CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2002

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2001-1451 DoS 2002-10-22 2019-04-30
5.0
None Remote Low Not required None None Partial
Memory leak in the SNMP LAN Manager (LANMAN) MIB extension for Microsoft Windows 2000 before SP3, when the Print Spooler is not running, allows remote attackers to cause a denial of service (memory consumption) via a large number of GET or GETNEXT requests.
2 CVE-2002-0370 DoS Exec Code Overflow 2002-10-10 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.
3 CVE-2002-0384 Exec Code Overflow 2002-10-04 2008-09-10
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in Jabber plug-in for Gaim client before 0.58 allows remote attackers to execute arbitrary code.
4 CVE-2002-0399 Dir. Trav. 2002-10-10 2018-10-19
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
5 CVE-2002-0662 2002-10-04 2016-10-18
2.1
None Local Low Not required None Partial None
scrollkeeper-get-cl in ScrollKeeper 0.3 to 0.3.11 allows local users to create and overwrite files via a symlink attack on the scrollkeeper-tempfile.x temporary files.
6 CVE-2002-0664 2002-10-04 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
The default Access Control Lists (ACLs) of the administration database for ZMerge 4.x and 5.x provides arbitrary users (including anonymous users) with Manager level access, which allows the users to read or modify import/export scripts.
7 CVE-2002-0692 DoS Overflow 2002-10-10 2019-04-30
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in SmartHTML Interpreter (shtml.dll) in Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to cause a denial of service (CPU consumption) or run arbitrary code, respectively, via a certain type of web file request.
8 CVE-2002-0693 Exec Code Overflow 2002-10-10 2019-04-30
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function.
9 CVE-2002-0694 Exec Code 2002-10-10 2019-04-30
7.5
None Remote Low Not required Partial Partial Partial
The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File."
10 CVE-2002-0696 2002-10-04 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
Microsoft Visual FoxPro 6.0 does not register its associated files with Internet Explorer, which allows remote attackers to execute Visual FoxPro applications without warning via HTML that references specially-crafted filenames.
11 CVE-2002-0699 2002-10-04 2018-10-12
5.0
None Remote Low Not required None Partial None
Unknown vulnerability in the Certificate Enrollment ActiveX Control in Microsoft Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000, and Windows XP allow remote attackers to delete digital certificates on a user's system via HTML.
12 CVE-2002-0705 2002-10-10 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
The Web Reports Server for SurfControl SuperScout WebFilter stores the "scwebusers" username and password file in a web-accessible directory, which allows remote attackers to obtain valid usernames and crack the passwords.
13 CVE-2002-0706 2002-10-10 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, which allows remote attackers to decrypt the administrative password using a hard-coded key in a Javascript function.
14 CVE-2002-0707 DoS Overflow 2002-10-10 2016-10-18
5.0
None Remote Low Not required None None Partial
The Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to cause a denial of service (CPU consumption) via large GET requests, possibly due to a buffer overflow.
15 CVE-2002-0708 Dir. Trav. 2002-10-10 2016-10-18
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to read arbitrary files via an HTTP request containing ... (triple dot) sequences.
16 CVE-2002-0709 Sql 2002-10-10 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerabilities in the Web Reports Server for SurfControl SuperScout WebFilter allow remote attackers to execute arbitrary SQL queries via the RunReport option to SimpleBar.dll, and possibly other DLLs.
17 CVE-2002-0835 DoS 2002-10-04 2008-09-05
5.0
None Remote Low Not required None None Partial
Preboot eXecution Environment (PXE) server allows remote attackers to cause a denial of service (crash) via certain DHCP packets from Voice-Over-IP (VOIP) phones.
18 CVE-2002-0836 Exec Code 2002-10-28 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.
19 CVE-2002-0837 Exec Code XSS 2002-10-04 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
wordtrans 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to (1) execute arbitrary code or (2) conduct cross-site scripting attacks via certain parameters (possibly "dict") to the wordtrans.php script.
