Overview 2,768 matches · 40 in Waratek scope · 3 protected · 8 exploited · 0 CISA KEV · 824 public PoC · 30 EPSS ≥ 0.5
2,768matches
40in Waratek scope1.4%
3protected0.1%
8exploited0.3%
0CISA KEV0.0%
824public PoC29.8%
30EPSS ≥ 0.51.1%
Protected by Waratek
3
0.1%
Rule in development
0
0.0%
Mitigation candidate
12
0.4%
No exploit published
25
0.9%
Outside Waratek scope
12
0.4%
Not applicable
2,716
98.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.1%
partly blocked
0
0.0%
not blocked
2,765
99.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
8
0.3%
Working exploit published
823
29.7%
Proof of concept only
0
0.0%
Forecast only
5
0.2%
No public exploit
1,932
69.8%
split by
peak 980 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
200337
Protected by Waratek1
No exploit published3
Not applicable33
Medium37
blocked by ARMR today1
not blocked36
Working exploit published5
No public exploit32
19891991199319951997199920012003
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2003-0076 | Medium | 2003-02-19 | Not applicable | No public exploit | Unknown vulnerability in the directory parser for Direct Connect 4 Linux (dcgui) before 0.2.2 allows remote attackers to read files outside the sharelist. |
| CVE-2003-0073 | Medium | 2003-02-19 | Not applicable | No public exploit | Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user. |
| CVE-2003-0058 | Medium | 2003-02-19 | Not applicable | No public exploit | MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference. |
| CVE-2003-0048 | Medium | 2003-02-19 | Not applicable | No public exploit | PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials. |
| CVE-2003-0047 | Medium | 2003-02-19 | Not applicable | No public exploit | SSH2 clients for VanDyke (1) SecureCRT 4.0.2 and 3.4.7, (2) SecureFX 2.1.2 and 2.0.4, and (3) Entunnel 1.0.2 and earlier, do not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials. |
| CVE-2003-0046 | Medium | 2003-02-19 | Not applicable | No public exploit | AbsoluteTelnet SSH2 client does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials. |
| CVE-2002-1405 | Medium | 2003-02-19 | Not applicable | Working exploit published | CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters. |
| CVE-2002-1348 | Medium | 2003-02-19 | Not applicable | No public exploit | w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies. |
| CVE-2002-0669 | Medium | 2003-02-19 | Not applicable | No public exploit | The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause a denial of service by modifying the SIP_AUTHENTICATE_SCHEME value to force authentication of incoming calls, which does not notify the user when an authentication failure occurs. |
| CVE-2002-0036 | Medium | 2003-02-19 | Not applicable | No public exploit | Integer signedness error in MIT Kerberos V5 ASN.1 decoder before krb5 1.2.5 allows remote attackers to cause a denial of service via a large unsigned data element length, which is later used as a negative value. |
| CVE-2003-1079 | Medium | 2003-02-18 | Not applicable | No public exploit | Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC, and 2.5.1 through 8 for x86, allows remote attackers to cause a denial of service (memory consumption) via certain arguments in RPC calls that cause large amounts of memory to be allocated. |
| CVE-2003-0045 | Medium | 2003-02-07 | No exploit published | No public exploit | Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp. |
| CVE-2003-0044 | Medium | 2003-02-07 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML. |
| CVE-2003-0043 | Medium | 2003-02-07 | No exploit published | No public exploit | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file. |
| CVE-2003-0042 | Medium | 2003-02-07 | Protected by Waratek | Working exploit published | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character. |
| CVE-2003-0039 | Medium | 2003-02-07 | Not applicable | No public exploit | ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (packet storm) via a certain BOOTP packet that is forwarded to a broadcast MAC address, causing an infinite loop that is not restricted by a hop count. |
| CVE-2003-0038 | Medium | 2003-02-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters. |
| CVE-2003-0036 | Medium | 2003-02-07 | Not applicable | No public exploit | ml85p, as included in the printer-drivers package for Mandrake Linux, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable filenames of the form "mlg85p%d". |
| CVE-2003-0027 | Medium | 2003-02-07 | Not applicable | No public exploit | Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. |
| CVE-2003-0017 | Medium | 2003-02-07 | Not applicable | No public exploit | Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served. |
| CVE-2003-0007 | Medium | 2003-02-07 | Not applicable | No public exploit | Microsoft Outlook 2002 does not properly handle requests to encrypt email messages with V1 Exchange Server Security certificates, which causes Outlook to send the email in plaintext, aka "Flaw in how Outlook 2002 handles V1 Exchange Server Security Certificates could lead to Information Disclosure." |
