Overview 2,239 matches · 17 in Waratek scope · 1 protected · 20 exploited · 0 CISA KEV · 713 public PoC · 46 EPSS ≥ 0.5
2,239matches
17in Waratek scope0.8%
1protected0.0%
20exploited0.9%
0CISA KEV0.0%
713public PoC31.8%
46EPSS ≥ 0.52.1%
Protected by Waratek
1
0.0%
Rule in development
0
0.0%
Mitigation candidate
2
0.1%
No exploit published
14
0.6%
Outside Waratek scope
8
0.4%
Not applicable
2,214
98.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.0%
partly blocked
0
0.0%
not blocked
2,238
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
20
0.9%
Working exploit published
696
31.1%
Proof of concept only
0
0.0%
Forecast only
5
0.2%
No public exploit
1,518
67.8%
split by
peak 776 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19892
Not applicable2
High2
not blocked2
No public exploit2
19908
Not applicable8
High8
not blocked8
No public exploit8
199111
Not applicable11
High11
not blocked11
Working exploit published2
No public exploit9
199212
Not applicable12
High12
not blocked12
No public exploit12
19938
Not applicable8
High8
not blocked8
No public exploit8
199414
Not applicable14
High14
not blocked14
Working exploit published3
No public exploit11
199517
Not applicable17
High17
not blocked17
Working exploit published2
No public exploit15
199643
No exploit published1
Not applicable42
High43
not blocked43
Working exploit published12
Forecast only1
No public exploit30
1997143
Not applicable143
High143
not blocked143
Exploited2
Working exploit published51
No public exploit90
1998137
Not applicable137
High137
not blocked137
Exploited1
Working exploit published33
No public exploit103
1999423
No exploit published2
Not applicable421
High423
not blocked423
Exploited2
Working exploit published132
No public exploit289
2000454
Mitigation candidate2
No exploit published3
Outside Waratek scope2
Not applicable447
High454
not blocked454
Exploited3
Working exploit published197
Forecast only1
No public exploit253
2001776
Protected by Waratek1
No exploit published6
Outside Waratek scope5
Not applicable764
High776
blocked by ARMR today1
not blocked775
Exploited11
Working exploit published219
No public exploit546
2002189
No exploit published2
Outside Waratek scope1
Not applicable186
High189
not blocked189
Exploited1
Working exploit published44
Forecast only3
No public exploit141
19881990199219941996199820002002
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2002-0311 | High | 2002-05-31 | Not applicable | Working exploit published | Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell metacharacters in the -c argument for (1) in scoadminreg.cgi or (2) service_action.cgi. |
| CVE-2002-0310 | High | 2002-05-31 | Not applicable | No public exploit | Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations (1) testweb/newstest, (2) alwn3845/imaptest, (3) alwi3845/wtest3452, or (4) testweb2/wtest4879. |
| CVE-2002-0308 | High | 2002-05-31 | Not applicable | No public exploit | admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments. |
| CVE-2002-0307 | High | 2002-05-31 | Not applicable | No public exploit | Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existence of arbitrary files or execute any Perl program on the system via a .. (dot dot) in the p parameter, which reads the target file and attempts to execute the line using Perl's eval function. |
| CVE-2002-0306 | High | 2002-05-31 | Not applicable | No public exploit | ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the p (plugin) parameter. |
| CVE-2002-0299 | High | 2002-05-31 | Not applicable | No public exploit | CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such as .BAT), which is executed during a scan. |
| CVE-2002-0290 | High | 2002-05-31 | Not applicable | No public exploit | Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument. |
| CVE-2002-0287 | High | 2002-05-31 | Not applicable | No public exploit | pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default. |
| CVE-2002-0286 | High | 2002-05-31 | Not applicable | No public exploit | The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to add_user.php, which causes GetPassword to produce and compare a blank password for the non-existent user. |
| CVE-2002-0285 | High | 2002-05-31 | Not applicable | No public exploit | Outlook Express 5.5 and 6.0 on Windows treats a carriage return ("CR") in a message header as if it were a valid carriage return/line feed combination (CR/LF), which could allow remote attackers to bypass virus protection and or other filtering mechanisms via a mail message with headers that only contain the CR, which causes Outlook to create separate headers. |