20 CVE-2002-0838 Exec Code Overflow 2002-10-10 2016-10-18
4.6
None Local Low Not required Partial Partial Partial
Buffer overflow in (1) gv 3.5.8 and earlier, (2) gvv 1.0.2 and earlier, (3) ggv 1.99.90 and earlier, (4) gnome-gv, and (5) kghostview in kdegraphics 2.2.2 and earlier, allows attackers to execute arbitrary code via a malformed (a) PDF or (b) PostScript file, which is processed by an unsafe call to sscanf.
21 CVE-2002-0839 DoS 2002-10-11 2021-06-06
7.2
None Local Low Not required Complete Complete Complete
The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
22 CVE-2002-0840 XSS 2002-10-11 2021-06-06
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
23 CVE-2002-0843 DoS Exec Code Overflow 2002-10-11 2021-06-06
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
24 CVE-2002-0850 Exec Code Overflow 2002-10-04 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted.
25 CVE-2002-0862 2002-10-04 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
26 CVE-2002-0863 2002-10-11 2019-04-30
5.0
None Remote Low Not required Partial None None
Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol."
27 CVE-2002-0864 DoS 2002-10-11 2019-04-30
5.0
None Remote Low Not required None None Partial
The Remote Data Protocol (RDP) version 5.1 in Microsoft Windows XP allows remote attackers to cause a denial of service (crash) when Remote Desktop is enabled via a PDU Confirm Active data packet that does not set the Pattern BLT command, aka "Denial of Service in Remote Desktop."
28 CVE-2002-0865 Exec Code 2002-10-11 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
A certain class that supports XML (Extensible Markup Language) in Microsoft Virtual Machine (VM) 5.0.3805 and earlier, probably com.ms.osp.ospmrshl, exposes certain unsafe methods, which allows remote attackers to execute unsafe code via a Java applet, aka "Inappropriate Methods Exposed in XML Support Classes."
29 CVE-2002-0866 2002-10-11 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL terminated by a null string, aka "DLL Execution via JDBC Classes."
30 CVE-2002-0867 DoS 2002-10-11 2018-10-12
5.0
None Remote Low Not required None None Partial
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet Explorer via invalid handle data in a Java applet, aka "Handle Validation Flaw."
31 CVE-2002-0876 DoS 2002-10-04 2008-09-05
5.0
None Remote Low Not required None None Partial
Web server for Shambala 4.5 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request.
32 CVE-2002-0877 Dir. Trav. 2002-10-04 2008-09-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the FTP server for Shambala 4.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) LIST (ls) or (2) GET commands.
33 CVE-2002-0878 Sql Bypass 2002-10-04 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the login form for LogiSense software including (1) Hawk-i Billing, (2) Hawk-i ASP and (3) DNS Manager allows remote attackers to bypass authentication via SQL code in the password field.
34 CVE-2002-0879 2002-10-04 2008-09-05
5.0
None Remote Low Not required Partial None None
showtemp.cfm for Gafware CFXImage 1.6.6 allows remote attackers to read arbitrary files via (1) a .. or (2) a C: style pathname in the FILE parameter.
35 CVE-2002-0880 DoS 2002-10-04 2018-10-30
5.0
None Remote Low Not required None None Partial
Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allow remote attackers to cause a denial of service (crash) via malformed packets as demonstrated by (1) "jolt", (2) "jolt2", (3) "raped", (4) "hping2", (5) "bloop", (6) "bubonic", (7) "mutant", (8) "trash", and (9) "trash2."
36 CVE-2002-0881 2002-10-04 2018-10-30
2.1
None Local Low Not required None Partial None
Cisco IP Phone (VoIP) models 7910, 7940, and 7960 use a default administrative password, which allows attackers with physical access to the phone to modify the configuration settings.
37 CVE-2002-0882 DoS 2002-10-04 2018-10-30
6.4
None Remote Low Not required Partial None Partial
The web server for Cisco IP Phone (VoIP) models 7910, 7940, and 7960 allows remote attackers to cause a denial of service (reset) and possibly read sensitive memory via a large integer value in (1) the stream ID of the StreamingStatistics script, or (2) the port ID of the PortInformation script.