| CVE-2003-0002 | Medium | 2003-02-07 | Not applicable | Working exploit published | Cross-site scripting vulnerability (XSS) in ManualLogin.asp script for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary script via the REASONTXT parameter. |
| CVE-2002-1252 | Medium | 2003-02-07 | Not applicable | No public exploit | The Application Messaging Gateway for PeopleTools 8.1x before 8.19, as used in various PeopleSoft products, allows remote attackers to read arbitrary files via certain XML External Entities (XXE) fields in an HTTP POST request that is processed by the SimpleFileHandler handler. |
| CVE-2003-1075 | Medium | 2003-01-27 | Not applicable | No public exploit | Unknown vulnerability in the FTP server (in.ftpd) for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (temporary FTP server hang), which affects other active mode FTP clients. |
| CVE-2003-0032 | Medium | 2003-01-17 | Not applicable | No public exploit | Memory leak in libmcrypt before 2.5.5 allows attackers to cause a denial of service (memory exhaustion) via a large number of requests to the application, which causes libmcrypt to dynamically load algorithms via libtool. |
| CVE-2003-0001 | Medium | 2003-01-17 | Not applicable | Working exploit published | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. |
| CVE-2002-1402 | Medium | 2003-01-17 | Not applicable | No public exploit | Buffer overflows in the (1) TZ and (2) SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code. |
| CVE-2002-1401 | Medium | 2003-01-17 | Not applicable | No public exploit | Buffer overflows in (1) circle_poly, (2) path_encode and (3) path_add (also incorrectly identified as path_addr) for PostgreSQL 7.2.3 and earlier allow attackers to cause a denial of service and possibly execute arbitrary code, possibly as a result of an integer overflow. |
| CVE-2002-1398 | Medium | 2003-01-17 | Not applicable | No public exploit | Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input." |
| CVE-2002-1390 | Medium | 2003-01-17 | Not applicable | No public exploit | The daemon for GeneWeb before 4.09 does not properly handle requested paths, which allows remote attackers to read arbitrary files via a crafted URL. |
| CVE-2003-0014 | Medium | 2003-01-11 | Not applicable | No public exploit | gsinterf.c in bmv 1.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. |
| CVE-2002-0630 | Medium | 2003-01-07 | Not applicable | No public exploit | The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via long or malformed ICMP packets. |
| CVE-2002-0629 | Medium | 2003-01-07 | Not applicable | No public exploit | The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via multiple connections to the server. |
| CVE-2002-1389 | Medium | 2003-01-02 | Not applicable | No public exploit | Buffer overflow in typespeed 0.4.2 and earlier allows local users to gain privileges via long input. |
| CVE-2002-1388 | Medium | 2003-01-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages. |
| CVE-2002-1387 | Medium | 2003-01-02 | Not applicable | No public exploit | The spray mode in traceroute-nanog (aka traceroute-ng) may allow local users to overwrite arbitrary memory locations via an array index overflow using the nprobes (number of probes) argument. |
| CVE-2002-1386 | Medium | 2003-01-02 | Not applicable | No public exploit | Buffer overflow in traceroute-nanog (aka traceroute-ng) may allow local users to execute arbitrary code via a long hostname argument. |
| CVE-2002-2426 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information. |
| CVE-2002-2424 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in PHP(Reactor) 1.2.7 pl1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the style attribute of an HTML tag. |
| CVE-2002-2423 | Medium | 2002-12-31 | Not applicable | No public exploit | Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address from being logged via a long IDENT response. |
| CVE-2002-2422 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Compaq Insight Management Agents 2.0, 2.1, 3.6.0, 4.2 and 4.3.7 allows remote attackers to inject arbitrary web script or HTML via a URL, which inserts the script into the resulting error message. |
| CVE-2002-2418 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in acFreeProxy (aka acFP) 1.33 beta 7 allows remote attackers to inject arbitrary web script or HTML via the URL, which is inserted into an error page. |
| CVE-2002-2416 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request. |
| CVE-2002-2415 | Medium | 2002-12-31 | Not applicable | No public exploit | Allied Telesyn AT-8024 1.3.1 and Rapier 24 switches allow remote authenticated users to cause a denial of service in the management interface via a stream of zero (null) bytes sent via UDP to a running service. |
| CVE-2002-2414 | Medium | 2002-12-31 | Not applicable | No public exploit | Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority (CA) certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service (crash). |
| CVE-2002-2413 | Medium | 2002-12-31 | Not applicable | No public exploit | WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name. |
| CVE-2002-2410 | Medium | 2002-12-31 | Not applicable | No public exploit | openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information. |
