WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Published from 2002-01-01✕Published to 2002-12-31✕
Overview 2,170 matches · 37 in Waratek scope · 3 protected · 12 exploited · 1 CISA KEV · 551 public PoC · 34 EPSS ≥ 0.5
2,170matches 37in Waratek scope1.7% 3protected0.1% 12exploited0.6% 1CISA KEV0.0% 551public PoC25.4% 34EPSS ≥ 0.51.6%
Protected by Waratek 3 0.1% Rule in development 0 0.0% Mitigation candidate 8 0.4% No exploit published 26 1.2% Outside Waratek scope 12 0.6% Not applicable 2,107 97.1% Withdrawn CVE 14 0.6%
Critical 10 0.5% High 1,023 47.1% Medium 980 45.2% Low 143 6.6% None 0 0.0% Unknown 14 0.6%
blocked by ARMR today 3 0.1% partly blocked 0 0.0% not blocked 2,167 99.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 12 0.6% Working exploit published 545 25.1% Proof of concept only 0 0.0% Forecast only 9 0.4% No public exploit 1,604 73.9%
split by peak 879 / month
Withdrawn CVE: 14Not applicable: 2,107Outside Waratek scope: 12No exploit published: 26Mitigation candidate: 8Protected by Waratek: 3 Unknown: 14Low: 143Medium: 980High: 1,023Critical: 10 not blocked: 2,167blocked by ARMR today: 3 No public exploit: 1,604Forecast only: 9Working exploit published: 545Exploited: 12
Jan 0225 Not applicable25 High12 Medium11 Low2 not blocked25 Working exploit published4 No public exploit21 Feb 0215 No exploit published3 Not applicable12 High9 Medium5 Low1 not blocked15 Working exploit published4 No public exploit11 Mar 02104 Protected by Waratek1 Mitigation candidate1 Outside Waratek scope2 Not applicable100 Critical2 High54 Medium38 Low10 blocked by ARMR today1 not blocked103 Exploited1 Working exploit published22 No public exploit81 Apr 0245 No exploit published2 Not applicable43 High34 Medium11 not blocked45 Working exploit published7 Forecast only5 No public exploit33 May 02150 Not applicable148 Withdrawn CVE2 High80 Medium56 Low12 Unknown2 not blocked150 Working exploit published37 No public exploit113 Jun 02102 Not applicable102 High54 Medium44 Low4 not blocked102 Exploited1 Working exploit published31 No public exploit70 Jul 02137 Mitigation candidate1 No exploit published5 Outside Waratek scope2 Not applicable129 Critical2 High93 Medium38 Low4 not blocked137 Exploited1 Working exploit published31 Forecast only2 No public exploit103 Aug 02256 No exploit published1 Outside Waratek scope3 Not applicable251 Withdrawn CVE1 Critical1 High138 Medium100 Low16 Unknown1 not blocked256 Exploited1 Working exploit published61 Forecast only2 No public exploit192 Sep 0268 Outside Waratek scope2 Not applicable66 High45 Medium19 Low4 not blocked68 Working exploit published21 No public exploit47 Oct 02314 Mitigation candidate2 No exploit published3 Outside Waratek scope2 Not applicable307 High156 Medium148 Low10 not blocked314 Exploited4 Working exploit published96 No public exploit214 Nov 0275 Not applicable74 Withdrawn CVE1 High38 Medium33 Low3 Unknown1 not blocked75 Exploited1 Working exploit published17 No public exploit57 Dec 02879 Protected by Waratek2 Mitigation candidate4 No exploit published12 Outside Waratek scope1 Not applicable850 Withdrawn CVE10 Critical5 High310 Medium477 Low77 Unknown10 blocked by ARMR today2 not blocked877 Exploited3 Working exploit published214 No public exploit662
Jan 02Feb 02Mar 02Apr 02May 02Jun 02Jul 02Aug 02Sep 02Oct 02Nov 02Dec 02
2,170 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 22 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2002-2426 Medium 2002-12-31 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information.
CVE-2002-2425 High 2002-12-31 Not applicable Working exploit published Sun AnswerBook2 1.2 through 1.4.2 allows remote attackers to execute administrative scripts such as (1) AdminViewError and (2) AdminAddadmin via a direct request.
