Overview 6,365 matches · 0 in Waratek scope · 0 protected · 36 exploited · 1 CISA KEV · 1,886 public PoC · 94 EPSS ≥ 0.5
6,365matches
0in Waratek scope0.0%
0protected0.0%
36exploited0.6%
1CISA KEV0.0%
1,886public PoC29.6%
94EPSS ≥ 0.51.5%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
6,365
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
6,365
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
36
0.6%
Working exploit published
1,862
29.3%
Proof of concept only
0
0.0%
Forecast only
12
0.2%
No public exploit
4,455
70.0%
split by
peak 2,107 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19893
Not applicable3
High2
Medium1
not blocked3
No public exploit3
199011
Not applicable11
High8
Medium2
Low1
not blocked11
Working exploit published1
No public exploit10
199115
Not applicable15
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
199213
Not applicable13
High12
Low1
not blocked13
No public exploit13
199313
Not applicable13
High8
Medium3
Low2
not blocked13
No public exploit13
199425
Not applicable25
High14
Medium10
Low1
not blocked25
Working exploit published6
No public exploit19
199525
Not applicable25
Critical1
High17
Medium6
Low1
not blocked25
Working exploit published5
No public exploit20
199673
Not applicable73
Critical1
High42
Medium21
Low9
not blocked73
Working exploit published17
Forecast only1
No public exploit55
1997252
Not applicable252
Critical1
High143
Medium89
Low19
not blocked252
Exploited2
Working exploit published73
Forecast only2
No public exploit175
1998246
Not applicable246
Critical1
High137
Medium85
Low23
not blocked246
Exploited1
Working exploit published50
No public exploit195
1999891
Not applicable891
Critical3
High421
Medium356
Low111
not blocked891
Exploited2
Working exploit published280
No public exploit609
20001,005
Not applicable1,005
Critical2
High447
Medium460
Low96
not blocked1,005
Exploited5
Working exploit published420
No public exploit580
20011,649
Not applicable1,649
Critical12
High764
Medium693
Low180
not blocked1,649
Exploited14
Working exploit published474
Forecast only2
No public exploit1,159
20022,107
Not applicable2,107
Critical10
High1,004
Medium953
Low140
not blocked2,107
Exploited12
Working exploit published531
Forecast only7
No public exploit1,557
200335
Not applicable35
High17
Medium14
Low4
not blocked35
Working exploit published2
No public exploit33
19891991199319951997199920012003
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2003-1075 | Medium | 2003-01-27 | Not applicable | No public exploit | Unknown vulnerability in the FTP server (in.ftpd) for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (temporary FTP server hang), which affects other active mode FTP clients. |
| CVE-2003-0032 | Medium | 2003-01-17 | Not applicable | No public exploit | Memory leak in libmcrypt before 2.5.5 allows attackers to cause a denial of service (memory exhaustion) via a large number of requests to the application, which causes libmcrypt to dynamically load algorithms via libtool. |
| CVE-2003-0031 | High | 2003-01-17 | Not applicable | No public exploit | Multiple buffer overflows in libmcrypt before 2.5.5 allow attackers to cause a denial of service (crash). |
| CVE-2003-0026 | High | 2003-01-17 | Not applicable | No public exploit | Multiple stack-based buffer overflows in the error handling routines of the minires library, as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10, allow remote attackers to execute arbitrary code via a DHCP message containing a long hostname. |
| CVE-2003-0025 | High | 2003-01-17 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3. |
| CVE-2003-0013 | High | 2003-01-17 | Not applicable | No public exploit | The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file. |
| CVE-2003-0012 | Low | 2003-01-17 | Not applicable | No public exploit | The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data. |
| CVE-2003-0001 | Medium | 2003-01-17 | Not applicable | Working exploit published | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. |
| CVE-2002-1403 | High | 2003-01-17 | Not applicable | No public exploit | dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script. |
| CVE-2002-1402 | Medium | 2003-01-17 | Not applicable | No public exploit | Buffer overflows in the (1) TZ and (2) SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code. |
| CVE-2002-1401 | Medium | 2003-01-17 | Not applicable | No public exploit | Buffer overflows in (1) circle_poly, (2) path_encode and (3) path_add (also incorrectly identified as path_addr) for PostgreSQL 7.2.3 and earlier allow attackers to cause a denial of service and possibly execute arbitrary code, possibly as a result of an integer overflow. |