| CVE-2002-2407 | Medium | 2002-12-31 | Not applicable | No public exploit | Certain patches for QNX Neutrino realtime operating system (RTOS) 6.2.0 set insecure permissions for the files (1) /sbin/io-audio by OS Update Patch A, (2) /bin/shutdown, (3) /sbin/fs-pkg, and (4) phshutdown by QNX experimental patches, (5) cpim, (6) vpim, (7) phrelaycfg, and (8) columns, (9) othello, (10) peg, (11) solitaire, and (12) vpoker in the games pack 2.0.3, which allows local users to gain privileges by modifying the files before permissions are changed. |
| CVE-2002-2406 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in HTTP server in LiteServe 2.0, 2.0.1 and 2.0.2 allows remote attackers to cause a denial of service (hang) via a large number of percent characters (%) in an HTTP GET request. |
| CVE-2002-2405 | Medium | 2002-12-31 | Not applicable | No public exploit | Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall. |
| CVE-2002-2404 | Medium | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP port 110). |
| CVE-2002-2403 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...", "....", ".....", and other multiple dot sequences. |
| CVE-2002-2399 | Medium | 2002-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in viewAttachment.cgi in W3Mail 1.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. |
| CVE-2002-2398 | Medium | 2002-12-31 | Not applicable | No public exploit | The new thread posting page in APBoard 2.02 and 2.03 allows remote attackers to post messages to protected forums by modifying the insertinto parameter. |
| CVE-2002-2395 | Medium | 2002-12-31 | Not applicable | No public exploit | InterScan VirusWall 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 gzip content encoding. |
| CVE-2002-2394 | Medium | 2002-12-31 | Not applicable | No public exploit | InterScan VirusWall 3.6 for Linux and 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 chunked transfer encoding. |
| CVE-2002-2393 | Medium | 2002-12-31 | Not applicable | No public exploit | Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights, which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands. |
| CVE-2002-2392 | Medium | 2002-12-31 | Not applicable | No public exploit | Winamp 2.65 through 3.0 stores skin files in a predictable file location, which allows remote attackers to execute arbitrary code via a URL reference to (1) wsz and (2) wal files that contain embedded code. |
| CVE-2002-2389 | Medium | 2002-12-31 | Not applicable | No public exploit | TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files. |
| CVE-2002-2388 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in INweb POP3 mail server 2.01 allows remote attackers to cause a denial of service (crash) via a long HELO command. |
| CVE-2002-2387 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in Hyperion FTP server 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the LS command. |
| CVE-2002-2386 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Quizz module for XOOPS 1.0, when allowing on-line question development, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the SRC attribute of an IMG tag. |
| CVE-2002-2380 | Medium | 2002-12-31 | Not applicable | No public exploit | NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic. |
| CVE-2002-2378 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in AN HTTP 1.41d allows remote attackers to inject arbitrary web script or HTML via a colon (:) in the query string, which is inserted into the resulting error page. |
| CVE-2002-2377 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in addentry.cgi in ZAP 1.0.3 allows remote attackers to inject arbitrary SSi directives, web script, and HTML via the entry field. |
| CVE-2002-2376 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in E-Guest_sign.pl in E-Guest 1.1 allows remote attackers to inject arbitrary SSI directives, web script, and HTML via the (1) full name, (2) email, (3) homepage, and (4) location parameters. NOTE: this issue might overlap CVE-2005-1605. |
| CVE-2002-2375 | Medium | 2002-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user, although there is a possibility that it could be used to infer product version information. |
| CVE-2002-2372 | Medium | 2002-12-31 | Not applicable | No public exploit | The telnet server in Infoprint 21 running controller software before 1.056007 allows remote attackers to cause a denial of service (crash) via a long username, possibly due to a buffer overflow. |
| CVE-2002-2370 | Medium | 2002-12-31 | Not applicable | Working exploit published | SWS web server 0.0.4, 0.0.3 and 0.1.0 allows remote attackers to cause a denial of service (crash) via a URL request that does not end with a newline. |
| CVE-2002-2369 | Medium | 2002-12-31 | Not applicable | No public exploit | Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL. |
| CVE-2002-2366 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the XML parser of Trillian 0.6351, 0.725 and 0.73 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a skin with a long colors file name in trillian.xml. |
| CVE-2002-2364 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in PHP Ticket 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a help ticket. |