38 CVE-2002-0883 2002-10-04 2008-09-05
7.2
None Local Low Not required Complete Complete Complete
Vulnerability in Compaq ProLiant BL e-Class Integrated Administrator 1.0 and 1.10, allows authenticated users with Telnet, SSH, or console access to conduct unauthorized activities.
39 CVE-2002-0884 Exec Code 2002-10-04 2018-10-30
7.5
None Remote Low Not required Partial Partial Partial
Multiple format string vulnerabilities in in.rarpd (ARP server) on Solaris, Caldera UnixWare and Open UNIX, and possibly other operating systems, allows remote attackers to execute arbitrary code via format strings that are not properly handled in the functions (1) syserr and (2) error.
40 CVE-2002-0885 Exec Code Overflow 2002-10-04 2018-10-30
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in in.rarpd (ARP server) on Solaris, and possibly other operating systems including Caldera UnixWare and Open UNIX, allow remote attackers to execute arbitrary code, possibly via the functions (1) syserr and (2) error.
41 CVE-2002-0886 DoS 2002-10-04 2017-07-11
5.0
None Remote Low Not required None None Partial
Cisco DSL CPE devices running CBOS 2.4.4 and earlier allows remote attackers to cause a denial of service (hang or memory consumption) via (1) a large packet to the DHCP port, (2) a large packet to the Telnet port, or (3) a flood of large packets to the CPE, which causes the TCP/IP stack to consume large amounts of memory.
42 CVE-2002-0887 2002-10-04 2016-10-18
2.1
None Local Low Not required None Partial None
scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files.
43 CVE-2002-0888 Bypass 2002-10-04 2012-05-12
7.5
None Remote Low Not required Partial Partial Partial
3Com OfficeConnect Remote 812 ADSL Router, firmware 1.1.9 and 1.1.7, allows remote attackers to bypass port access restrictions by connecting to an approved port and quickly connecting to the desired port, which is allowed by the router.
44 CVE-2002-0889 DoS Exec Code Overflow 2002-10-04 2016-10-18
4.6
None Local Low Not required Partial Partial Partial
Buffer overflow in Qpopper (popper) 4.0.4 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a long bulldir argument in the user's .qpopper-options configuration file.
45 CVE-2002-0891 DoS 2002-10-04 2008-09-05
5.0
None Remote Low Not required None None Partial
The web interface (WebUI) of NetScreen ScreenOS before 2.6.1r8, and certain 2.8.x and 3.0.x versions before 3.0.3r1, allows remote attackers to cause a denial of service (crash) via a long user name.
46 CVE-2002-0892 2002-10-04 2008-09-05
5.0
None Remote Low Not required Partial None None
The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct request to com.newatlanta.servletexec.JSP10Servlet without a filename, which leaks the pathname in an error message.
47 CVE-2002-0893 Dir. Trav. 2002-10-04 2008-09-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to read arbitrary files via a URL-encoded request to com.newatlanta.servletexec.JSP10Servlet containing "..%5c" (modified dot-dot) sequences.
48 CVE-2002-0894 DoS 2002-10-04 2008-09-05
5.0
None Remote Low Not required None None Partial
NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to cause a denial of service (crash) via (1) a request for a long .jsp file, or (2) a long URL sent directly to com.newatlanta.servletexec.JSP10Servlet.
49 CVE-2002-0895 DoS Exec Code Overflow 2002-10-04 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in MatuFtpServer 1.1.3.0 (1.1.3) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long PASS (password) command.
50 CVE-2002-0896 2002-10-04 2008-09-05
5.0
None Remote Low Not required Partial None None
The throttle capability in Swatch may fail to report certain events if (1) the same type of event occurs after the throttle period, or (2) when multiple events matching the same "watchfor" expression do not occur after the throttle period, which could allow attackers to avoid detection.
Total number of vulnerabilities : 314   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.