| CVE-2002-0280 | High | 2002-05-31 | Not applicable | Working exploit published | Buffer overflow in CodeBlue 4 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via a long string in an SMTP reply. |
| CVE-2002-0278 | High | 2002-05-31 | Not applicable | No public exploit | Directory traversal vulnerability in Add2it Mailman Free 1.73 and earlier allows remote attackers to modify arbitrary files via a .. (dot dot) in the list parameter. |
| CVE-2002-0277 | High | 2002-05-31 | Not applicable | No public exploit | Add2it Mailman Free 1.73 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the list parameter. |
| CVE-2002-0276 | High | 2002-05-31 | Not applicable | Working exploit published | Buffer overflow in various decoders in Ettercap 0.6.3.1 and earlier, when running on networks with an MTU greater than 2000, allows remote attackers to execute arbitrary code via large packets. |
| CVE-2002-0272 | High | 2002-05-31 | Not applicable | No public exploit | Buffer overflows in mpg321 before 0.2.9 allows local and possibly remote attackers to execute arbitrary code via a long URL to (1) a command line option, (2) an HTTP request, or (3) an FTP request. |
| CVE-2002-0374 | High | 2002-05-29 | Not applicable | No public exploit | Format string vulnerability in the logging function for the pam_ldap PAM LDAP module before version 144 allows attackers to execute arbitrary code via format strings in the configuration file name. |
| CVE-2002-0363 | High | 2002-05-29 | Not applicable | No public exploit | ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice. |
| CVE-2002-0362 | High | 2002-05-29 | Not applicable | No public exploit | Buffer overflow in AOL Instant Messenger (AIM) 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711. |
| CVE-2002-0356 | High | 2002-05-29 | Not applicable | No public exploit | Vulnerability in XFS filesystem reorganizer (fsr_xfs) in SGI IRIX 6.5.10 and earlier allows local users to gain root privileges by overwriting critical system files. |
| CVE-2002-0269 | High | 2002-05-29 | Not applicable | No public exploit | Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent cross-site scripting attacks. |
| CVE-2002-0268 | High | 2002-05-29 | Not applicable | No public exploit | Identix BioLogon 3 allows users with physical access to the system to gain administrative privileges by using CTRL-ALT-DEL and running a "Browse" function, which runs Explorer with SYSTEM privileges. |
| CVE-2002-0267 | High | 2002-05-29 | Not applicable | No public exploit | preferences.php in Simple Internet Publishing System (SIPS) before 0.3.1 allows remote attackers to gain administrative privileges via a linebreak in the "theme" field followed by the Status::admin command, which causes the Status line to be entered into the password file. |
| CVE-2002-0264 | High | 2002-05-29 | Not applicable | No public exploit | PowerFTP Personal FTP Server 2.03 through 2.10 stores sensitive account information in plaintext in the ftpserver.ini file, which allows attackers with access to the file to gain privileges. |
| CVE-2002-0263 | High | 2002-05-29 | Not applicable | Working exploit published | Buffer overflow in EasyBoard 2000 1.27 (aka EZboard) allows remote attackers to execute arbitrary code via a long boundary value in a multipart Content-Type header to (1) ezboard.cgi, (2) ezman.cgi, or (3) ezadmin.cgi. |
| CVE-2002-0261 | High | 2002-05-29 | Not applicable | No public exploit | Directory traversal vulnerability in InstantServers MiniPortal 1.1.5 and earlier allows remote authenticated users to read arbitrary files via a ... (modified dot dot) in the GET command. |
| CVE-2002-0260 | High | 2002-05-29 | Not applicable | No public exploit | Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, which is not properly handled by the logging utility. |
| CVE-2002-0258 | High | 2002-05-29 | Not applicable | No public exploit | Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs. |
| CVE-2002-0257 | High | 2002-05-29 | Not applicable | No public exploit | Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields (1) TITLE, (2) DESCTIT, (3) DESC, (4) searchstring, (5) ALIAS, (6) EMAIL, (7) ADDRESS1, (8) ADDRESS2, (9) ADDRESS3, (10) PHONE1, (11) PHONE2, (12) PHONE3, or (13) PHONE4. |
| CVE-2002-0255 | High | 2002-05-29 | Not applicable | No public exploit | The default configuration of Arescom NetDSL 800 does not require authentication, which allows remote attackers to cause a denial of service or reconfigure the router. |
