Overview 2,731 matches · 36 in Waratek scope · 2 protected · 8 exploited · 0 CISA KEV · 819 public PoC · 29 EPSS ≥ 0.5
2,731matches
36in Waratek scope1.3%
2protected0.1%
8exploited0.3%
0CISA KEV0.0%
819public PoC30.0%
29EPSS ≥ 0.51.1%
Protected by Waratek
2
0.1%
Rule in development
0
0.0%
Mitigation candidate
12
0.4%
No exploit published
22
0.8%
Outside Waratek scope
12
0.4%
Not applicable
2,683
98.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.1%
partly blocked
0
0.0%
not blocked
2,729
99.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
8
0.3%
Working exploit published
818
30.0%
Proof of concept only
0
0.0%
Forecast only
5
0.2%
No public exploit
1,900
69.6%
split by
peak 980 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
1990199219941996199820002002
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2002-2426 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information. |
| CVE-2002-2424 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in PHP(Reactor) 1.2.7 pl1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the style attribute of an HTML tag. |
| CVE-2002-2423 | Medium | 2002-12-31 | Not applicable | No public exploit | Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address from being logged via a long IDENT response. |
| CVE-2002-2422 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Compaq Insight Management Agents 2.0, 2.1, 3.6.0, 4.2 and 4.3.7 allows remote attackers to inject arbitrary web script or HTML via a URL, which inserts the script into the resulting error message. |
| CVE-2002-2418 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in acFreeProxy (aka acFP) 1.33 beta 7 allows remote attackers to inject arbitrary web script or HTML via the URL, which is inserted into an error page. |
| CVE-2002-2416 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request. |
| CVE-2002-2415 | Medium | 2002-12-31 | Not applicable | No public exploit | Allied Telesyn AT-8024 1.3.1 and Rapier 24 switches allow remote authenticated users to cause a denial of service in the management interface via a stream of zero (null) bytes sent via UDP to a running service. |
| CVE-2002-2414 | Medium | 2002-12-31 | Not applicable | No public exploit | Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority (CA) certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service (crash). |
| CVE-2002-2413 | Medium | 2002-12-31 | Not applicable | No public exploit | WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name. |
| CVE-2002-2410 | Medium | 2002-12-31 | Not applicable | No public exploit | openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information. |
| CVE-2002-2407 | Medium | 2002-12-31 | Not applicable | No public exploit | Certain patches for QNX Neutrino realtime operating system (RTOS) 6.2.0 set insecure permissions for the files (1) /sbin/io-audio by OS Update Patch A, (2) /bin/shutdown, (3) /sbin/fs-pkg, and (4) phshutdown by QNX experimental patches, (5) cpim, (6) vpim, (7) phrelaycfg, and (8) columns, (9) othello, (10) peg, (11) solitaire, and (12) vpoker in the games pack 2.0.3, which allows local users to gain privileges by modifying the files before permissions are changed. |
| CVE-2002-2406 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in HTTP server in LiteServe 2.0, 2.0.1 and 2.0.2 allows remote attackers to cause a denial of service (hang) via a large number of percent characters (%) in an HTTP GET request. |
| CVE-2002-2405 | Medium | 2002-12-31 | Not applicable | No public exploit | Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall. |
| CVE-2002-2404 | Medium | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP port 110). |
| CVE-2002-2403 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...", "....", ".....", and other multiple dot sequences. |
| CVE-2002-2399 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in viewAttachment.cgi in W3Mail 1.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. |
| CVE-2002-2398 | Medium | 2002-12-31 | Not applicable | No public exploit | The new thread posting page in APBoard 2.02 and 2.03 allows remote attackers to post messages to protected forums by modifying the insertinto parameter. |
| CVE-2002-2395 | Medium | 2002-12-31 | Not applicable | No public exploit | InterScan VirusWall 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 gzip content encoding. |