| CVE-2002-1400 | High | 2003-01-17 | Not applicable | No public exploit | Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string. |
| CVE-2002-1399 | High | 2003-01-17 | Not applicable | No public exploit | Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later versions before 7.2.3, with unknown impact, based on an invalid integer input which is processed as a different data type, as demonstrated using cash_out(2). |
| CVE-2002-1398 | Medium | 2003-01-17 | Not applicable | No public exploit | Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input." |
| CVE-2002-1397 | High | 2003-01-17 | Not applicable | No public exploit | Vulnerability in the cash_words() function for PostgreSQL 7.2 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a large negative argument, possibly triggering an integer signedness error or buffer overflow. |
| CVE-2002-1396 | High | 2003-01-17 | Not applicable | No public exploit | Heap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow attackers to cause a denial of service or execute arbitrary code. |
| CVE-2002-1395 | Low | 2003-01-17 | Not applicable | No public exploit | Internet Message (IM) 141-18 and earlier uses predictable file and directory names, which allows local users to (1) obtain unauthorized directory permissions via a temporary directory used by impwagent, and (2) overwrite and create arbitrary files via immknmz. |
| CVE-2002-1393 | High | 2003-01-17 | Not applicable | No public exploit | Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses. |
| CVE-2002-1392 | Low | 2003-01-17 | Not applicable | No public exploit | faxspool in mgetty before 1.1.29 uses a world-writable spool directory for outgoing faxes, which allows local users to modify fax transmission privileges. |
| CVE-2002-1391 | High | 2003-01-17 | Not applicable | No public exploit | Buffer overflow in cnd-program for mgetty before 1.1.29 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Caller ID string with a long CallerName argument. |
| CVE-2002-1390 | Medium | 2003-01-17 | Not applicable | No public exploit | The daemon for GeneWeb before 4.09 does not properly handle requested paths, which allows remote attackers to read arbitrary files via a crafted URL. |
| CVE-2003-0014 | Medium | 2003-01-11 | Not applicable | No public exploit | gsinterf.c in bmv 1.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. |
| CVE-2002-0630 | Medium | 2003-01-07 | Not applicable | No public exploit | The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via long or malformed ICMP packets. |
| CVE-2002-0629 | Medium | 2003-01-07 | Not applicable | No public exploit | The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via multiple connections to the server. |
| CVE-2002-0628 | High | 2003-01-07 | Not applicable | No public exploit | The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack. |
| CVE-2002-0627 | High | 2003-01-07 | Not applicable | No public exploit | The Web server for Polycom ViewStation before 7.2.4 allows remote attackers to bypass authentication and read files via Unicode encoded requests. |
| CVE-2002-0626 | High | 2003-01-07 | Not applicable | No public exploit | Polycom ViewStation before 7.2.4 has a default null password for the administrator account, which allows arbitrary users to conduct unauthorized activities. |
| CVE-2003-1071 | Low | 2003-01-03 | Not applicable | Working exploit published | rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header. |
| CVE-2002-1389 | Medium | 2003-01-02 | Not applicable | No public exploit | Buffer overflow in typespeed 0.4.2 and earlier allows local users to gain privileges via long input. |
| CVE-2002-1388 | Medium | 2003-01-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages. |
| CVE-2002-1387 | Medium | 2003-01-02 | Not applicable | No public exploit | The spray mode in traceroute-nanog (aka traceroute-ng) may allow local users to overwrite arbitrary memory locations via an array index overflow using the nprobes (number of probes) argument. |
| CVE-2002-1386 | Medium | 2003-01-02 | Not applicable | No public exploit | Buffer overflow in traceroute-nanog (aka traceroute-ng) may allow local users to execute arbitrary code via a long hostname argument. |
| CVE-2002-1384 | High | 2003-01-02 | Not applicable | No public exploit | Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf. |
| CVE-2002-1379 | High | 2003-01-02 | Not applicable | No public exploit | OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges. |
