Overview 3,073 matches · 26 in Waratek scope · 2 protected · 28 exploited · 1 CISA KEV · 951 public PoC · 64 EPSS ≥ 0.5
3,073matches
26in Waratek scope0.8%
2protected0.1%
28exploited0.9%
1CISA KEV0.0%
951public PoC30.9%
64EPSS ≥ 0.52.1%
Protected by Waratek
2
0.1%
Rule in development
0
0.0%
Mitigation candidate
4
0.1%
No exploit published
20
0.7%
Outside Waratek scope
15
0.5%
Not applicable
3,032
98.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.1%
partly blocked
0
0.0%
not blocked
3,071
99.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
28
0.9%
Working exploit published
928
30.2%
Proof of concept only
0
0.0%
Forecast only
5
0.2%
No public exploit
2,112
68.7%
split by
peak 1,023 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19892
Not applicable2
High2
not blocked2
No public exploit2
19908
Not applicable8
High8
not blocked8
No public exploit8
199111
Not applicable11
High11
not blocked11
Working exploit published2
No public exploit9
199212
Not applicable12
High12
not blocked12
No public exploit12
19938
Not applicable8
High8
not blocked8
No public exploit8
199414
Not applicable14
High14
not blocked14
Working exploit published3
No public exploit11
199517
Not applicable17
High17
not blocked17
Working exploit published2
No public exploit15
199643
No exploit published1
Not applicable42
High43
not blocked43
Working exploit published12
Forecast only1
No public exploit30
1997143
Not applicable143
High143
not blocked143
Exploited2
Working exploit published51
No public exploit90
1998137
Not applicable137
High137
not blocked137
Exploited1
Working exploit published33
No public exploit103
1999423
No exploit published2
Not applicable421
High423
not blocked423
Exploited2
Working exploit published132
No public exploit289
2000454
Mitigation candidate2
No exploit published3
Outside Waratek scope2
Not applicable447
High454
not blocked454
Exploited3
Working exploit published197
Forecast only1
No public exploit253
2001776
Protected by Waratek1
No exploit published6
Outside Waratek scope5
Not applicable764
High776
blocked by ARMR today1
not blocked775
Exploited11
Working exploit published219
No public exploit546
20021,023
Protected by Waratek1
Mitigation candidate2
No exploit published8
Outside Waratek scope8
Not applicable1,004
High1,023
blocked by ARMR today1
not blocked1,022
Exploited9
Working exploit published276
Forecast only3
No public exploit735
19881990199219941996199820002002
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2002-2425 | High | 2002-12-31 | Not applicable | Working exploit published | Sun AnswerBook2 1.2 through 1.4.2 allows remote attackers to execute administrative scripts such as (1) AdminViewError and (2) AdminAddadmin via a direct request. |
| CVE-2002-2421 | High | 2002-12-31 | Not applicable | No public exploit | acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2. |
| CVE-2002-2420 | High | 2002-12-31 | Not applicable | Working exploit published | site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter. |
| CVE-2002-2419 | High | 2002-12-31 | Not applicable | No public exploit | Direct connect text client (DCTC) client 0.83.3 allows remote attackers to cause a denial of service (crash) via a string ending with a NULL byte character. |
| CVE-2002-2417 | High | 2002-12-31 | Not applicable | Working exploit published | acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges. |
| CVE-2002-2411 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command. |
| CVE-2002-2408 | High | 2002-12-31 | Not applicable | No public exploit | Gordano Messaging Server (GMS) Mail 8 (a.k.a. NTMail) only filters email messages for the first recipient, which allows remote attackers to bypass JUCE filters by sending a message to more than one user on the GMS server. |
| CVE-2002-2402 | High | 2002-12-31 | Not applicable | No public exploit | SURECOM broadband router EP-4501 uses a default SNMP read community string of "public" and a default SNMP read/write community string of "secret," which allows remote attackers to read and modify router configuration information. |
| CVE-2002-2400 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in the httpdProcessRequest function in LibHTTPD 1.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP POST request. |
