WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2002-08-31✕
Overview 2,524 matches · 20 in Waratek scope · 1 protected · 23 exploited · 1 CISA KEV · 795 public PoC · 53 EPSS ≥ 0.5
2,524matches 20in Waratek scope0.8% 1protected0.0% 23exploited0.9% 1CISA KEV0.0% 795public PoC31.5% 53EPSS ≥ 0.52.1%
Protected by Waratek 1 0.0% Rule in development 0 0.0% Mitigation candidate 3 0.1% No exploit published 16 0.6% Outside Waratek scope 12 0.5% Not applicable 2,492 98.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 2,524 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 0.0% partly blocked 0 0.0% not blocked 2,523 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 23 0.9% Working exploit published 775 30.7% Proof of concept only 0 0.0% Forecast only 5 0.2% No public exploit 1,721 68.2%
split by peak 776 / year
Not applicable: 2,492Outside Waratek scope: 12No exploit published: 16Mitigation candidate: 3Protected by Waratek: 1 High: 2,524 not blocked: 2,523blocked by ARMR today: 1 No public exploit: 1,721Forecast only: 5Working exploit published: 775Exploited: 23
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19892 Not applicable2 High2 not blocked2 No public exploit2 19908 Not applicable8 High8 not blocked8 No public exploit8 199111 Not applicable11 High11 not blocked11 Working exploit published2 No public exploit9 199212 Not applicable12 High12 not blocked12 No public exploit12 19938 Not applicable8 High8 not blocked8 No public exploit8 199414 Not applicable14 High14 not blocked14 Working exploit published3 No public exploit11 199517 Not applicable17 High17 not blocked17 Working exploit published2 No public exploit15 199643 No exploit published1 Not applicable42 High43 not blocked43 Working exploit published12 Forecast only1 No public exploit30 1997143 Not applicable143 High143 not blocked143 Exploited2 Working exploit published51 No public exploit90 1998137 Not applicable137 High137 not blocked137 Exploited1 Working exploit published33 No public exploit103 1999423 No exploit published2 Not applicable421 High423 not blocked423 Exploited2 Working exploit published132 No public exploit289 2000454 Mitigation candidate2 No exploit published3 Outside Waratek scope2 Not applicable447 High454 not blocked454 Exploited3 Working exploit published197 Forecast only1 No public exploit253 2001776 Protected by Waratek1 No exploit published6 Outside Waratek scope5 Not applicable764 High776 blocked by ARMR today1 not blocked775 Exploited11 Working exploit published219 No public exploit546 2002474 Mitigation candidate1 No exploit published4 Outside Waratek scope5 Not applicable464 High474 not blocked474 Exploited4 Working exploit published123 Forecast only3 No public exploit344
19881990199219941996199820002002
2,524 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 26 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2002-1452 High 2002-08-14 Not applicable Working exploit published Buffer overflow in the search capability for MyWebServer 1.0.2 allows remote attackers to execute arbitrary code via a long searchTarget parameter.
CVE-2002-0847 High 2002-08-12 Not applicable No public exploit tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free).
CVE-2002-0846 High 2002-08-12 Not applicable No public exploit The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specified length.
CVE-2002-0845 High 2002-08-12 Not applicable No public exploit Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding.
CVE-2002-0844 High 2002-08-12 Not applicable No public exploit Off-by-one overflow in the CVS PreservePermissions of rcs.c for CVSD before 1.11.2 allows local users to execute arbitrary code.
CVE-2002-0833 High 2002-08-12 Not applicable Working exploit published Buffer overflow in Eudora 5.1.1 and 5.0-J for Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a multi-part message with a long boundary string.
CVE-2002-0832 High 2002-08-12 Not applicable No public exploit Internet Explorer 5, 5.6, and 6 allows remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData (storeuserData) feature.
CVE-2002-0827 High 2002-08-12 Not applicable No public exploit Vulnerability in pppd on UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to gain root privileges via (1) ppptalk or (2) ppp, a different vulnerability than CVE-2002-0824.
CVE-2002-0826 High 2002-08-12 Not applicable No public exploit Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.
