable Working exploit published SQL injection vulnerability in index.php for MyHelpDesk 20020509, and possibly other versions, allows remote attackers to conduct unauthorized activities via SQL code in the "id" parameter for the operations (1) detailticket, (2) editticket, or (3) updateticketlog.
CVE-2002-0931 High 2002-10-04 Not applicable Working exploit published Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to execute script as other users via a (1) Title or (2) Description when a new ticket is created by a support assistant, via the "id" parameter to the index.php script with the (3) tickettime, (4) ticketfiles, or (5) updateticketlog operations, or (6) via the update section when a ticket is edited.
CVE-2002-0930 Medium 2002-10-04 Not applicable No public exploit Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 (NWFTPD) allows remote attackers to cause a denial of service (ABEND) via format strings in the USER command.
CVE-2002-0929 Medium 2002-10-04 Not applicable No public exploit Buffer overflows in the DHCP server for NetWare 6.0 SP1 allow remote attackers to cause a denial of service (reboot) via long DHCP requests.
CVE-2002-0928 High 2002-10-04 Not applicable Working exploit published Buffer overflow in the Pirch 98 IRC client allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long hyperlink in a channel or private message.
CVE-2002-0926 Medium 2002-10-04 Not applicable Working exploit published Directory traversal vulnerability in Wolfram Research webMathematica 1.0.0 and 1.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the MSPStoreID parameter.
CVE-2002-0925 High 2002-10-04 Not applicable No public exploit Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or (3) the USER command to mmftpd 0.0.7 and earlier.
CVE-2002-0924 High 2002-10-04 Not applicable No public exploit CGIScript.net csNews.cgi allows remote authenticated users to execute arbitrary Perl code via terminating quotes and metacharacters in text fields of the "Advanced Settings" capability.
CVE-2002-0923 High 2002-10-04 Not applicable Working exploit published CGIScript.net csNews.cgi allows remote authenticated users to read arbitrary files, and possibly gain privileges, via the (1) pheader or (2) pfooter parameters in the "Advanced Settings" capability.
CVE-2002-0922 Medium 2002-10-04 Not applicable Working exploit published CGIScript.net csNews.cgi allows remote attackers to obtain database files via a direct URL-encoded request to (1) default%2edb or (2) default%2edb.style, or remote authenticated users to perform administrative actions via (3) a database parameter set to default%2edb.
CVE-2002-0921 Medium 2002-10-04 Not applicable No public exploit CGIScript.net csNews.cgi allows remote attackers to obtain potentially sensitive information, such as the full server pathname and other configuration settings, via the viewnews command with an invalid database, which leaks the information in error messages.
CVE-2002-0920 Medium 2002-10-04 Not applicable No public exploit CGIScript.net csPassword.cgi stores usernames and unencrypted passwords in the password.cgi.tmp temporary file while modifying data, which could allow local users (and possibly remote attackers) to gain privileges by stealing the file before it has been processed.
CVE-2002-0919 High 2002-10-04 Not applicable Working exploit published CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privileges via newlines in the title field of the edit page.
CVE-2002-0918 Medium 2002-10-04 Not applicable Working exploit published CGIScript.net csPassword.cgi leaks sensitive information such as the pathname of the server in debug messages that are presented when the script fails, which allows remote attackers to obtain the information via a "remove" option in the command parameter, which generates an error.
CVE-2002-0917 High 2002-10-04 Not applicable No public exploit CGIScript.net csPassword.cgi stores .htpasswd files under the web document root, which could allow remote authenticated users to download the file and crack the passwords of other users.
CVE-2002-0916 High 2002-10-04 Not applicable No public exploit Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call.
CVE-2002-0915 Low 2002-10-04 Not applicable No public exploit autorun in Xandros based Linux distributions allows local users to read the first line of arbitrary files via the -c parameter, which causes autorun to print the first line of the file.
CVE-2002-0914 Medium 2002-10-04 Not applicable No public exploit Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely large or negative value for the year, which causes a tight loop.
CVE-2002-0913 High 2002-10-04 Not applicable Working exploit published Format string vulnerability in log_doit function of Slurp NNTP client 1.1.0 allows a malicious news server to execute arbitrary code on the client via format strings in a server response.