| CVE-2002-2397 | High | 2002-12-31 | Not applicable | No public exploit | Sygate personal firewall 5.0 could allow remote attackers to bypass firewall filters via spoofed (1) source IP address of 127.0.0.1 or (2) network address of 127.0.0.0. |
| CVE-2002-2396 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in Advanced TFTP (atftp) 0.5 and 0.6, if installed setuid or setgid, may allow local users to execute arbitrary code via a long argument to the -g option. |
| CVE-2002-2391 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter. |
| CVE-2002-2390 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the IDENT daemon (identd) in Trillian 0.6351, 0.725, 0.73, 0.74 and 1.0 pro allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long request. |
| CVE-2002-2385 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in hotfoon4.exe in Hotfoon 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL containing a long voice phone number. |
| CVE-2002-2383 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in f2html.pl 0.1 through 0.4 allows remote attackers to execute arbitrary SQL commands via file names. |
| CVE-2002-2382 | High | 2002-12-31 | Not applicable | No public exploit | cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out. |
| CVE-2002-2381 | High | 2002-12-31 | Not applicable | No public exploit | Multiple buffer overflows in (1) tetrinet_inmessage, (2) speclist_add and (3) config-getthemeinfo of GTetrinet 0.4.3 and earlier allow remote attackers to casue a denial of service and possibly execute arbitrary code. |
| CVE-2002-2379 | High | 2002-12-31 | Not applicable | Working exploit published | Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor |
| CVE-2002-2374 | High | 2002-12-31 | Not applicable | No public exploit | Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files." |
| CVE-2002-2373 | High | 2002-12-31 | Not applicable | No public exploit | The default configuration of the TCP/IP printer configuration utility in Apple LaserWriter 12/640 PS printer contains a blank Telnet password, which allows remote attackers to gain access. |
| CVE-2002-2371 | High | 2002-12-31 | Not applicable | No public exploit | Linksys WET11 firmware 1.31 and 1.32 allows remote attackers to cause a denial of service (crash) via a packet containing the device's hardware address as the source MAC address in the DLC header. |
| CVE-2002-2368 | High | 2002-12-31 | Not applicable | No public exploit | Multiple buffer overflows in NEC SOCKS5 1.0 r11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long username to (1) the GetString function in proxy.c for the SOCKS5 module or (2) the HandleS4Connection function in proxy.c for the SOCKS4 module. |
| CVE-2002-2367 | High | 2002-12-31 | Not applicable | No public exploit | Off-by-one buffer overflow in NEC SOCKS5 1.0 r11 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long hostname. |
| CVE-2002-2365 | High | 2002-12-31 | Not applicable | No public exploit | Simple WAIS (SWAIS) 1.11 allows remote attackers to execute arbitrary commands via the shell metacharacters in the search field, as demonstrated using the "|" (pipe) character. |
| CVE-2002-2363 | High | 2002-12-31 | Not applicable | No public exploit | VJE.VJE-RUN in HP-UX 11.00 adds bin to /etc/PATH, which could allow local users to gain privileges. |
| CVE-2002-2360 | High | 2002-12-31 | Not applicable | Working exploit published | The RPC module in Webmin 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remote_foreign_require and remote_foreign_call requests. |
| CVE-2002-2355 | High | 2002-12-31 | Not applicable | No public exploit | Netgear FM114P firmware 1.3 wireless firewall, when configured to backup configuration information, stores DDNS (DynDNS) user name and password, MAC address filtering table and possibly other information in cleartext, which could allow local users to obtain sensitive information. |
| CVE-2002-2354 | High | 2002-12-31 | Not applicable | No public exploit | Netgear FM114P firmware 1.3 wireless firewall allows remote attackers to cause a denial of service (crash or hang) via a large number of TCP connection requests. |
| CVE-2002-2345 | High | 2002-12-31 | Not applicable | No public exploit | Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, which allows remote attackers to gain access. |