CVE-2002-2424 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in PHP(Reactor) 1.2.7 pl1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the style attribute of an HTML tag.
CVE-2002-2423 Medium 2002-12-31 Not applicable No public exploit Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address from being logged via a long IDENT response.
CVE-2002-2422 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in Compaq Insight Management Agents 2.0, 2.1, 3.6.0, 4.2 and 4.3.7 allows remote attackers to inject arbitrary web script or HTML via a URL, which inserts the script into the resulting error message.
CVE-2002-2421 High 2002-12-31 Not applicable No public exploit acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2.
CVE-2002-2420 High 2002-12-31 Not applicable Working exploit published site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.
CVE-2002-2419 High 2002-12-31 Not applicable No public exploit Direct connect text client (DCTC) client 0.83.3 allows remote attackers to cause a denial of service (crash) via a string ending with a NULL byte character.
CVE-2002-2418 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in acFreeProxy (aka acFP) 1.33 beta 7 allows remote attackers to inject arbitrary web script or HTML via the URL, which is inserted into an error page.
CVE-2002-2417 High 2002-12-31 Not applicable Working exploit published acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges.
CVE-2002-2416 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request.
CVE-2002-2415 Medium 2002-12-31 Not applicable No public exploit Allied Telesyn AT-8024 1.3.1 and Rapier 24 switches allow remote authenticated users to cause a denial of service in the management interface via a stream of zero (null) bytes sent via UDP to a running service.
CVE-2002-2414 Medium 2002-12-31 Not applicable No public exploit Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority (CA) certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service (crash).
CVE-2002-2413 Medium 2002-12-31 Not applicable No public exploit WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name.
CVE-2002-2412 Low 2002-12-31 Not applicable No public exploit Winamp 2.80 stores authentication credentials in plaintext in the (1) [HTTP-AUTH] and (2) [winamp] sections in winamp.ini, which allows local users to gain access to other accounts.
CVE-2002-2411 High 2002-12-31 Not applicable No public exploit Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command.
CVE-2002-2410 Medium 2002-12-31 Not applicable No public exploit openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information.
CVE-2002-2409 Low 2002-12-31 Not applicable No public exploit Photon microGUI in QNX Neutrino realtime operating system (RTOS) 6.1.0 and 6.2.0 allows attackers to read user clipboard information via a direct request to the 1.TEXT file in a directory whose name is a hex-encoded user ID.
CVE-2002-2408 High 2002-12-31 Not applicable No public exploit Gordano Messaging Server (GMS) Mail 8 (a.k.a. NTMail) only filters email messages for the first recipient, which allows remote attackers to bypass JUCE filters by sending a message to more than one user on the GMS server.
CVE-2002-2407 Medium 2002-12-31 Not applicable No public exploit Certain patches for QNX Neutrino realtime operating system (RTOS) 6.2.0 set insecure permissions for the files (1) /sbin/io-audio by OS Update Patch A, (2) /bin/shutdown, (3) /sbin/fs-pkg, and (4) phshutdown by QNX experimental patches, (5) cpim, (6) vpim, (7) phrelaycfg, and (8) columns, (9) othello, (10) peg, (11) solitaire, and (12) vpoker in the games pack 2.0.3, which allows local users to gain privileges by modifying the files before permissions are changed.
CVE-2002-2406 Medium 2002-12-31 Not applicable No public exploit Buffer overflow in HTTP server in LiteServe 2.0, 2.0.1 and 2.0.2 allows remote attackers to cause a denial of service (hang) via a large number of percent characters (%) in an HTTP GET request.
CVE-2002-2405 Medium 2002-12-31 Not applicable No public exploit Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall.
CVE-2002-2404 Medium 2002-12-31 Not applicable Working exploit published Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP port 110).
CVE-2002-2403 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...", "....", ".....", and other multiple dot sequences.
CVE-2002-2402 High 2002-12-31 Not applicable No public exploit SURECOM broadband router EP-4501 uses a default SNMP read community string of "public" and a default SNMP read/write community string of "secret," which allows remote attackers to read and modify router configuration information.
CVE-2002-2401 Low 2002-12-31 Not applicable No public exploit NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs.