| CVE-2002-1378 | High | 2003-01-02 | Not applicable | No public exploit | Multiple buffer overflows in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allow remote attackers to execute arbitrary code via (1) long -t or -r parameters to slurpd, (2) a malicious ldapfilter.conf file that is not properly handled by getfilter functions, (3) a malicious ldaptemplates.conf that causes an overflow in libldap, (4) a certain access control list that causes an overflow in slapd, or (5) a long generated filename for logging rejected replication requests. |
| CVE-2002-2426 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information. |
| CVE-2002-2425 | High | 2002-12-31 | Not applicable | Working exploit published | Sun AnswerBook2 1.2 through 1.4.2 allows remote attackers to execute administrative scripts such as (1) AdminViewError and (2) AdminAddadmin via a direct request. |
| CVE-2002-2424 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in PHP(Reactor) 1.2.7 pl1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the style attribute of an HTML tag. |
| CVE-2002-2423 | Medium | 2002-12-31 | Not applicable | No public exploit | Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address from being logged via a long IDENT response. |
| CVE-2002-2422 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Compaq Insight Management Agents 2.0, 2.1, 3.6.0, 4.2 and 4.3.7 allows remote attackers to inject arbitrary web script or HTML via a URL, which inserts the script into the resulting error message. |
| CVE-2002-2421 | High | 2002-12-31 | Not applicable | No public exploit | acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2. |
| CVE-2002-2420 | High | 2002-12-31 | Not applicable | Working exploit published | site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter. |
| CVE-2002-2419 | High | 2002-12-31 | Not applicable | No public exploit | Direct connect text client (DCTC) client 0.83.3 allows remote attackers to cause a denial of service (crash) via a string ending with a NULL byte character. |
| CVE-2002-2418 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in acFreeProxy (aka acFP) 1.33 beta 7 allows remote attackers to inject arbitrary web script or HTML via the URL, which is inserted into an error page. |
| CVE-2002-2417 | High | 2002-12-31 | Not applicable | Working exploit published | acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges. |
| CVE-2002-2416 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request. |
| CVE-2002-2415 | Medium | 2002-12-31 | Not applicable | No public exploit | Allied Telesyn AT-8024 1.3.1 and Rapier 24 switches allow remote authenticated users to cause a denial of service in the management interface via a stream of zero (null) bytes sent via UDP to a running service. |
| CVE-2002-2414 | Medium | 2002-12-31 | Not applicable | No public exploit | Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority (CA) certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service (crash). |
| CVE-2002-2413 | Medium | 2002-12-31 | Not applicable | No public exploit | WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name. |
| CVE-2002-2412 | Low | 2002-12-31 | Not applicable | No public exploit | Winamp 2.80 stores authentication credentials in plaintext in the (1) [HTTP-AUTH] and (2) [winamp] sections in winamp.ini, which allows local users to gain access to other accounts. |
| CVE-2002-2411 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command. |
| CVE-2002-2410 | Medium | 2002-12-31 | Not applicable | No public exploit | openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information. |
| CVE-2002-2409 | Low | 2002-12-31 | Not applicable | No public exploit | Photon microGUI in QNX Neutrino realtime operating system (RTOS) 6.1.0 and 6.2.0 allows attackers to read user clipboard information via a direct request to the 1.TEXT file in a directory whose name is a hex-encoded user ID. |
| CVE-2002-2408 | High | 2002-12-31 | Not applicable | No public exploit | Gordano Messaging Server (GMS) Mail 8 (a.k.a. NTMail) only filters email messages for the first recipient, which allows remote attackers to bypass JUCE filters by sending a message to more than one user on the GMS server. |
| CVE-2002-2407 | Medium | 2002-12-31 | Not applicable | No public exploit | Certain patches for QNX Neutrino realtime operating system (RTOS) 6.2.0 set insecure permissions for the files (1) /sbin/io-audio by OS Update Patch A, (2) /bin/shutdown, (3) /sbin/fs-pkg, and (4) phshutdown by QNX experimental patches, (5) cpim, (6) vpim, (7) phrelaycfg, and (8) columns, (9) othello, (10) peg, (11) solitaire, and (12) vpoker in the games pack 2.0.3, which allows local users to gain privileges by modifying the files before permissions are changed. |