| CVE-2002-2329 | High | 2002-12-31 | Not applicable | No public exploit | ICQ client 2001b, 2002a and 2002b allows remote attackers to cause a denial of service (CPU consumption or crash) via a message with a large number of emoticons. |
| CVE-2002-2328 | High | 2002-12-31 | Not applicable | No public exploit | Active Directory in Windows 2000, when supporting Kerberos V authentication and GSSAPI, allows remote attackers to cause a denial of service (hang) via an LDAP client that sets the page length to zero during a large request. |
| CVE-2002-2325 | High | 2002-12-31 | Not applicable | Working exploit published | The c-client library in Internet Message Access Protocol (IMAP) dated before 2002 RC2, as used by Pine 4.20 through 4.44, allows remote attackers to cause a denial of service (client crash) via a MIME-encoded email with Content-Type header containing an empty boundary field. |
| CVE-2002-2324 | High | 2002-12-31 | Not applicable | No public exploit | The "System Restore" directory and subdirectories, and possibly other subdirectories in the "System Volume Information" directory on Windows XP Professional, have insecure access control list (ACL) permissions, which allows local users to access restricted files and modify registry settings. |
| CVE-2002-2323 | High | 2002-12-31 | Not applicable | No public exploit | Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored from backup, which could allow local or remote attackers to bypass intended access restrictions. |
| CVE-2002-2320 | High | 2002-12-31 | Not applicable | No public exploit | MySimpleNews 1.0 allows remote attackers to delete arbitrary email messages via a direct request to vider.php3. |
| CVE-2002-2319 | High | 2002-12-31 | Not applicable | Working exploit published | Static code injection vulnerability in users.php in MySimpleNews allows remote attackers to inject arbitrary PHP code and HTML via the (1) LOGIN, (2) DATA, and (3) MESS parameters, which are inserted into news.php3. |
| CVE-2002-2317 | High | 2002-12-31 | Not applicable | No public exploit | Memory leak in the (1) httpd, (2) nntpd, and (3) vpn driver in VelociRaptor 1.0 allows remote attackers to cause a denial of service (memory consumption) via an unknown method. |
| CVE-2002-2315 | High | 2002-12-31 | Not applicable | Working exploit published | Cisco IOS 11.2.x and 12.0.x does not limit the size of its redirect table, which allows remote attackers to cause a denial of service (memory consumption) via spoofed ICMP redirect packets to the router. |
| CVE-2002-2313 | High | 2002-12-31 | Not applicable | No public exploit | Eudora email client 5.1.1, with "use Microsoft viewer" enabled, allows remote attackers to execute arbitrary programs via an HTML email message containing a META refresh tag that references an embedded .mhtml file with ActiveX controls that execute a second embedded program, which is processed by Internet Explorer. |
| CVE-2002-2309 | High | 2002-12-31 | Not applicable | Working exploit published | php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments. |
| CVE-2002-2306 | High | 2002-12-31 | Not applicable | Working exploit published | Sharman Networks KaZaA Media Desktop 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large messages. |
| CVE-2002-2305 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in agentadmin.php in Immobilier allows remote attackers to execute arbitrary SQL commands via the (1) agentname or (2) agentpassword parameter. |
| CVE-2002-2304 | High | 2002-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in admin/auth/checksession.php in MyPHPLinks 2.1.9 and 2.2.0 allows remote attackers to execute arbitrary SQL commands via the idsession parameter. |
| CVE-2002-2303 | High | 2002-12-31 | Not applicable | No public exploit | 3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by using the Javascript to decrypt the cookie that contains the data. |
| CVE-2002-2300 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in ftpd 5.4 in 3Com NBX 4.0.17 or ftpd 5.4.2 in 3Com NBX 4.1.4 allows remote attackers to cause a denial of service (crash) via a long CEL command. |