| CVE-2002-0252 | High | 2002-05-29 | Not applicable | Working exploit published | Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header. |
| CVE-2002-0251 | High | 2002-05-29 | Not applicable | No public exploit | Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string of format string characters such as "%d". |
| CVE-2002-0250 | High | 2002-05-29 | Not applicable | Working exploit published | Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authentication via a direct HTTP request to the web_access.html file, which allows the user to change the switch's configuration and modify the administrator password. |
| CVE-2002-0248 | High | 2002-05-29 | Not applicable | No public exploit | wmtv 0.6.5 and earlier allows local users to modify arbitrary files via a symlink attack on a configuration file. |
| CVE-2002-0247 | High | 2002-05-29 | Not applicable | No public exploit | Buffer overflows in wmtv 0.6.5 and earlier may allow local users to gain privileges. |
| CVE-2002-0246 | High | 2002-05-29 | Not applicable | Working exploit published | Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying the LC_MESSAGE environment variable to read other message catalogs containing format strings from setuid programs such as vxprint. |
| CVE-2002-0245 | High | 2002-05-29 | Not applicable | No public exploit | Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a nonexistent file with a .pl (Perl) extension, which leaks the pathname in the error message, or (2) make any request that causes an HTTP 500 error, which leaks the server's version name in the HTTP error message. |
| CVE-2002-0244 | High | 2002-05-29 | Not applicable | Working exploit published | Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname argument to chdir. |
| CVE-2002-0243 | High | 2002-05-29 | Not applicable | No public exploit | Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed. |
| CVE-2002-0242 | High | 2002-05-29 | Not applicable | No public exploit | Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed. |
| CVE-2002-0241 | High | 2002-05-29 | Not applicable | No public exploit | NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server. |
| CVE-2002-0239 | High | 2002-05-29 | Not applicable | Working exploit published | Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) -hfn argument. |
| CVE-2002-0238 | High | 2002-05-29 | Not applicable | No public exploit | Cross-site scripting vulnerability in web administration interface for NetGear RT314 and RT311 Gateway Routers allows remote attackers to execute arbitrary script on another client via a URL that contains the script. |
| CVE-2002-0237 | High | 2002-05-29 | Not applicable | No public exploit | Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a flood of large ICMP ping packets. |
| CVE-2002-0236 | High | 2002-05-29 | Not applicable | Working exploit published | Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user. |
| CVE-2002-0235 | High | 2002-05-29 | Not applicable | No public exploit | Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event. |
| CVE-2002-0193 | High | 2002-05-29 | Not applicable | Working exploit published | Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the first variant of the "Content Disposition" vulnerability. |
| CVE-2002-0190 | High | 2002-05-29 | Not applicable | No public exploit | Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability. |
| CVE-2002-0189 | High | 2002-05-29 | Not applicable | Working exploit published | Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability. |
| CVE-2002-0188 | High | 2002-05-29 | Not applicable | No public exploit | Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the second variant of the "Content Disposition" vulnerability. |
| CVE-2002-0178 | High | 2002-05-29 | Not applicable | No public exploit | uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands. |
| CVE-2002-0174 | High | 2002-05-29 | Not applicable | No public exploit | nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file. |
| CVE-2002-0155 | High | 2002-05-29 | Not applicable | No public exploit | Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX. |
| CVE-2002-0033 | High | 2002-05-29 | Not applicable | Working exploit published | Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. |
| CVE-2002-1447 | High | 2002-05-28 | Not applicable | Working exploit published | Buffer overflow in the vpnclient program for UNIX VPN Client before 3.5.2 allows local users to gain administrative privileges via a long profile name in a connect argument. |