CVE-2002-0912 Medium 2002-10-04 Not applicable No public exploit in.uucpd UUCP server in Debian GNU/Linux 2.2, and possibly other operating systems, does not properly terminate long strings, which allows remote attackers to cause a denial of service, possibly due to a buffer overflow.
CVE-2002-0911 High 2002-10-04 Not applicable No public exploit Caldera Volution Manager 1.1 stores the Directory Administrator password in cleartext in the slapd.conf file, which could allow local users to gain privileges.
CVE-2002-0910 High 2002-10-04 Not applicable No public exploit Buffer overflows in netstd 3.07-17 package allows remote DNS servers to execute arbitrary code via a long FQDN reply, as observed in the utilities (1) linux-ftpd, (2) pcnfsd, (3) tftp, (4) traceroute, or (5) from/to.
CVE-2002-0909 High 2002-10-04 Not applicable No public exploit Multiple buffer overflows in mnews 1.22 and earlier allow (1) a remote NNTP server to execute arbitrary code via long responses, or local users can gain privileges via long command line arguments (2) -f, (3) -n, (4) -D, (5) -M, or (6) -P, or via long environment variables (7) JNAMES or (8) MAILSERVER.
CVE-2002-0908 Medium 2002-10-04 Not applicable Working exploit published Directory traversal vulnerability in the web server for Cisco IDS Device Manager before 3.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTPS request.
CVE-2002-0907 High 2002-10-04 Not applicable Working exploit published Buffer overflow in SHOUTcast 1.8.9 and other versions before 1.8.12 allows a remote authenticated DJ to execute arbitrary code on the server via a long value in a header whose name begins with "icy-".
CVE-2002-0906 High 2002-10-04 Not applicable No public exploit Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malicious DNS server.
CVE-2002-0905 High 2002-10-04 Not applicable Working exploit published Buffer overflow in sqlexec for Informix SE-7.25 allows local users to gain root privileges via a long INFORMIXDIR environment variable.
CVE-2002-0904 High 2002-10-04 Not applicable No public exploit SayText function in Kismet 2.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters (backtick or pipe) in the essid argument.
CVE-2002-0903 High 2002-10-04 Not applicable No public exploit register.php for WoltLab Burning Board (wbboard) 1.1.1 uses a small number of random values for the "code" parameter that is provided to action.php to approve a new registration, along with predictable new user ID's, which allows remote attackers to hijack new user accounts via a brute force attack on the new user ID and the code value.
CVE-2002-0902 High 2002-10-04 Not applicable Working exploit published Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote (") in the [IMG] tag, which bypasses phpBB's security check, terminates the src parameter of the resulting HTML IMG tag, and injects the script.
CVE-2002-0901 High 2002-10-04 Not applicable No public exploit Multiple buffer overflows in Advanced Maryland Automatic Network Disk Archiver (AMANDA) 2.3.0.4 allow (1) remote attackers to execute arbitrary code via long commands to the amindexd daemon, or certain local users to execute arbitrary code via long command line arguments to the programs (2) amcheck, (3) amgetidx, (4) amtrmidx, (5) createindex-dump, or (6) createindex-gnutar.
CVE-2002-0900 High 2002-10-04 Not applicable Working exploit published Buffer overflow in pks PGP public key web server before 0.9.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long search argument to the lookup capability.
CVE-2002-0899 High 2002-10-04 Not applicable No public exploit Falcon web server 2.0.0.1021 and earlier allows remote attackers to bypass access restrictions for protected files via a URL whose directory portion ends in a . (dot).
CVE-2002-0898 Medium 2002-10-04 Not applicable Working exploit published Opera 6.0.1 and 6.0.2 allows a remote web site to upload arbitrary files from the client system, without prompting the client, via an input type=file tag whose value contains a newline.
CVE-2002-0897 High 2002-10-04 Not applicable Working exploit published LocalWEB2000 2.1.0 web server allows remote attackers to bypass access restrictions for restricted files via a URL that contains the "/./" directory.