| CVE-2002-2295 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in Pico Server (pServ) 2.0 beta 1 through beta 5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a 1024-byte TCP stream message, which triggers an off-by-one buffer overflow, or (2) a long method name in an HTTP request, (3) a long version number in an HTTP request, (4) a long User-Agent header, or (5) a long file path. |
| CVE-2002-2291 | High | 2002-12-31 | Not applicable | No public exploit | Calisto Internet Talker 0.04 and earlier allows remote attackers to cause a denial of service (hang) via a long request, possibly triggering a buffer overflow. |
| CVE-2002-2290 | High | 2002-12-31 | Not applicable | No public exploit | Mambo Site Server 4.0.11 installs with a default username and password of admin, which allows remote attackers to gain privileges. |
| CVE-2002-2287 | High | 2002-12-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in quick_reply.php for phpBB Advanced Quick Reply Hack 1.0.0 and 1.1.0 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter. |
| CVE-2002-2281 | High | 2002-12-31 | Not applicable | Working exploit published | Symantec Java! JIT (Just-In-Time) Compiler for Netscape Communicator 4.0 through 4.8 allows remote attackers to execute arbitrary Java commands via an applet that uses a jump call, which is not correctly compiled by the JIT compiler. |
| CVE-2002-2279 | High | 2002-12-31 | Not applicable | No public exploit | Unspecified vulnerability in the bind function in config.inc of aldap 0.09 allows remote attackers to authenticate with Manager permissions. |
| CVE-2002-2277 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in mod_search/index.php in PortailPHP 0.99 allows remote attackers to execute arbitrary SQL commands via the (1) $rech, (2) $BD_Tab_docs, (3) $BD_Tab_file, (4) $BD_Tab_liens, (5) $BD_Tab_faq, or (6) $chemin variables. |
| CVE-2002-2272 | High | 2002-12-31 | Mitigation candidate | Working exploit published | Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values. |
| CVE-2002-2269 | High | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in Webster HTTP Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. |
| CVE-2002-2268 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL. |
| CVE-2002-2267 | High | 2002-12-31 | Not applicable | No public exploit | bogopass in bogofilter 0.9.0.4 allows local users to overwrite arbitrary files via a symlink attack on the bogopass temporary file. |
| CVE-2002-2264 | High | 2002-12-31 | Not applicable | No public exploit | Unspecified vulnerability in Internet Group Management Protocol (IGMP) of HP Tru64 4.0F through 5.1A allows remote attackers to cause a denial of service via unknown attack vectors. NOTE: this might be the same issue as CVE-2002-2185, but there are insufficient details to be certain. |
| CVE-2002-2261 | High | 2002-12-31 | Not applicable | No public exploit | Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname. |
| CVE-2002-2259 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the French documentation patch for Gnuplot 3.7 in SuSE Linux before 8.0 allows local users to execute arbitrary code as root via unknown attack vectors. |
| CVE-2002-2257 | High | 2002-12-31 | Not applicable | No public exploit | Stack-based buffer overflow in the parse_field function in cgi_lib.c for LIBCGI 1.0.2 and 1.0.3 allows remote attackers to execute arbitrary code via a long argument. |
| CVE-2002-2253 | High | 2002-12-31 | Not applicable | No public exploit | Multiple buffer overflows in Cyrus Sieve / libSieve 2.1.2 and earlier allow remote attackers to execute arbitrary code via (1) a long header name, (2) a long IMAP flag, or (3) a script that generates a large number of errors that overflow the resulting error string. |
| CVE-2002-2252 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a base64-encoded user parameter. |
| CVE-2002-2251 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code via a long argument. |
| CVE-2002-2250 | High | 2002-12-31 | Not applicable | No public exploit | Multiple buffer overflows in Sybase Adaptive Server 12.0 and 12.5 allow remote attackers to execute arbitrary code via (1) a long parameter to the xp_freedll extended stored procedure or (2) a long database name argument to the DBCC CHECKVERIFY function. |