CVE-2002-2400 High 2002-12-31 Not applicable Working exploit published Buffer overflow in the httpdProcessRequest function in LibHTTPD 1.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP POST request.
CVE-2002-2399 Medium 2002-12-31 Not applicable Working exploit published Directory traversal vulnerability in viewAttachment.cgi in W3Mail 1.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2002-2398 Medium 2002-12-31 Not applicable No public exploit The new thread posting page in APBoard 2.02 and 2.03 allows remote attackers to post messages to protected forums by modifying the insertinto parameter.
CVE-2002-2397 High 2002-12-31 Not applicable No public exploit Sygate personal firewall 5.0 could allow remote attackers to bypass firewall filters via spoofed (1) source IP address of 127.0.0.1 or (2) network address of 127.0.0.0.
CVE-2002-2396 High 2002-12-31 Not applicable No public exploit Buffer overflow in Advanced TFTP (atftp) 0.5 and 0.6, if installed setuid or setgid, may allow local users to execute arbitrary code via a long argument to the -g option.
CVE-2002-2395 Medium 2002-12-31 Not applicable No public exploit InterScan VirusWall 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 gzip content encoding.
CVE-2002-2394 Medium 2002-12-31 Not applicable No public exploit InterScan VirusWall 3.6 for Linux and 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 chunked transfer encoding.
CVE-2002-2393 Medium 2002-12-31 Not applicable No public exploit Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights, which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands.
CVE-2002-2392 Medium 2002-12-31 Not applicable No public exploit Winamp 2.65 through 3.0 stores skin files in a predictable file location, which allows remote attackers to execute arbitrary code via a URL reference to (1) wsz and (2) wal files that contain embedded code.
CVE-2002-2391 High 2002-12-31 Not applicable No public exploit SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
CVE-2002-2390 High 2002-12-31 Not applicable No public exploit Buffer overflow in the IDENT daemon (identd) in Trillian 0.6351, 0.725, 0.73, 0.74 and 1.0 pro allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long request.
CVE-2002-2389 Medium 2002-12-31 Not applicable No public exploit TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files.
CVE-2002-2388 Medium 2002-12-31 Not applicable No public exploit Buffer overflow in INweb POP3 mail server 2.01 allows remote attackers to cause a denial of service (crash) via a long HELO command.
CVE-2002-2387 Medium 2002-12-31 Not applicable No public exploit Directory traversal vulnerability in Hyperion FTP server 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the LS command.
CVE-2002-2386 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Quizz module for XOOPS 1.0, when allowing on-line question development, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the SRC attribute of an IMG tag.
CVE-2002-2385 High 2002-12-31 Not applicable Working exploit published Buffer overflow in hotfoon4.exe in Hotfoon 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL containing a long voice phone number.
CVE-2002-2384 Low 2002-12-31 Not applicable No public exploit hotfoon4.exe in Hotfoon 4.00 stores user names and passwords in cleartext in the hotfoon2 registry key, which allows local users to gain access to user accounts and steal phone service.
CVE-2002-2383 High 2002-12-31 Not applicable No public exploit SQL injection vulnerability in f2html.pl 0.1 through 0.4 allows remote attackers to execute arbitrary SQL commands via file names.
CVE-2002-2382 High 2002-12-31 Not applicable No public exploit cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out.
CVE-2002-2381 High 2002-12-31 Not applicable No public exploit Multiple buffer overflows in (1) tetrinet_inmessage, (2) speclist_add and (3) config-getthemeinfo of GTetrinet 0.4.3 and earlier allow remote attackers to casue a denial of service and possibly execute arbitrary code.
CVE-2002-2380 Medium 2002-12-31 Not applicable No public exploit NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic.
CVE-2002-2379 High 2002-12-31 Not applicable Working exploit published Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor
CVE-2002-2378 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in AN HTTP 1.41d allows remote attackers to inject arbitrary web script or HTML via a colon (:) in the query string, which is inserted into the resulting error page.
CVE-2002-2377 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in addentry.cgi in ZAP 1.0.3 allows remote attackers to inject arbitrary SSi directives, web script, and HTML via the entry field.
CVE-2002-2376 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in E-Guest_sign.pl in E-Guest 1.1 allows remote attackers to inject arbitrary SSI directives, web script, and HTML via the (1) full name, (2) email, (3) homepage, and (4) location parameters. NOTE: this issue might overlap CVE-2005-1605.