| CVE-2002-1641 | High | 2002-05-27 | Not applicable | No public exploit | Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server (9iAS) allow remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2002-1056 | High | 2002-05-16 | Not applicable | No public exploit | Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to. |
| CVE-2002-0231 | High | 2002-05-16 | Not applicable | Working exploit published | Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname. |
| CVE-2002-0229 | High | 2002-05-16 | Not applicable | Working exploit published | Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements. |
| CVE-2002-0226 | High | 2002-05-16 | Not applicable | No public exploit | retrieve_password.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to request a new password on behalf of another user and use the sessionID to calculate the new password for that user. |
| CVE-2002-0223 | High | 2002-05-16 | Not applicable | No public exploit | Infopop UBB.Threads 5.4 and Wired Community Software WWWThreads 5.0 through 5.0.9 allows remote attackers to upload arbitrary files by using a filename that contains an accepted extension, but ends in a different extension. |
| CVE-2002-0222 | High | 2002-05-16 | Not applicable | No public exploit | Etype Eserv 2.97 allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command. |
| CVE-2002-0220 | High | 2002-05-16 | Not applicable | No public exploit | phpsmssend.php in PhpSmsSend 1.0 allows remote attackers to execute arbitrary commands via an SMS message containing shell metacharacters. |
| CVE-2002-0219 | High | 2002-05-16 | Not applicable | No public exploit | Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via large command line argument. |
| CVE-2002-0218 | High | 2002-05-16 | Not applicable | No public exploit | Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via format specifiers in a command line argument. |
| CVE-2002-0217 | High | 2002-05-16 | Not applicable | No public exploit | Cross-site scripting (CSS) vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients via (1) the Title field or a Private Message Box or (2) the image field parameter in pmlite.php. |
| CVE-2002-0212 | High | 2002-05-16 | Not applicable | No public exploit | The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack. |
| CVE-2002-0210 | High | 2002-05-16 | Not applicable | Working exploit published | setlicense for TOLIS Group Backup and Restore Utility (BRU) 17.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/brutest.$$ temporary file. |
| CVE-2002-0207 | High | 2002-05-16 | Not applicable | Working exploit published | Buffer overflow in Real Networks RealPlayer 8.0 and earlier allows remote attackers to execute arbitrary code via a header length value that exceeds the actual length of the header. |
| CVE-2002-0206 | High | 2002-05-16 | Not applicable | Working exploit published | index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter. |
| CVE-2002-0205 | High | 2002-05-16 | Not applicable | No public exploit | Cross-site scripting (CSS) vulnerability in error.asp for Plumtree Corporate Portal 3.5 through 4.5 allows remote attackers to execute arbitrary script on other clients via the "Description" parameter. |
| CVE-2002-0204 | High | 2002-05-16 | Not applicable | No public exploit | Buffer overflow in GNU Chess (gnuchess) 5.02 and earlier, if modified or used in a networked capacity contrary to its own design as a single-user application, may allow local or remote attackers to execute arbitrary code via a long command. |
| CVE-2002-0199 | High | 2002-05-16 | Not applicable | No public exploit | Buffer overflow in admin.cgi for Nullsoft Shoutcast Server 1.8.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an argument with a large number of backslashes. |
| CVE-2002-0198 | High | 2002-05-16 | Not applicable | No public exploit | Buffer overflow in plDaniels ripMime 1.2.6 and earlier, as used in other programs such as xamime and inflex, allows remote attackers to execute arbitrary code via an attachment in a long filename. |
| CVE-2002-0197 | High | 2002-05-16 | Not applicable | No public exploit | psyBNC 2.3 beta and earlier allows remote attackers to spoof encrypted, trusted messages by sending lines that begin with the "[B]" sequence, which makes the message appear legitimate. |
| CVE-2002-0185 | High | 2002-05-16 | Not applicable | No public exploit | mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attackers to call possibly dangerous functions from the imported module. |
