Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2002-0091 | 1 Nswc | 1 Cider Shadow | 2008-09-05 | 7.5 HIGH | N/A |
| Multiple CGI scripts in CIDER SHADOW 1.5 and 1.6 allows remote attackers to execute arbitrary commands via certain form fields. | |||||
| CVE-2002-0094 | 1 Fraunhofer Fit | 1 Bscw | 2008-09-05 | 7.5 HIGH | N/A |
| config_converters.py in BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion. | |||||
| CVE-2002-0095 | 1 Fraunhofer Fit | 1 Bscw | 2008-09-05 | 7.5 HIGH | N/A |
| The default configuration of BSCW (Basic Support for Cooperative Work) 3.x and possibly version 4 enables user self registration, which could allow remote attackers to upload files and possibly join a user community that was intended to be closed. | |||||
| CVE-2002-0096 | 1 Geeklog | 1 Geeklog | 2008-09-05 | 7.2 HIGH | N/A |
| The installation of Geeklog 1.3 creates an extra group_assignments record which is not properly deleted, which causes the first newly created user to be added to the GroupAdmin and UserAdmin groups, which could provide that user with administrative privileges that were not intended. | |||||
| CVE-2002-0117 | 1 Yabb | 1 Yabb | 2008-09-05 | 7.5 HIGH | N/A |
| Cross-site scripting vulnerability in Yet Another Bulletin Board (YaBB) 1 Gold SP 1 and earlier allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag. | |||||
| CVE-2002-0128 | 1 Sambar | 1 Sambar Server | 2008-09-05 | 7.5 HIGH | N/A |
| cgitest.exe in Sambar Server 5.1 before Beta 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long argument. | |||||
| CVE-2002-0157 | 1 Eazel | 1 Nautilus | 2008-09-05 | 4.6 MEDIUM | N/A |
| Nautilus 1.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the .nautilus-metafile.xml metadata file. | |||||
| CVE-2002-0179 | 1 Xpilot | 1 Xpilot | 2008-09-05 | 7.5 HIGH | N/A |
| Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code. | |||||
| CVE-2002-0185 | 1 Apache | 1 Mod Python | 2008-09-05 | 7.5 HIGH | N/A |
| mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attackers to call possibly dangerous functions from the imported module. | |||||
| CVE-2002-0225 | 1 Cisco | 1 Tacacs\+ | 2008-09-05 | 4.6 MEDIUM | N/A |
| tac_plus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and writable permissions, which allows local users to access and modify sensitive files. | |||||
| CVE-2002-0235 | 1 Castelle | 1 Faxpress | 2008-09-05 | 7.5 HIGH | N/A |
| Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event. | |||||
| CVE-2002-0241 | 1 Cisco | 1 Secure Access Control Server | 2008-09-05 | 7.5 HIGH | N/A |
| NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server. | |||||
| CVE-2002-0339 | 1 Cisco | 1 Ios | 2008-09-05 | 5.0 MEDIUM | N/A |
| Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC level packet when the MAC packet's length is less than the IP level packet length. | |||||
| CVE-2002-0358 | 1 Sgi | 1 Mediamail | 2008-09-05 | 4.6 MEDIUM | N/A |
| MediaMail and MediaMail Pro in SGI IRIX 6.5.16 and earlier allows local users to force the program to dump core via certain arguments, which could allow the users to read sensitive data or gain privileges. | |||||
| CVE-2002-0363 | 1 Aladdin Enterprises | 1 Ghostscript | 2008-09-05 | 7.5 HIGH | N/A |
| ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice. | |||||
| CVE-2002-0381 | 3 Freebsd, Netbsd, Openbsd | 3 Freebsd, Netbsd, Openbsd | 2008-09-05 | 5.0 MEDIUM | N/A |
| The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address. | |||||
| CVE-2002-0394 | 1 Red-m | 1 1050ap Lan Acess Point | 2008-09-05 | 10.0 HIGH | N/A |
| Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords. | |||||