CVE-2002-2375 Medium 2002-12-31 Not applicable No public exploit Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user, although there is a possibility that it could be used to infer product version information.
CVE-2002-2374 High 2002-12-31 Not applicable No public exploit Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files."
CVE-2002-2373 High 2002-12-31 Not applicable No public exploit The default configuration of the TCP/IP printer configuration utility in Apple LaserWriter 12/640 PS printer contains a blank Telnet password, which allows remote attackers to gain access.
CVE-2002-2372 Medium 2002-12-31 Not applicable No public exploit The telnet server in Infoprint 21 running controller software before 1.056007 allows remote attackers to cause a denial of service (crash) via a long username, possibly due to a buffer overflow.
CVE-2002-2371 High 2002-12-31 Not applicable No public exploit Linksys WET11 firmware 1.31 and 1.32 allows remote attackers to cause a denial of service (crash) via a packet containing the device's hardware address as the source MAC address in the DLC header.
CVE-2002-2370 Medium 2002-12-31 Not applicable Working exploit published SWS web server 0.0.4, 0.0.3 and 0.1.0 allows remote attackers to cause a denial of service (crash) via a URL request that does not end with a newline.
CVE-2002-2369 Medium 2002-12-31 Not applicable No public exploit Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL.
CVE-2002-2368 High 2002-12-31 Not applicable No public exploit Multiple buffer overflows in NEC SOCKS5 1.0 r11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long username to (1) the GetString function in proxy.c for the SOCKS5 module or (2) the HandleS4Connection function in proxy.c for the SOCKS4 module.
CVE-2002-2367 High 2002-12-31 Not applicable No public exploit Off-by-one buffer overflow in NEC SOCKS5 1.0 r11 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long hostname.
CVE-2002-2366 Medium 2002-12-31 Not applicable No public exploit Buffer overflow in the XML parser of Trillian 0.6351, 0.725 and 0.73 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a skin with a long colors file name in trillian.xml.
CVE-2002-2365 High 2002-12-31 Not applicable No public exploit Simple WAIS (SWAIS) 1.11 allows remote attackers to execute arbitrary commands via the shell metacharacters in the search field, as demonstrated using the "|" (pipe) character.
CVE-2002-2364 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in PHP Ticket 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a help ticket.
CVE-2002-2363 High 2002-12-31 Not applicable No public exploit VJE.VJE-RUN in HP-UX 11.00 adds bin to /etc/PATH, which could allow local users to gain privileges.
CVE-2002-2362 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in form_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML via the noticemsg parameter.
CVE-2002-2361 Medium 2002-12-31 Not applicable No public exploit The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan programs via DNS spoofing.
CVE-2002-2360 High 2002-12-31 Not applicable Working exploit published The RPC module in Webmin 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remote_foreign_require and remote_foreign_call requests.
CVE-2002-2359 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the FTP view feature in Mozilla 1.0 allows remote attackers to inject arbitrary web script or HTML via the title tag of an ftp URL.
CVE-2002-2358 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the FTP view feature in Opera 6.0 and 6.01 through 6.04 allows remote attackers to inject arbitrary web script or HTML via the title tag of an FTP URL.
CVE-2002-2357 Medium 2002-12-31 Not applicable Working exploit published MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a buffer overflow.
CVE-2002-2356 Medium 2002-12-31 Not applicable No public exploit HAMweather 2.x allows remote attackers to modify administrative settings and obtain sensitive information via a direct request to hwadmin.cgi.
CVE-2002-2355 High 2002-12-31 Not applicable No public exploit Netgear FM114P firmware 1.3 wireless firewall, when configured to backup configuration information, stores DDNS (DynDNS) user name and password, MAC address filtering table and possibly other information in cleartext, which could allow local users to obtain sensitive information.
CVE-2002-2354 High 2002-12-31 Not applicable No public exploit Netgear FM114P firmware 1.3 wireless firewall allows remote attackers to cause a denial of service (crash or hang) via a large number of TCP connection requests.
CVE-2002-2353 Medium 2002-12-31 Not applicable Working exploit published tftpd32 2.50 and 2.50.2 allows remote attackers to read or write arbitrary files via a full pathname in GET and PUT requests.