| CVE-2002-0184 | High | 2002-05-16 | Not applicable | Working exploit published | Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p (prompt) argument, which are not properly expanded. |
| CVE-2002-0173 | High | 2002-05-16 | Not applicable | No public exploit | Buffer overflow in cpr for the eoe.sw.cpr SGI Checkpoint-Restart Software package on SGI IRIX 6.5.10 and earlier may allow local users to gain root privileges. |
| CVE-2002-0171 | High | 2002-05-16 | Not applicable | No public exploit | IRISconsole 2.0 may allow users to log into the icadmin account with an incorrect password in some circumstances, which could allow users to gain privileges. |
| CVE-2002-0154 | High | 2002-05-16 | Not applicable | No public exploit | Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments. |
| CVE-1999-1570 | High | 2002-05-01 | Not applicable | No public exploit | Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter. |
| CVE-2002-1621 | High | 2002-04-22 | Not applicable | No public exploit | Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code. |
| CVE-2002-0181 | High | 2002-04-22 | Not applicable | No public exploit | Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter. |
| CVE-2002-0180 | High | 2002-04-22 | Not applicable | No public exploit | Buffer overflow in Webalizer 2.01-06, when configured to use reverse DNS lookups, allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname. |
| CVE-2002-0179 | High | 2002-04-22 | Not applicable | No public exploit | Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code. |
| CVE-2002-0177 | High | 2002-04-22 | Not applicable | Working exploit published | Buffer overflows in icecast 1.3.11 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client. |
| CVE-2002-0170 | High | 2002-04-22 | Not applicable | No public exploit | Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration. |
| CVE-2002-0168 | High | 2002-04-22 | Not applicable | No public exploit | Vulnerability in Imlib before 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments that are passed to malloc, which results in a heap corruption. |
| CVE-2002-0167 | High | 2002-04-22 | Not applicable | No public exploit | Imlib before 1.9.13 sometimes uses the NetPBM package to load trusted images, which could allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain weaknesses of NetPBM. |
| CVE-2002-0166 | High | 2002-04-22 | Not applicable | No public exploit | Cross-site scripting vulnerability in analog before 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is entered into a web logfile and not properly filtered by analog during display. |
| CVE-2002-0159 | High | 2002-04-22 | Not applicable | No public exploit | Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or execute arbitrary code via format strings in the URL to port 2002. |
| CVE-2002-0153 | High | 2002-04-22 | Not applicable | Working exploit published | Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, aka the "Local Applescript Invocation" vulnerability. |
| CVE-2002-0152 | High | 2002-04-22 | Not applicable | No public exploit | Buffer overflow in various Microsoft applications for Macintosh allows remote attackers to cause a denial of service (crash) or execute arbitrary code by invoking the file:// directive with a large number of / characters, which affects Internet Explorer 5.1, Outlook Express 5.0 through 5.0.2, Entourage v. X and 2001, PowerPoint v. X, 2001, and 98, and Excel v. X and 2001 for Macintosh. |
| CVE-2002-0150 | High | 2002-04-22 | Not applicable | Forecast only | Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. |
| CVE-2002-0149 | High | 2002-04-22 | Not applicable | Forecast only | Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. |
| CVE-2002-0148 | High | 2002-04-22 | Not applicable | Working exploit published | Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. |
| CVE-2002-0147 | High | 2002-04-22 | Not applicable | Forecast only | Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." |
| CVE-2002-0079 | High | 2002-04-22 | Not applicable | Working exploit published | Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. |
| CVE-2002-0075 | High | 2002-04-22 | Not applicable | No public exploit | Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message. |
| CVE-2002-0074 | High | 2002-04-22 | Not applicable | No public exploit | Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session. |
| CVE-2002-0071 | High | 2002-04-22 | Not applicable | No public exploit | Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. |