CVE-2002-0825 High 2002-08-12 Not applicable No public exploit Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVE-2002-0823 High 2002-08-12 Not applicable Working exploit published Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter.
CVE-2002-0822 High 2002-08-12 Not applicable No public exploit Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly excecute arbitrary code via the (1) SOCKS, (2) RSVP, (3) AFS, or (4) LMP dissectors, which can be caused to core dump.
CVE-2002-0821 High 2002-08-12 Not applicable No public exploit Buffer overflows in Ethereal 0.9.4 and earlier allow remote attackers to cause a denial of service or execute arbitrary code via (1) the BGP dissector, or (2) the WCP dissector.
CVE-2002-0820 High 2002-08-12 Not applicable No public exploit FreeBSD kernel 4.6 and earlier closes the file descriptors 0, 1, and 2 after they have already been assigned to /dev/null when the descriptors reference procfs or linprocfs, which could allow local users to reuse the file descriptors in a setuid or setgid program to modify critical data and gain privileges.
CVE-2002-0819 High 2002-08-12 Not applicable No public exploit Format string vulnerability in artsd, when called by artswrapper, allows local users to gain privileges via format strings in the -a argument, which results in an error message that is not properly handled in a call to the arts_fatal function.
CVE-2002-0818 High 2002-08-12 Not applicable No public exploit wwwoffled in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value.
CVE-2002-0817 High 2002-08-12 Not applicable Working exploit published Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument.
CVE-2002-0816 High 2002-08-12 Not applicable No public exploit Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.
CVE-2002-0815 High 2002-08-12 Not applicable No public exploit The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP and SOAP/XML content from restricted sites by mapping the malicious server's parent DNS domain name to the restricted site, loading a page from the restricted site into one frame, and passing the information to the attacker-controlled frame, which is allowed because the document.domain of the two frames matches on the parent domain.
CVE-2002-0814 High 2002-08-12 Not applicable Working exploit published Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument.
CVE-2002-0813 High 2002-08-12 Not applicable Working exploit published Heap-based buffer overflow in the TFTP server capability in Cisco IOS 11.1, 11.2, and 11.3 allows remote attackers to cause a denial of service (reset) or modify configuration via a long filename.
CVE-2002-0811 High 2002-08-12 Not applicable No public exploit Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort order parameter to buglist.cgi.
CVE-2002-0809 High 2002-08-12 Not applicable No public exploit Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names.
CVE-2002-0808 High 2002-08-12 Not applicable No public exploit Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when performing a mass change, sets the groupset of all bugs to the groupset of the first bug, which could inadvertently cause insecure groupset permissions to be assigned to some bugs.
CVE-2002-0807 High 2002-08-12 Not applicable No public exploit Cross-site scripting vulnerabilities in Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, could allow remote attackers to execute script as other Bugzilla users via the full name (real name) field, which is not properly quoted by editusers.cgi.
CVE-2002-0804 High 2002-08-12 Not applicable No public exploit Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname.
CVE-2002-0802 High 2002-08-12 Not applicable No public exploit The multibyte support in PostgreSQL 6.5.x with SQL_ASCII encoding consumes an extra character when processing a character that cannot be converted, which could remove an escape character from the query and make the application subject to SQL injection attacks.
CVE-2002-0801 High 2002-08-12 Not applicable No public exploit Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to the filter with a long HTTP host header field in a URL for a .jsp file.
CVE-2002-0799 High 2002-08-12 Not applicable Working exploit published Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument.
CVE-2002-0797 High 2002-08-12 Not applicable No public exploit Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.
CVE-2002-0796 High 2002-08-12 Not applicable No public exploit Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges.
CVE-2002-0789 High 2002-08-12 Not applicable No public exploit Buffer overflow in search.cgi in mnoGoSearch 3.1.19 and earlier allows remote attackers to execute arbitrary code via a long query (q) parameter.
CVE-2002-0787 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified (1) LOCID or (2) OC parameters.
CVE-2002-0783 High 2002-08-12 Not applicable Working exploit published Opera 6.01, 6.0, and 5.12 allows remote attackers to execute arbitrary JavaScript in the security context of other sites by setting the location of a frame or iframe to a Javascript: URL.