| CVE-2002-2406 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in HTTP server in LiteServe 2.0, 2.0.1 and 2.0.2 allows remote attackers to cause a denial of service (hang) via a large number of percent characters (%) in an HTTP GET request. |
| CVE-2002-2405 | Medium | 2002-12-31 | Not applicable | No public exploit | Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall. |
| CVE-2002-2404 | Medium | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP port 110). |
| CVE-2002-2403 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...", "....", ".....", and other multiple dot sequences. |
| CVE-2002-2402 | High | 2002-12-31 | Not applicable | No public exploit | SURECOM broadband router EP-4501 uses a default SNMP read community string of "public" and a default SNMP read/write community string of "secret," which allows remote attackers to read and modify router configuration information. |
| CVE-2002-2401 | Low | 2002-12-31 | Not applicable | No public exploit | NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs. |
| CVE-2002-2400 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in the httpdProcessRequest function in LibHTTPD 1.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP POST request. |
| CVE-2002-2399 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in viewAttachment.cgi in W3Mail 1.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. |
| CVE-2002-2398 | Medium | 2002-12-31 | Not applicable | No public exploit | The new thread posting page in APBoard 2.02 and 2.03 allows remote attackers to post messages to protected forums by modifying the insertinto parameter. |
| CVE-2002-2397 | High | 2002-12-31 | Not applicable | No public exploit | Sygate personal firewall 5.0 could allow remote attackers to bypass firewall filters via spoofed (1) source IP address of 127.0.0.1 or (2) network address of 127.0.0.0. |
| CVE-2002-2396 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in Advanced TFTP (atftp) 0.5 and 0.6, if installed setuid or setgid, may allow local users to execute arbitrary code via a long argument to the -g option. |
| CVE-2002-2395 | Medium | 2002-12-31 | Not applicable | No public exploit | InterScan VirusWall 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 gzip content encoding. |
| CVE-2002-2394 | Medium | 2002-12-31 | Not applicable | No public exploit | InterScan VirusWall 3.6 for Linux and 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 chunked transfer encoding. |
| CVE-2002-2393 | Medium | 2002-12-31 | Not applicable | No public exploit | Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights, which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands. |
| CVE-2002-2392 | Medium | 2002-12-31 | Not applicable | No public exploit | Winamp 2.65 through 3.0 stores skin files in a predictable file location, which allows remote attackers to execute arbitrary code via a URL reference to (1) wsz and (2) wal files that contain embedded code. |
| CVE-2002-2391 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter. |
| CVE-2002-2390 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the IDENT daemon (identd) in Trillian 0.6351, 0.725, 0.73, 0.74 and 1.0 pro allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long request. |
| CVE-2002-2389 | Medium | 2002-12-31 | Not applicable | No public exploit | TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files. |
| CVE-2002-2388 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in INweb POP3 mail server 2.01 allows remote attackers to cause a denial of service (crash) via a long HELO command. |
| CVE-2002-2387 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in Hyperion FTP server 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the LS command. |
| CVE-2002-2386 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Quizz module for XOOPS 1.0, when allowing on-line question development, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the SRC attribute of an IMG tag. |
| CVE-2002-2385 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in hotfoon4.exe in Hotfoon 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL containing a long voice phone number. |
| CVE-2002-2384 | Low | 2002-12-31 | Not applicable | No public exploit | hotfoon4.exe in Hotfoon 4.00 stores user names and passwords in cleartext in the hotfoon2 registry key, which allows local users to gain access to user accounts and steal phone service. |