| CVE-2002-0406 | 1 Menasoft | 1 Sphereserver | 2008-09-05 | 5.0 MEDIUM | N/A |
| Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server without providing login credentials, which prevents other users from being able to log in. | |||||
| CVE-2002-0410 | 1 Aeromail | 1 Aeromail | 2008-09-05 | 5.0 MEDIUM | N/A |
| send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded. | |||||
| CVE-2002-0411 | 1 Aeromail | 1 Aeromail | 2008-09-05 | 7.5 HIGH | N/A |
| Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line. | |||||
| CVE-2002-0413 | 1 Rebb | 1 Rebb | 2008-09-05 | 7.5 HIGH | N/A |
| Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script. | |||||
| CVE-2002-0414 | 3 Freebsd, Netbsd, Openbsd | 3 Freebsd, Netbsd, Openbsd | 2008-09-05 | 7.5 HIGH | N/A |
| KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets. | |||||
| CVE-2002-0415 | 1 Realnetworks | 1 Realplayer | 2008-09-05 | 1.7 LOW | N/A |
| Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read files that are accessible to RealPlayer via a .. (dot dot) in an HTTP GET request to port 1275. | |||||
| CVE-2002-0416 | 1 Sh39 | 1 Mailserver | 2008-09-05 | 10.0 HIGH | N/A |
| Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port. | |||||
| CVE-2002-0417 | 1 Endymion | 1 Mailman Webmail | 2008-09-05 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the ALTERNATE_TEMPLATES parameter for various mmstdo*.cgi programs. | |||||
| CVE-2002-0418 | 1 Endymion | 1 Sake Mail | 2008-09-05 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the param_name parameter. | |||||
| CVE-2002-0420 | 1 Claymore Systems Inc | 1 Puretls | 2008-09-05 | 7.5 HIGH | N/A |
| Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user sessions. | |||||
| CVE-2002-0421 | 1 Microsoft | 1 Windows Nt | 2008-09-05 | 5.0 MEDIUM | N/A |
| IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr. | |||||
| CVE-2002-0423 | 1 Efingerd | 1 Efingerd | 2008-09-05 | 10.0 HIGH | N/A |
| Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a finger request from an IP address with a long hostname that is obtained via a reverse DNS lookup. | |||||
| CVE-2002-0424 | 1 Efingerd | 1 Efingerd | 2008-09-05 | 4.6 MEDIUM | N/A |
| efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user (typically "nobody"), which allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger. | |||||
| CVE-2002-0425 | 1 Khaled Mardam-bey | 1 Mirc | 2008-09-05 | 5.0 MEDIUM | N/A |
| mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message in a DCC connection request that cannot be ignored or canceled by the user, which may leak the alternate nickname in a response message. | |||||
| CVE-2002-0426 | 1 Linksys | 1 Befvp41 | 2008-09-05 | 7.5 HIGH | N/A |
| VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via manual key entry, which makes it easier for attackers to crack the keys. | |||||
| CVE-2002-0427 | 1 Christof Pohl | 1 Improved Mod Frontpage | 2008-09-05 | 10.0 HIGH | N/A |
| Buffer overflows in fpexec in mod_frontpage before 1.6.1 may allow attackers to gain root privileges. | |||||
| CVE-2001-1224 | 1 Les Vanbrunt | 1 Adrotate Pro | 2008-09-05 | 7.5 HIGH | N/A |
| get_input in adrotate.pm for Les VanBrunt AdRotate Pro 2.0 allows remote attackers to modify the database and possibly execute arbitrary commands via a SQL code injection attack. | |||||
| CVE-2001-1225 | 1 Hughes | 1 Msql | 2008-09-05 | 2.1 LOW | N/A |
| Hughes Technology Mini SQL 2.0.10 through 2.0.12 allows local users to cause a denial of service by creating a very large array in a table, which causes miniSQL to crash when the table is queried. | |||||
| CVE-2001-1226 | 1 Adcycle | 1 Adcycle | 2008-09-05 | 5.0 MEDIUM | N/A |
| AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database. | |||||
| CVE-2001-1234 | 1 Gallery Project | 1 Gallery | 2008-09-05 | 7.5 HIGH | N/A |
| Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable. | |||||
| CVE-2001-1240 | 1 Engardelinux | 1 Secure Linux | 2008-09-05 | 10.0 HIGH | N/A |
| The default configuration of sudo in Engarde Secure Linux 1.0.1 allows any user in the admin group to run certain commands that could be leveraged to gain full root access. | |||||
| CVE-2001-1245 | 1 Opera Software | 1 Opera Web Browser | 2008-09-05 | 5.0 MEDIUM | N/A |
| Opera 5.0 for Linux does not properly handle malformed HTTP headers, which allows remote attackers to cause a denial of service, possibly with a header whose value is the same as a MIME header name. | |||||
| CVE-2001-1253 | 1 Com2001 | 1 Alexis Server | 2008-09-05 | 4.6 MEDIUM | N/A |
| Alexis 2.0 and 2.1 in COM2001 InternetPBX stores voicemail passwords in plain text in the com2001.ini file, which could allow local users to make long distance calls as other users. | |||||
| CVE-2001-1259 | 1 Avaya | 1 Argent Office | 2008-09-05 | 5.0 MEDIUM | N/A |
| Avaya Argent Office allows remote attackers to cause a denial of service by sending UDP packets to port 53 with no payload. | |||||
| CVE-2001-1260 | 1 Avaya | 1 Argent Office | 2008-09-05 | 10.0 HIGH | N/A |
| Avaya Argent Office uses weak encryption (trivial encoding) for passwords, which allows remote attackers to gain administrator privileges by sniffing and decrypting the sniffing the passwords during a system reboot. | |||||
| CVE-2001-1261 | 1 Avaya | 1 Argent Office | 2008-09-05 | 5.0 MEDIUM | N/A |
| Avaya Argent Office 2.1 may allow remote attackers to change hold music by spoofing a legitimate server's response to a TFTP broadcast and providing an alternate HoldMusic file. | |||||
| CVE-2001-1262 | 1 Avaya | 1 Argent Office | 2008-09-05 | 7.5 HIGH | N/A |
| Avaya Argent Office 2.1 compares a user-provided SNMP community string with the correct string only up to the length of the user-provided string, which allows remote attackers to bypass authentication with a 0 length community string. | |||||
| CVE-2001-1266 | 1 Doug Neal | 1 Dnhttpd | 2008-09-05 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in Doug Neal's HTTPD Daemon (DNHTTPD) before 0.4.1 allows remote attackers to view arbitrary files via a .. (dot dot) attack using the dot hex code '%2E'. | |||||
| CVE-2001-1267 | 1 Gnu | 1 Tar | 2008-09-05 | 2.1 LOW | N/A |
| Directory traversal vulnerability in GNU tar 1.13.19 and earlier allows local users to overwrite arbitrary files during archive extraction via a tar file whose filenames contain a .. (dot dot). | |||||
| CVE-2001-1270 | 1 Pkware | 1 Pkzip | 2008-09-05 | 2.1 LOW | N/A |
| Directory traversal vulnerability in the console version of PKZip (pkzipc) 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec (recursive) option via a .. (dot dot) attack on the archived files. | |||||
| CVE-2001-1271 | 1 Rarsoft | 1 Rar | 2008-09-05 | 2.1 LOW | N/A |
| Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) attack on archived filenames. | |||||
| CVE-2001-1272 | 1 Wliang | 1 Wmtv | 2008-09-05 | 4.6 MEDIUM | N/A |
| wmtv 0.6.5 and earlier does not properly drop privileges, which allows local users to execute arbitrary commands via the -e (external command) option. | |||||
| CVE-2001-1273 | 1 Linux | 1 Linux Kernel | 2008-09-05 | 2.1 LOW | N/A |
| The "mxcsr P4" vulnerability in the Linux kernel before 2.2.17-14, when running on certain Intel CPUs, allows local users to cause a denial of service (system halt). | |||||