CVE-2002-0778 High 2002-08-12 Not applicable No public exploit The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connections to allowed IP addresses while hiding the actual source IP.
CVE-2002-0777 High 2002-08-12 Not applicable No public exploit Buffer overflow in the LDAP component of Ipswitch IMail 7.1 and earlier allows remote attackers to execute arbitrary code via a long "bind DN" parameter.
CVE-2002-0776 High 2002-08-12 Not applicable No public exploit getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter, as addressed by the "UpdateUser" hot fix.
CVE-2002-0774 High 2002-08-12 Not applicable No public exploit Hosting Controller creates a default user AdvWebadmin with a default password, which could allow remote attackers to gain privileges if the password is not changed.
CVE-2002-0773 High 2002-08-12 Not applicable Working exploit published imp_rootdir.asp for Hosting Controller allows remote attackers to copy or delete arbitrary files and directories via a direct request to imp_rootdir.asp and modifying parameters such as (1) ftp, (2) owwwPath, and (3) oftpPath.
CVE-2002-0768 High 2002-08-12 Not applicable No public exploit Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execute arbitrary code via a long PASV command.
CVE-2002-0767 High 2002-08-12 Not applicable Working exploit published simpleinit on Linux systems does not close a read/write FIFO file descriptor before creating a child process, which allows the child process to cause simpleinit to execute arbitrary programs with root privileges.
CVE-2002-0766 High 2002-08-12 Not applicable No public exploit OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor.
CVE-2002-0765 High 2002-08-12 Not applicable No public exploit sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.
CVE-2002-0764 High 2002-08-12 Not applicable Working exploit published Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHORUM[settings_dir] variable to point to a directory that contains a PHP file with the commands.
CVE-2002-0763 High 2002-08-12 Not applicable No public exploit Vulnerability in administration server for HP VirtualVault 4.5 on HP-UX 11.04 allows remote web servers or privileged external processes to bypass access restrictions and establish connections to the server.
CVE-2002-0762 High 2002-08-12 Not applicable No public exploit shadow package in SuSE 8.0 allows local users to destroy the /etc/passwd and /etc/shadow files or assign extra group privileges to some users by changing filesize limits before calling programs that modify the files.
CVE-2002-0758 High 2002-08-12 Not applicable No public exploit ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file.
CVE-2002-0757 High 2002-08-12 Not applicable No public exploit (1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.
CVE-2002-0756 High 2002-08-12 Not applicable No public exploit Cross-site scripting vulnerability in the authentication page for (1) Webmin 0.96 and (2) Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies.
CVE-2002-0755 High 2002-08-12 Not applicable No public exploit Kerberos 5 su (k5su) in FreeBSD 4.5 and earlier does not verify that a user is a member of the wheel group before granting superuser privileges, which could allow unauthorized users to execute commands as root.
CVE-2002-0754 High 2002-08-12 Not applicable No public exploit Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them.
CVE-2002-0753 High 2002-08-12 Not applicable No public exploit Buffer overflow in Talentsoft Web+ 5.0 allows remote attackers to execute arbitrary code via an HTTP request with a long cookie.
CVE-2002-0751 High 2002-08-12 Not applicable No public exploit CGIscript.net csMailto.cgi program allows remote attackers to use csMailto as a "spam proxy" and send mail to arbitrary users via modified (1) form-to, (2) form-from, and (3) form-results parameters.
CVE-2002-0749 High 2002-08-12 Not applicable Working exploit published CGIscript.net csMailto.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the form-attachment field.
CVE-2002-0747 High 2002-08-12 Not applicable Working exploit published Buffer overflow in lsmcode in AIX 4.3.3.
CVE-2002-0746 High 2002-08-12 Not applicable No public exploit Vulnerability in template.dhcpo in AIX 4.3.3 related to an insecure linker argument.
CVE-2002-0745 High 2002-08-12 Not applicable No public exploit Buffer overflow in uucp in AIX 4.3.3.