| CVE-2002-2249 | High | 2002-12-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to (1) backend.php, (2) screen.php, or (3) admin/modules/comment.php. |
| CVE-2002-2248 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the sun.awt.windows.WDefaultFontCharset Java class implementation in Netscape 4.0 allows remote attackers to execute arbitrary code via an applet that calls the WDefaultFontCharset constructor with a long string and invokes the canConvert method. |
| CVE-2002-2239 | High | 2002-12-31 | Not applicable | No public exploit | The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet. |
| CVE-2002-2236 | High | 2002-12-31 | Not applicable | No public exploit | Format string vulnerability in the awp_log function in apt-www-proxy 0.1 allows remote attackers to execute arbitrary code. |
| CVE-2002-2233 | High | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in Enceladus Server Suite 3.9 allows remote attackers to list arbitrary directories and possibly cause a denial of service via "@" (at) characters in a CD (CWD) command, such as (1) "@/....\", (2) "@@@/..c:\", or (3) "@/..@/..". |
| CVE-2002-2232 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command. |
| CVE-2002-2227 | High | 2002-12-31 | Not applicable | No public exploit | Buffer underflow in ssldump 0.9b2 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted SSLv2 challenge value. |
| CVE-2002-2226 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument. |
| CVE-2002-2219 | High | 2002-12-31 | Not applicable | Working exploit published | chetcpasswd.cgi in Pedro Lineu Orso chetcpasswd before 2.1 allows remote attackers to read the last line of the shadow file via a long user (userid) field. |
| CVE-2002-2218 | High | 2002-12-31 | Not applicable | No public exploit | CRLF injection vulnerability in the setUserValue function in sipssys/code/site.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) before 20020209 has unknown impact, possibly gaining privileges or modifying critical configuration, via a CRLF sequence in a key value. |
| CVE-2002-2217 | High | 2002-12-31 | Not applicable | No public exploit | Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal (WSC-WebPortal) 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) l parameter to customize.php or the (2) pg parameter to index.php. |
| CVE-2002-2209 | High | 2002-12-31 | Not applicable | No public exploit | Unspecified "security vulnerability" in Baby FTP Server versions before November 7, 2002 has unknown impact and attack vectors. |
| CVE-2002-2208 | High | 2002-12-31 | Not applicable | No public exploit | Extended Interior Gateway Routing Protocol (EIGRP), as implemented in Cisco IOS 11.3 through 12.2 and other products, allows remote attackers to cause a denial of service (flood) by sending a large number of spoofed EIGRP neighbor announcements, which results in an ARP storm on the local network. |
| CVE-2002-2207 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in ssldump 0.9b2 and earlier, when running in decryption mode, allows remote attackers to execute arbitrary code via a long RSA PreMasterSecret. |
| CVE-2002-2206 | High | 2002-12-31 | Not applicable | No public exploit | The POP3 proxy service (POPROXY.EXE) in Norton AntiVirus 2001 allows local users to cause a denial of service (CPU consumption and crash) via a long username with multiple /localhost entries. |
| CVE-2002-2204 | High | 2002-12-31 | Not applicable | No public exploit | The default --checksig setting in RPM Package Manager 4.0.4 checks that a package's signature is valid without listing who signed it, which can allow remote attackers to make it appear that a malicious package comes from a trusted source. |
| CVE-2002-2201 | High | 2002-12-31 | Not applicable | No public exploit | The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the printer name. |
| CVE-2002-2200 | High | 2002-12-31 | Not applicable | Working exploit published | Benjamin Lefevre Dobermann FORUM 0.5 and earlier allows remote attackers to remotely include and execute malicious PHP files via the "subpath" variablein (1) entete.php, (2) enteteacceuil.php, (3) index.php, or (4) newtopic.php. |