| CVE-2002-2383 | High | 2002-12-31 | Not applicable | No public exploit | SQL injection vulnerability in f2html.pl 0.1 through 0.4 allows remote attackers to execute arbitrary SQL commands via file names. |
| CVE-2002-2382 | High | 2002-12-31 | Not applicable | No public exploit | cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out. |
| CVE-2002-2381 | High | 2002-12-31 | Not applicable | No public exploit | Multiple buffer overflows in (1) tetrinet_inmessage, (2) speclist_add and (3) config-getthemeinfo of GTetrinet 0.4.3 and earlier allow remote attackers to casue a denial of service and possibly execute arbitrary code. |
| CVE-2002-2380 | Medium | 2002-12-31 | Not applicable | No public exploit | NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic. |
| CVE-2002-2379 | High | 2002-12-31 | Not applicable | Working exploit published | Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor |
| CVE-2002-2378 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in AN HTTP 1.41d allows remote attackers to inject arbitrary web script or HTML via a colon (:) in the query string, which is inserted into the resulting error page. |
| CVE-2002-2377 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in addentry.cgi in ZAP 1.0.3 allows remote attackers to inject arbitrary SSi directives, web script, and HTML via the entry field. |
| CVE-2002-2376 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in E-Guest_sign.pl in E-Guest 1.1 allows remote attackers to inject arbitrary SSI directives, web script, and HTML via the (1) full name, (2) email, (3) homepage, and (4) location parameters. NOTE: this issue might overlap CVE-2005-1605. |
| CVE-2002-2375 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user, although there is a possibility that it could be used to infer product version information. |
| CVE-2002-2374 | High | 2002-12-31 | Not applicable | No public exploit | Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files." |
| CVE-2002-2373 | High | 2002-12-31 | Not applicable | No public exploit | The default configuration of the TCP/IP printer configuration utility in Apple LaserWriter 12/640 PS printer contains a blank Telnet password, which allows remote attackers to gain access. |
| CVE-2002-2372 | Medium | 2002-12-31 | Not applicable | No public exploit | The telnet server in Infoprint 21 running controller software before 1.056007 allows remote attackers to cause a denial of service (crash) via a long username, possibly due to a buffer overflow. |
| CVE-2002-2371 | High | 2002-12-31 | Not applicable | No public exploit | Linksys WET11 firmware 1.31 and 1.32 allows remote attackers to cause a denial of service (crash) via a packet containing the device's hardware address as the source MAC address in the DLC header. |
| CVE-2002-2370 | Medium | 2002-12-31 | Not applicable | Working exploit published | SWS web server 0.0.4, 0.0.3 and 0.1.0 allows remote attackers to cause a denial of service (crash) via a URL request that does not end with a newline. |
| CVE-2002-2369 | Medium | 2002-12-31 | Not applicable | No public exploit | Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL. |
| CVE-2002-2368 | High | 2002-12-31 | Not applicable | No public exploit | Multiple buffer overflows in NEC SOCKS5 1.0 r11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long username to (1) the GetString function in proxy.c for the SOCKS5 module or (2) the HandleS4Connection function in proxy.c for the SOCKS4 module. |
| CVE-2002-2367 | High | 2002-12-31 | Not applicable | No public exploit | Off-by-one buffer overflow in NEC SOCKS5 1.0 r11 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long hostname. |
| CVE-2002-2366 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the XML parser of Trillian 0.6351, 0.725 and 0.73 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a skin with a long colors file name in trillian.xml. |
| CVE-2002-2365 | High | 2002-12-31 | Not applicable | No public exploit | Simple WAIS (SWAIS) 1.11 allows remote attackers to execute arbitrary commands via the shell metacharacters in the search field, as demonstrated using the "|" (pipe) character. |
| CVE-2002-2364 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in PHP Ticket 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a help ticket. |
| CVE-2002-2363 | High | 2002-12-31 | Not applicable | No public exploit | VJE.VJE-RUN in HP-UX 11.00 adds bin to /etc/PATH, which could allow local users to gain privileges. |
| CVE-2002-2362 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in form_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML via the noticemsg parameter. |