CVE-2002-0744 High 2002-08-12 Not applicable No public exploit namerslv in AIX 4.3.3 core dumps when called with a very long argument, possibly as a result of a buffer overflow.
CVE-2002-0743 High 2002-08-12 Not applicable No public exploit mail and mailx in AIX 4.3.3 core dump when called with a very long argument, an indication of a buffer overflow.
CVE-2002-0742 High 2002-08-12 Not applicable No public exploit Buffer overflow in pioout on AIX 4.3.3.
CVE-2002-0740 High 2002-08-12 Not applicable Working exploit published Buffer overflow in slrnpull for the SLRN package, when installed setuid or setgid, allows local users to gain privileges via a long -d (SPOOLDIR) argument.
CVE-2002-0739 High 2002-08-12 Not applicable No public exploit Cross-site scripting in PostCalendar 3.02 allows remote attackers to insert arbitrary HTML and script, and steal cookies, by modifying a calendar entry in its preview page.
CVE-2002-0738 High 2002-08-12 Not applicable No public exploit MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax.
CVE-2002-0736 High 2002-08-12 Not applicable No public exploit Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank.
CVE-2002-0735 High 2002-08-12 Not applicable No public exploit Format string vulnerability in the logging() function in C-Note Squid LDAP authentication module (squid_auth_LDAP) 2.0.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code by triggering log messages.
CVE-2002-0734 High 2002-08-12 Not applicable Working exploit published b2edit.showposts.php in B2 2.0.6pre2 and earlier does not properly load the b2config.php file in some configurations, which allows remote attackers to execute arbitrary PHP code via a URL that sets the $b2inc variable to point to a malicious program stored on a remote server.
CVE-2002-0733 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerability in thttpd 2.20 and earlier allows remote attackers to execute arbitrary script via a URL to a nonexistent page, which causes thttpd to insert the script into a 404 error message.
CVE-2002-0732 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerability in MyGuestbook 1.0 allows remote attackers to execute arbitrary script or inject HTML via fields such as (1) user name or (2) comments.
CVE-2002-0731 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerability in demonstration scripts for vqServer allows remote attackers to execute arbitrary script via a link that contains the script in arguments to demo scripts such as respond.pl.
CVE-2002-0730 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerability in guestbook.pl for Philip Chinery's Guestbook 1.1 allows remote attackers to execute Javascript or HTML via fields such as (1) Name, (2) EMail, or (3) Homepage.
CVE-2002-0719 High 2002-08-12 Not applicable No public exploit SQL injection vulnerability in the function that services for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary commands via an MCMS resource request for image files or other files.
CVE-2002-0718 High 2002-08-12 Not applicable No public exploit Web authoring command in Microsoft Content Management Server (MCMS) 2001 allows attackers to authenticate and upload executable content, by modifying the upload location, aka "Program Execution via MCMS Authoring Function."
CVE-2002-0700 High 2002-08-12 Not applicable No public exploit Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers to execute code in the Local System context by authenticating to a web page that calls the function, aka "Unchecked Buffer in MDAC Function Could Enable SQL Server Compromise."
CVE-2002-0698 High 2002-08-12 Not applicable No public exploit Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.
CVE-2002-0697 High 2002-08-12 Not applicable No public exploit Microsoft Metadirectory Services (MMS) 2.2 allows remote attackers to bypass authentication and modify sensitive data by using an LDAP client to directly connect to MMS and bypass the checks for MMS credentials.
CVE-2002-0695 High 2002-08-12 Not applicable No public exploit Buffer overflow in the Transact-SQL (T-SQL) OpenRowSet component of Microsoft Data Access Components (MDAC) 2.5 through 2.7 for SQL Server 7.0 or 2000 allows remote attackers to execute arbitrary code via a query that calls the OpenRowSet command.
CVE-2002-0684 High 2002-08-12 Not applicable No public exploit Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.
CVE-2002-0661 High 2002-08-12 Not applicable Working exploit published Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
CVE-2002-0660 High 2002-08-12 Not applicable No public exploit Buffer overflow in libpng 1.0.12-3.woody.2 and libpng3 1.2.1-1.1.woody.2 on Debian GNU/Linux 3.0, and other operating systems, may allow attackers to cause a denial of service and possibly execute arbitrary code, a different vulnerability than CVE-2002-0728.