| CVE-2002-2362 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in form_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML via the noticemsg parameter. |
| CVE-2002-2361 | Medium | 2002-12-31 | Not applicable | No public exploit | The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan programs via DNS spoofing. |
| CVE-2002-2359 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the FTP view feature in Mozilla 1.0 allows remote attackers to inject arbitrary web script or HTML via the title tag of an ftp URL. |
| CVE-2002-2358 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the FTP view feature in Opera 6.0 and 6.01 through 6.04 allows remote attackers to inject arbitrary web script or HTML via the title tag of an FTP URL. |
| CVE-2002-2357 | Medium | 2002-12-31 | Not applicable | Working exploit published | MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a buffer overflow. |
| CVE-2002-2356 | Medium | 2002-12-31 | Not applicable | No public exploit | HAMweather 2.x allows remote attackers to modify administrative settings and obtain sensitive information via a direct request to hwadmin.cgi. |
| CVE-2002-2353 | Medium | 2002-12-31 | Not applicable | Working exploit published | tftpd32 2.50 and 2.50.2 allows remote attackers to read or write arbitrary files via a full pathname in GET and PUT requests. |
| CVE-2002-2352 | Medium | 2002-12-31 | Not applicable | No public exploit | The NBActiveX.ocx ActiveX control in NeoBook 4 allows remote attackers to install and execute arbitrary programs. |
| CVE-2002-2351 | Medium | 2002-12-31 | Not applicable | Working exploit published | Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a trailing "." (dot). |
| CVE-2002-2350 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in z_user_show.php in dbtreelistproperty_method.php in Zorum 2.4 allows remote attackers to inject arbitrary web script or HTML via the class parameter. |
| CVE-2002-2349 | Medium | 2002-12-31 | Not applicable | Working exploit published | phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information. |
| CVE-2002-2348 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in athcgi.exe in Authoria HR allows remote attackers to inject arbitrary web script or HTML via the command parameter. |
| CVE-2002-2347 | Medium | 2002-12-31 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field. |
| CVE-2002-2346 | Medium | 2002-12-31 | Not applicable | No public exploit | phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses. |
| CVE-2002-2344 | Medium | 2002-12-31 | Not applicable | No public exploit | Ensim WEBppliance 3.0 and 3.1 allows remote attackers to read mail intended for other users by defining an alias that is the target's email address. |
| CVE-2002-2343 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email messages. |
| CVE-2002-2342 | Medium | 2002-12-31 | Not applicable | No public exploit | Bannermatic 1, 2, and 3 stores the (1) ban.log, (2) ban.bak, (3) ban.dat and (4) banmat.pwd data files under the web document root with insufficient access control, which allows attackers to obtain sensitive information via a direct request for the files. |
| CVE-2002-2341 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web script or HTML via a blocked URL. |
| CVE-2002-2340 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response. |
| CVE-2002-2339 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in (1) image, (2) img, (3) image=right, (4) img=right, (5) image=left, and (6) img=left tags. |
| CVE-2002-2338 | Medium | 2002-12-31 | Not applicable | Working exploit published | The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of service (no new mail) via a mail message containing a dot (.) at a newline, which is interpreted as the end of the message. |
| CVE-2002-2337 | Medium | 2002-12-31 | Not applicable | No public exploit | Kaspersky Anti-Hacker 1.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets. |
| CVE-2002-2336 | Medium | 2002-12-31 | Not applicable | Working exploit published | Norton Personal Firewall 2002 4.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets. |
| CVE-2002-2335 | Medium | 2002-12-31 | Not applicable | Working exploit published | Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain user names and passwords and log in using protection.php. |
| CVE-2002-2333 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in konqueror in KDE 2.1 through 3.0 and 3.0.2 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes. |
| CVE-2002-2332 | Medium | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in Opera 6.01 allows remote attackers to cause a denial of service (crash) via an IMG tag with large width and height attributes. |
| CVE-2002-2331 | Medium | 2002-12-31 | Not applicable | No public exploit | W3Mail 1.0.2 through 1.0.5 with server side scripting (SSI) enabled in the attachments directory does not properly restrict the types of files that can be uploaded as attachments, which allows remote attackers to execute arbitrary code by sending code in MIME attachments, then requesting the attachments. |
| CVE-2002-2330 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to stats.html and executed in client browsers. |