| CVE-2002-2394 | Medium | 2002-12-31 | Not applicable | No public exploit | InterScan VirusWall 3.6 for Linux and 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 chunked transfer encoding. |
| CVE-2002-2393 | Medium | 2002-12-31 | Not applicable | No public exploit | Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights, which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands. |
| CVE-2002-2392 | Medium | 2002-12-31 | Not applicable | No public exploit | Winamp 2.65 through 3.0 stores skin files in a predictable file location, which allows remote attackers to execute arbitrary code via a URL reference to (1) wsz and (2) wal files that contain embedded code. |
| CVE-2002-2389 | Medium | 2002-12-31 | Not applicable | No public exploit | TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files. |
| CVE-2002-2388 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in INweb POP3 mail server 2.01 allows remote attackers to cause a denial of service (crash) via a long HELO command. |
| CVE-2002-2387 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in Hyperion FTP server 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the LS command. |
| CVE-2002-2386 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Quizz module for XOOPS 1.0, when allowing on-line question development, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the SRC attribute of an IMG tag. |
| CVE-2002-2380 | Medium | 2002-12-31 | Not applicable | No public exploit | NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic. |
| CVE-2002-2378 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in AN HTTP 1.41d allows remote attackers to inject arbitrary web script or HTML via a colon (:) in the query string, which is inserted into the resulting error page. |
| CVE-2002-2377 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in addentry.cgi in ZAP 1.0.3 allows remote attackers to inject arbitrary SSi directives, web script, and HTML via the entry field. |
| CVE-2002-2376 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in E-Guest_sign.pl in E-Guest 1.1 allows remote attackers to inject arbitrary SSI directives, web script, and HTML via the (1) full name, (2) email, (3) homepage, and (4) location parameters. NOTE: this issue might overlap CVE-2005-1605. |
| CVE-2002-2375 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user, although there is a possibility that it could be used to infer product version information. |
| CVE-2002-2372 | Medium | 2002-12-31 | Not applicable | No public exploit | The telnet server in Infoprint 21 running controller software before 1.056007 allows remote attackers to cause a denial of service (crash) via a long username, possibly due to a buffer overflow. |
| CVE-2002-2370 | Medium | 2002-12-31 | Not applicable | Working exploit published | SWS web server 0.0.4, 0.0.3 and 0.1.0 allows remote attackers to cause a denial of service (crash) via a URL request that does not end with a newline. |
| CVE-2002-2369 | Medium | 2002-12-31 | Not applicable | No public exploit | Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL. |
| CVE-2002-2366 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the XML parser of Trillian 0.6351, 0.725 and 0.73 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a skin with a long colors file name in trillian.xml. |
| CVE-2002-2364 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in PHP Ticket 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a help ticket. |
| CVE-2002-2362 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in form_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML via the noticemsg parameter. |
| CVE-2002-2361 | Medium | 2002-12-31 | Not applicable | No public exploit | The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan programs via DNS spoofing. |
| CVE-2002-2359 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the FTP view feature in Mozilla 1.0 allows remote attackers to inject arbitrary web script or HTML via the title tag of an ftp URL. |
| CVE-2002-2358 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the FTP view feature in Opera 6.0 and 6.01 through 6.04 allows remote attackers to inject arbitrary web script or HTML via the title tag of an FTP URL. |
| CVE-2002-2357 | Medium | 2002-12-31 | Not applicable | Working exploit published | MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a buffer overflow. |
| CVE-2002-2356 | Medium | 2002-12-31 | Not applicable | No public exploit | HAMweather 2.x allows remote attackers to modify administrative settings and obtain sensitive information via a direct request to hwadmin.cgi. |