CVE-2002-0657 High 2002-08-12 Not applicable No public exploit Buffer overflow in OpenSSL 0.9.7 before 0.9.7-beta3, with Kerberos enabled, allows attackers to execute arbitrary code via a long master key.
CVE-2002-0656 High 2002-08-12 Outside Waratek scope Working exploit published Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.
CVE-2002-0655 High 2002-08-12 Outside Waratek scope No public exploit OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly execute arbitrary code.
CVE-2002-0649 High 2002-08-12 Not applicable Exploited Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
CVE-2002-0645 High 2002-08-12 Not applicable No public exploit SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands.
CVE-2002-0644 High 2002-08-12 Not applicable Working exploit published Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.
CVE-2002-0619 High 2002-08-12 Not applicable No public exploit The Mail Merge Tool in Microsoft Word 2002 for Windows, when Microsoft Access is present on a system, allows remote attackers to execute Visual Basic (VBA) scripts within a mail merge document that is saved in HTML format, aka a "Variant of MS00-071, Word Mail Merge Vulnerability" (CVE-2000-0788).
CVE-2002-0618 High 2002-08-12 Not applicable No public exploit The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code in the Local Computer zone by embedding HTML scripts within an Excel workbook that contains an XSL stylesheet, aka "Excel XSL Stylesheet Script Execution".
CVE-2002-0532 High 2002-08-12 Not applicable No public exploit EMU Webmail allows local users to execute arbitrary programs via a .. (dot dot) in the HTTP Host header that points to a Trojan horse configuration file that contains a pageroot specifier that contains shell metacharacters.
CVE-2002-0528 High 2002-08-12 Not applicable No public exploit Watchguard SOHO firewall 5.0.35 unpredictably disables certain IP restrictions for customized services that were set before the administrator upgrades to 5.0.35, which could allow remote attackers to bypass the intended access control rules.
CVE-2002-0526 High 2002-08-12 Not applicable No public exploit Vulnerability in (1) inews or (2) rnews for INN 2.2.3 and earlier, related to insecure open() calls.
CVE-2002-0525 High 2002-08-12 Not applicable Working exploit published Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.
CVE-2002-0522 High 2002-08-12 Not applicable No public exploit ASP-Nuke RC2 and earlier allows remote attackers to bypass authentication and gain privileges by modifying the "pseudo" cookie.
CVE-2002-0520 High 2002-08-12 Not applicable No public exploit Cross-site scripting vulnerability in functions-inc.asp for ASP-Nuke RC1 allows remote attackers to execute script as other ASP-Nuke users by embedding it within an IMG tag.
CVE-2002-0517 High 2002-08-12 Not applicable No public exploit Buffer overflow in X11 library (libX11) on Caldera Open UNIX 8.0.0, UnixWare 7.1.1, and possibly other operating systems, allows local users to gain root privileges via a long -xrm argument to programs such as (1) dtterm or (2) xterm.
CVE-2002-0516 High 2002-08-12 Not applicable Working exploit published SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie.
CVE-2002-0513 High 2002-08-12 Not applicable No public exploit The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
CVE-2002-0511 High 2002-08-12 Not applicable No public exploit The default configuration of Name Service Cache Daemon (nscd) in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulting the authoritative DNS server for the A record, which could make it easier for remote attackers to bypass applications that restrict access based on host names.
CVE-2002-0508 High 2002-08-12 Not applicable No public exploit wwwisis 3.45 and earlier allows remote attackers to execute arbitrary commands and read files via the parameters (1) prolog or (2) epilog.
CVE-2002-0506 High 2002-08-12 Not applicable No public exploit Buffer overflow in newt.c of newt windowing library (libnewt) 0.50.33 and earlier may allow attackers to cause a denial of service or execute arbitrary code in setuid programs that use libnewt.
CVE-2002-0504 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other clients via the NFuse_Application parameter to (1) launch.jsp or (2) launch.asp.
‹ prev page 1 of 26 next ›