CVE-2002-2352 Medium 2002-12-31 Not applicable No public exploit The NBActiveX.ocx ActiveX control in NeoBook 4 allows remote attackers to install and execute arbitrary programs.
CVE-2002-2351 Medium 2002-12-31 Not applicable Working exploit published Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a trailing "." (dot).
CVE-2002-2350 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in z_user_show.php in dbtreelistproperty_method.php in Zorum 2.4 allows remote attackers to inject arbitrary web script or HTML via the class parameter.
CVE-2002-2349 Medium 2002-12-31 Not applicable Working exploit published phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information.
CVE-2002-2348 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in athcgi.exe in Authoria HR allows remote attackers to inject arbitrary web script or HTML via the command parameter.
CVE-2002-2347 Medium 2002-12-31 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field.
CVE-2002-2346 Medium 2002-12-31 Not applicable No public exploit phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses.
CVE-2002-2345 High 2002-12-31 Not applicable No public exploit Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, which allows remote attackers to gain access.
CVE-2002-2344 Medium 2002-12-31 Not applicable No public exploit Ensim WEBppliance 3.0 and 3.1 allows remote attackers to read mail intended for other users by defining an alias that is the target's email address.
CVE-2002-2343 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email messages.
CVE-2002-2342 Medium 2002-12-31 Not applicable No public exploit Bannermatic 1, 2, and 3 stores the (1) ban.log, (2) ban.bak, (3) ban.dat and (4) banmat.pwd data files under the web document root with insufficient access control, which allows attackers to obtain sensitive information via a direct request for the files.
CVE-2002-2341 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web script or HTML via a blocked URL.
CVE-2002-2340 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response.
CVE-2002-2339 Medium 2002-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in (1) image, (2) img, (3) image=right, (4) img=right, (5) image=left, and (6) img=left tags.
CVE-2002-2338 Medium 2002-12-31 Not applicable Working exploit published The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of service (no new mail) via a mail message containing a dot (.) at a newline, which is interpreted as the end of the message.
CVE-2002-2337 Medium 2002-12-31 Not applicable No public exploit Kaspersky Anti-Hacker 1.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVE-2002-2336 Medium 2002-12-31 Not applicable Working exploit published Norton Personal Firewall 2002 4.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVE-2002-2335 Medium 2002-12-31 Not applicable Working exploit published Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain user names and passwords and log in using protection.php.
CVE-2002-2334 Low 2002-12-31 Not applicable No public exploit Joe text editor 2.8 through 2.9.7 does not remove the group and user setuid bits for backup files, which could allow local users to execute arbitrary setuid and setgid root programs when root edits scripts owned by other users.
CVE-2002-2333 Medium 2002-12-31 Not applicable No public exploit Buffer overflow in konqueror in KDE 2.1 through 3.0 and 3.0.2 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes.
CVE-2002-2332 Medium 2002-12-31 Not applicable No public exploit Buffer overflow in Opera 6.01 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes.
CVE-2002-2331 Medium 2002-12-31 Not applicable No public exploit W3Mail 1.0.2 through 1.0.5 with server side scripting (SSI) enabled in the attachments directory does not properly restrict the types of files that can be uploaded as attachments, which allows remote attackers to execute arbitrary code by sending code in MIME attachments, then requesting the attachments.
CVE-2002-2330 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to stats.html and executed in client browsers.
CVE-2002-2329 High 2002-12-31 Not applicable No public exploit ICQ client 2001b, 2002a and 2002b allows remote attackers to cause a denial of service (CPU consumption or crash) via a message with a large number of emoticons.
CVE-2002-2328 High 2002-12-31 Not applicable No public exploit Active Directory in Windows 2000, when supporting Kerberos V authentication and GSSAPI, allows remote attackers to cause a denial of service (hang) via an LDAP client that sets the page length to zero during a large request.
CVE-2002-2327 Medium 2002-12-31 Not applicable No public exploit Unspecified vulnerability in the environmental monitoring subsystem in Solaris 8 running on Sun Fire 280R, V480 and V880 allows local users to cause a denial of service by setting volatile properties.
‹ prev page 1 of 22 next ›