| CVE-2002-2198 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in ZMailer before 2.99.51_1 allows remote attackers to execute arbitrary code during HELO processing from an IPv6 address, possibly using an address that resolves to a long hostname. |
| CVE-2002-2197 | High | 2002-12-31 | Not applicable | No public exploit | Unknown vulnerability in Sun Solaris 8.0 allows local users to cause a denial of service (kernel panic) via a program that uses /dev/poll, triggering a NULL pointer dereference. |
| CVE-2002-2196 | High | 2002-12-31 | Not applicable | No public exploit | Samba before 2.2.5 does not properly terminate the enum_csc_policy data structure, which may allow remote attackers to execute arbitrary code via a buffer overflow attack. |
| CVE-2002-2190 | High | 2002-12-31 | Not applicable | Working exploit published | ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user file. |
| CVE-2002-2183 | High | 2002-12-31 | Not applicable | No public exploit | phpShare.php in phpShare before 0.6 beta 3 allows remote attackers to include and execute arbitrary PHP scripts from remote servers. |
| CVE-2002-2179 | High | 2002-12-31 | Not applicable | No public exploit | The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP port scan using a tool such as nmap. |
| CVE-2002-2176 | High | 2002-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in Gender MOD 1.1.3 allows remote attackers to gain administrative access via the user_level parameter in the User Profile page. |
| CVE-2002-2173 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the IRC module of Trillian 0.725 and 0.73 allowing remote attackers to execute arbitrary code via a long DCC Chat message. |
| CVE-2002-2170 | High | 2002-12-31 | Not applicable | Working exploit published | Working Resources Inc. BadBlue Enterprise Edition 1.7 through 1.74 attempts to restrict administrator actions to the IP address of the local host, but does not provide additional authentication, which allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request that accesses the dir.hts page on the localhost and adds an entire hard drive to be shared. |
| CVE-2002-2168 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in Thorsten Korner 123tkShop before 0.3.1 allows remote attackers to execute arbitrary SQL queries via various programs including function_describe_item1.inc.php. |
| CVE-2002-2159 | High | 2002-12-31 | Not applicable | No public exploit | Linksys EtherFast Cable/DSL BEFSR11, BEFSR41 and BEFSRU31 with the firmware 1.42.7 upgrade installed opens TCP port 5678 for remote administration even when the "Block WAN" and "Remote Admin" options are disabled, which allows remote attackers to gain access. |
| CVE-2002-2156 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in Trillian 0.73 allows remote IRC servers to execute arbitrary code via a long PING response. |
| CVE-2002-2155 | High | 2002-12-31 | Not applicable | No public exploit | Format string vulnerability in the error handling of IRC invite responses for Trillian 0.725 and 0.73 allows remote IRC servers to execute arbitrary code via an invite to a channel with format string specifiers in the name. |
| CVE-2002-2153 | High | 2002-12-31 | Not applicable | No public exploit | Format string vulnerability in the administrative pages of the PL/SQL module for Oracle Application Server 4.0.8 and 4.0.8 2 allows remote attackers to execute arbitrary code. |
| CVE-2002-2152 | High | 2002-12-31 | Not applicable | No public exploit | The Czech edition of Software602's Web Server before 2002.0.02.0916 allows remote attackers to gain administrator privileges via direct HTTP requests to the /admin/ directory, which is not password protected. |
| CVE-2002-2146 | High | 2002-12-31 | Not applicable | No public exploit | cgitest.exe in Savant Web Server 3.1 and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request. |
| CVE-2002-2145 | High | 2002-12-31 | Not applicable | Working exploit published | Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename. |
| CVE-2002-2143 | High | 2002-12-31 | Not applicable | Working exploit published | The admin.html file in MySimple News 1.0 stores its administrative password in plaintext, which allows remote attackers to gain unauthorized access to the web server by viewing the source of admin.html. |