| CVE-2002-2353 | Medium | 2002-12-31 | Not applicable | Working exploit published | tftpd32 2.50 and 2.50.2 allows remote attackers to read or write arbitrary files via a full pathname in GET and PUT requests. |
| CVE-2002-2352 | Medium | 2002-12-31 | Not applicable | No public exploit | The NBActiveX.ocx ActiveX control in NeoBook 4 allows remote attackers to install and execute arbitrary programs. |
| CVE-2002-2351 | Medium | 2002-12-31 | Not applicable | Working exploit published | Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a trailing "." (dot). |
| CVE-2002-2350 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in z_user_show.php in dbtreelistproperty_method.php in Zorum 2.4 allows remote attackers to inject arbitrary web script or HTML via the class parameter. |
| CVE-2002-2349 | Medium | 2002-12-31 | Not applicable | Working exploit published | phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information. |
| CVE-2002-2348 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in athcgi.exe in Authoria HR allows remote attackers to inject arbitrary web script or HTML via the command parameter. |
| CVE-2002-2347 | Medium | 2002-12-31 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field. |
| CVE-2002-2346 | Medium | 2002-12-31 | Not applicable | No public exploit | phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses. |
| CVE-2002-2344 | Medium | 2002-12-31 | Not applicable | No public exploit | Ensim WEBppliance 3.0 and 3.1 allows remote attackers to read mail intended for other users by defining an alias that is the target's email address. |
| CVE-2002-2343 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email messages. |
| CVE-2002-2342 | Medium | 2002-12-31 | Not applicable | No public exploit | Bannermatic 1, 2, and 3 stores the (1) ban.log, (2) ban.bak, (3) ban.dat and (4) banmat.pwd data files under the web document root with insufficient access control, which allows attackers to obtain sensitive information via a direct request for the files. |
| CVE-2002-2341 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web script or HTML via a blocked URL. |
| CVE-2002-2340 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response. |
| CVE-2002-2339 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in (1) image, (2) img, (3) image=right, (4) img=right, (5) image=left, and (6) img=left tags. |
| CVE-2002-2338 | Medium | 2002-12-31 | Not applicable | Working exploit published | The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of service (no new mail) via a mail message containing a dot (.) at a newline, which is interpreted as the end of the message. |
| CVE-2002-2337 | Medium | 2002-12-31 | Not applicable | No public exploit | Kaspersky Anti-Hacker 1.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets. |
| CVE-2002-2336 | Medium | 2002-12-31 | Not applicable | Working exploit published | Norton Personal Firewall 2002 4.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets. |
| CVE-2002-2335 | Medium | 2002-12-31 | Not applicable | Working exploit published | Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain user names and passwords and log in using protection.php. |
| CVE-2002-2333 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in konqueror in KDE 2.1 through 3.0 and 3.0.2 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes. |
| CVE-2002-2332 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in Opera 6.01 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes. |
| CVE-2002-2331 | Medium | 2002-12-31 | Not applicable | No public exploit | W3Mail 1.0.2 through 1.0.5 with server side scripting (SSI) enabled in the attachments directory does not properly restrict the types of files that can be uploaded as attachments, which allows remote attackers to execute arbitrary code by sending code in MIME attachments, then requesting the attachments. |
| CVE-2002-2330 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to stats.html and executed in client browsers. |
| CVE-2002-2327 | Medium | 2002-12-31 | Not applicable | No public exploit | Unspecified vulnerability in the environmental monitoring subsystem in Solaris 8 running on Sun Fire 280R, V480 and V880 allows local users to cause a denial of service by setting volatile properties. |