CVE-2002-0896 Medium 2002-10-04 Not applicable No public exploit The throttle capability in Swatch may fail to report certain events if (1) the same type of event occurs after the throttle period, or (2) when multiple events matching the same "watchfor" expression do not occur after the throttle period, which could allow attackers to avoid detection.
CVE-2002-0895 High 2002-10-04 Not applicable Working exploit published Buffer overflow in MatuFtpServer 1.1.3.0 (1.1.3) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long PASS (password) command.
CVE-2002-0894 Medium 2002-10-04 Not applicable Working exploit published NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to cause a denial of service (crash) via (1) a request for a long .jsp file, or (2) a long URL sent directly to com.newatlanta.servletexec.JSP10Servlet.
CVE-2002-0893 Medium 2002-10-04 Not applicable Working exploit published Directory traversal vulnerability in NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to read arbitrary files via a URL-encoded request to com.newatlanta.servletexec.JSP10Servlet containing "..%5c" (modified dot-dot) sequences.
CVE-2002-0892 Medium 2002-10-04 Not applicable Working exploit published The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct request to com.newatlanta.servletexec.JSP10Servlet without a filename, which leaks the pathname in an error message.
CVE-2002-0891 Medium 2002-10-04 Not applicable No public exploit The web interface (WebUI) of NetScreen ScreenOS before 2.6.1r8, and certain 2.8.x and 3.0.x versions before 3.0.3r1, allows remote attackers to cause a denial of service (crash) via a long user name.
CVE-2002-0889 Medium 2002-10-04 Not applicable No public exploit Buffer overflow in Qpopper (popper) 4.0.4 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a long bulldir argument in the user's .qpopper-options configuration file.
CVE-2002-0888 High 2002-10-04 Not applicable No public exploit 3Com OfficeConnect Remote 812 ADSL Router, firmware 1.1.9 and 1.1.7, allows remote attackers to bypass port access restrictions by connecting to an approved port and quickly connecting to the desired port, which is allowed by the router.
CVE-2002-0887 Low 2002-10-04 Not applicable Working exploit published scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files.
CVE-2002-0886 Medium 2002-10-04 Not applicable Working exploit published Cisco DSL CPE devices running CBOS 2.4.4 and earlier allows remote attackers to cause a denial of service (hang or memory consumption) via (1) a large packet to the DHCP port, (2) a large packet to the Telnet port, or (3) a flood of large packets to the CPE, which causes the TCP/IP stack to consume large amounts of memory.
CVE-2002-0885 High 2002-10-04 Not applicable No public exploit Multiple buffer overflows in in.rarpd (ARP server) on Solaris, and possibly other operating systems including Caldera UnixWare and Open UNIX, allow remote attackers to execute arbitrary code, possibly via the functions (1) syserr and (2) error.
CVE-2002-0884 High 2002-10-04 Not applicable No public exploit Multiple format string vulnerabilities in in.rarpd (ARP server) on Solaris, Caldera UnixWare and Open UNIX, and possibly other operating systems, allows remote attackers to execute arbitrary code via format strings that are not properly handled in the functions (1) syserr and (2) error.
CVE-2002-0883 High 2002-10-04 Not applicable No public exploit Vulnerability in Compaq ProLiant BL e-Class Integrated Administrator 1.0 and 1.10, allows authenticated users with Telnet, SSH, or console access to conduct unauthorized activities.
CVE-2002-0882 Medium 2002-10-04 Not applicable No public exploit The web server for Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allows remote attackers to cause a denial of service (reset) and possibly read sensitive memory via a large integer value in (1) the stream ID of the StreamingStatistics script, or (2) the port ID of the PortInformation script.
CVE-2002-0881 Low 2002-10-04 Not applicable No public exploit Cisco IP Phone (VoIP) models 7910, 7940, and 7960 use a default administrative password, which allows attackers with physical access to the phone to modify the configuration settings.
CVE-2002-0880 Medium 2002-10-04 Not applicable No public exploit Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allow remote attackers to cause a denial of service (crash) via malformed packets as demonstrated by (1) "jolt", (2) "jolt2", (3) "raped", (4) "hping2", (5) "bloop", (6) "bubonic", (7) "mutant", (8) "trash", and (9) "trash2."
‹ prev page 3 of 56 next ›