| CVE-2002-2326 | Medium | 2002-12-31 | Not applicable | No public exploit | The default configuration of Mail.app in Mac OS X 10.0 through 10.0.4 and 10.1 through 10.1.5 sends iDisk authentication credentials in cleartext when connecting to Mac.com, which could allow remote attackers to obtain passwords by sniffing network traffic. |
| CVE-2002-2322 | Medium | 2002-12-31 | Not applicable | No public exploit | Ultimate PHP Board (UPB) 1.0b stores the users.dat data file under the web root with insufficient access control, which allows remote attackers to obtain usernames and passwords. |
| CVE-2002-2321 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in (1) showcat.php and (2) addyoursite.php in phpLinkat 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the catid parameter. |
| CVE-2002-2318 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Falcon web server 2.0.0.1009 through 2.0.0.1021 allows remote attackers to inject arbitrary web script or HTML via the URI, which is inserted into 301 error messages and executed by 404 error messages. |
| CVE-2002-2316 | Medium | 2002-12-31 | Not applicable | No public exploit | Cisco Catalyst 4000 series switches running CatOS 5.5.5, 6.3.5, and 7.1.2 do not always learn MAC addresses from a single initial packet, which causes unicast traffic to be broadcast across the switch and allows remote attackers to obtain sensitive network information by sniffing. |
| CVE-2002-2314 | Medium | 2002-12-31 | Not applicable | Working exploit published | Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, which causes the host/path check to fail. |
| CVE-2002-2312 | Medium | 2002-12-31 | Not applicable | Working exploit published | Opera 6.0.1 allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. |
| CVE-2002-2311 | Medium | 2002-12-31 | Not applicable | No public exploit | Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the vendor has disputed the severity of this issue. |
| CVE-2002-2310 | Medium | 2002-12-31 | Not applicable | No public exploit | ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than Apache, which allows remote attackers to obtain usernames and passwords. |
| CVE-2002-2308 | Medium | 2002-12-31 | Not applicable | No public exploit | Netscape Communicator 6.2.1 allows remote attackers to cause a denial of service in client browsers via a webpage containing a recursive META refresh tag where the content tag is blank and the URL tag references itself. |
| CVE-2002-2307 | Medium | 2002-12-31 | Not applicable | No public exploit | The default configuration of BenHur Firewall release 3 update 066 fix 2 allows remote attackers to access arbitrary services by connecting from source port 20. |
| CVE-2002-2302 | Medium | 2002-12-31 | Not applicable | No public exploit | 3D3.Com ShopFactory 5.5 through 5.8 allows remote attackers to modify the prices in their shopping carts by modifying the price in a hidden form field. |
| CVE-2002-2299 | Medium | 2002-12-31 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in thatfile.php in Thatware 0.3 through 0.5.2 allows remote attackers to execute arbitrary PHP code via the root_path parameter. |
| CVE-2002-2298 | Medium | 2002-12-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in config.php in Thatware 0.3 through 0.5.3 allows remote attackers to execute arbitrary PHP code via the root_path parameter. |
| CVE-2002-2297 | Medium | 2002-12-31 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in artlist.php in Thatware 0.5.2 and 0.5.3 allows remote attackers to execute arbitrary PHP code via the root_path parameter. |
| CVE-2002-2296 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in YaBB.pl in Yet Another Bulletin Board (YaBB) 1 Gold SP 1 allows remote attackers to inject arbitrary web script or HTML via the num parameter. |
| CVE-2002-2294 | Medium | 2002-12-31 | Not applicable | No public exploit | Multiple buffer overflows in Symantec Raptor Firewall 6.5 and 6.5.3, Enterprise Firewall 6.5.2 and 7.0, VelociRaptor 500/700/1000 and 1100/1200/1300, and Gateway Security 5110/5200/5300 allow remote attackers to cause a denial of service (service termination) via (1) malformed RealAudio (rad) packets that are not properly handled by the RealAudio Proxy, or (2) crafted packets to the statistics service (statsd). |
| CVE-2002-2293 | Medium | 2002-12-31 | Not applicable | No public exploit | Webshots Desktop screensaver allows local users to bypass the password on the screensaver by pressing CTRL-ALT-DELETE and (1) hitting the cancel button or (2) killing the screensaver from the task manager. |
| CVE-2002-2292 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in Remote Console Applet in Halycon Software iASP 1.0.9 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request to port 9095. |
| CVE-2002-2289 | Medium | 2002-12-31 | Not applicable | No public exploit | soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive information including ODBC passwords. |
| CVE-2002-2288 | Medium | 2002-12-31 | Not applicable | Working exploit published | Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request to index.php with a parameter that does not exist, which causes the path to be leaked in an error message. |
| CVE-2002-2286 | Medium | 2002-12-31 | Not applicable | No public exploit | The parse-get function in utils.c for apt-www-proxy 0.1 allows remote attackers to cause a denial of service (crash) via an empty HTTP request, which causes a null dereference. |
| CVE-2002-2285 | Medium | 2002-12-31 | Not applicable | No public exploit | eTrust InoculateIT 6.0 with the "Incremental Scan" option enabled may certify that a file is free of viruses before the file has been completely downloaded, which allows remote attackers to bypass virus detection. |
| CVE-2002-2284 | Medium | 2002-12-31 | Not applicable | No public exploit | Netscape Communicator 4.0 through 4.79 allows remote attackers to bypass JVM security and execute arbitrary Java code via an applet that loads user-supplied Java classes. |
| CVE-2002-2282 | Medium | 2002-12-31 | Not applicable | No public exploit | McAfee VirusScan 4.5.1, when the WebScanX.exe module is enabled, searches for particular DLLs from the user's home directory, even when browsing the local hard drive, which allows local users to run arbitrary code via malicious versions of those DLLs. |
| CVE-2002-2278 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in mod_search/index.php in PortailPHP 0.99 allows remote attackers to inject arbitrary web script or HTML via the (1) $App_Theme, (2) $Rub_Search, (3) $Rub_News, (4) $Rub_File, (5) $Rub_Liens, or (6) $Rub_Faq variables. |
| CVE-2002-2276 | Medium | 2002-12-31 | Not applicable | No public exploit | Ultimate PHP Board (UPB) 1.0 allows remote attackers to view the physical path of the message board via a direct request to add.php, which leaks the path in an error message. |
| CVE-2002-2273 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Webster HTTP Server allows remote attackers to inject arbitrary web script or HTML via the URL. |
| CVE-2002-2271 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in BigFun 1.51b IRC client, when the Direct Client Connection (DCC) option is used, allows remote attackers to cause a denial of service (crash) via a long string. |
| CVE-2002-2266 | Medium | 2002-12-31 | Not applicable | No public exploit | NetScreen ScreenOS 2.8 through 4.0, when forwarding H.323 or Netmeeting traffic, allows remote attackers to cause a denial of service (firewall session table consumption) by establishing multiple half-open H.323 sessions, which are not cleaned up on garbage removal and do not time out for 36 hours. |
| CVE-2002-2265 | Medium | 2002-12-31 | Not applicable | No public exploit | Unspecified vulnerability in LDAP Module in System Authentication of Open Source Internet Solutions (OSIS) 5.4 running on Tru64 UNIX 4.0G and 4.0F allows remote attackers to gain access to arbitrary files or gain privileges via unknown attack vectors. |
| CVE-2002-2263 | Medium | 2002-12-31 | Not applicable | No public exploit | The installation program for HP-UX Visualize Conference B.11.00.11 running on HP-UX 11.00 and 11.11 installs /etc/dt and its subdirecties with insecure permissions, which allows local users to read or write arbitrary files. |
| CVE-2002-2262 | Medium | 2002-12-31 | Not applicable | No public exploit | Unspecified vulnerability in xntpd of HP-UX 10.20 through 11.11 allows remote attackers to cause a denial of service (hang) via unknown attack vectors. |
| CVE-2002-2260 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page. |
| CVE-2002-2258 | Medium | 2002-12-31 | Not applicable | Working exploit published | Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-numeric value in the Content-Length header, which causes an access violation after a failed atoi function call. |
| CVE-2002-2256 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in pWins Webserver 0.2.5 and earlier allows remote attackers to read arbitrary files via Unicode characters. |