CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2002 (CVSS score >= 5)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2002-1642 DoS 2002-10-03 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
PostgreSQL 7.2.1 and 7.2.2 allows local users to delete transaction log (pg_clog) data and cause a denial of service (data loss) via the VACUUM command.
2 CVE-2002-1618 Bypass 2002-10-16 2017-10-11
7.2
 None Local Low Not required Complete Complete Complete
JFS (JFS3.1 and OnlineJFS) in HP-UX 10.20, 11.00, and 11.04 does not properly implement the sticky bit functionality, which could allow attackers to bypass intended restrictions on filesystems.
3 CVE-2002-1590 264 DoS +Priv 2002-10-29 2018-10-30
7.2
 None Local Low Not required Complete Complete Complete
The Web-Based Enterprise Management (WBEM) packages (1) SUNWwbdoc, (2) SUNWwbcou, (3) SUNWwbdev and (4) SUNWmgapp packages, when installed using Solaris 8 Update 1/01 or later, install files with world or group write permissions, which allows local users to gain root privileges or cause a denial of service.
4 CVE-2002-1229 +Priv 2002-10-28 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Avaya Cajun switches P880, P882, P580, and P550R 5.2.14 and earlier contain undocumented accounts (1) manuf and (2) diag with default passwords, which allows remote attackers to gain privileges.
5 CVE-2002-1228 DoS 2002-10-28 2018-10-30
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in NFS on Solaris 2.5.1 through Solaris 9 allows an NFS client to cause a denial of service by killing the lockd daemon.
6 CVE-2002-1227 +Priv 2002-10-28 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
PAM 0.76 treats a disabled password as if it were an empty (null) password, which allows local and remote attackers to gain privileges as disabled users.
7 CVE-2002-1226 Overflow 2002-10-28 2016-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Unknown vulnerabilities in Heimdal before 0.5 with unknown impact, possibly in the (1) kadmind and (2) kdc servers, may allow remote or local attackers to gain root or other access, but not via buffer overflows (CVE-2002-1225).
8 CVE-2002-1225 Overflow 2002-10-28 2016-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Heimdal before 0.5, possibly in both the (1) kadmind and (2) kdc servers, may allow remote attackers to gain root access.
9 CVE-2002-1224 Dir. Trav. 2002-10-28 2008-09-05
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in kpf for KDE 3.0.1 through KDE 3.0.3a allows remote attackers to read arbitrary files as the kpf user via a URL with a modified icon parameter.
10 CVE-2002-1223 DoS Exec Code Overflow 2002-10-28 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in DSC 3.0 parser from GSview, as used in KGhostView in KDE 1.1 and KDE 3.0.3a, may allow attackers to cause a denial of service or execute arbitrary code via a modified .ps (PostScript) input file.
11 CVE-2002-1222 119 DoS Overflow 2002-10-28 2008-09-10
7.1
 None Remote Medium Not required None None Complete
Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reset) via a long HTTP request.
12 CVE-2002-1217 Exec Code Bypass 2002-10-28 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions.
13 CVE-2002-1216 2002-10-28 2016-10-18
5.0
 None Remote Low Not required None Partial None
GNU tar 1.13.19 and other versions before 1.13.25 allows remote attackers to overwrite arbitrary files via a symlink attack, as the result of a modification that effectively disabled the security check.
14 CVE-2002-1215 Exec Code Overflow 2002-10-28 2008-09-10
10.0
 None Remote Low Not required Complete Complete Complete
Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier (claimed as buffer overflows in some sources) allow remote attackers to execute arbitrary code via certain packets to UDP port 694 (incorrectly claimed as TCP in some sources).
15 CVE-2002-1214 DoS Exec Code Overflow 2002-10-28 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft PPTP Service on Windows XP and Windows 2000 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a certain PPTP packet with malformed control data.
16 CVE-2002-1213 Dir. Trav. 2002-10-28 2008-09-10
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to read arbitrary files via an HTTP request with ".." (dot-dot) sequences containing URL-encoded forward slash ("%2F") characters.
17 CVE-2002-1212 DoS Overflow 2002-10-28 2008-09-10
5.0
 None Remote Low Not required None None Partial
Buffer overflow in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.
18 CVE-2002-1203 399 DoS 2002-10-28 2016-10-18
5.0
 None Remote Low Not required None None Partial
IBM SecureWay Firewall before 4.2.2 performs extra processing before determining that a packet is invalid and dropping it, which allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed TCP packets without any flags set.
19 CVE-2002-1202 2002-10-28 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in routed for HP Tru64 UNIX V4.0F through V5.1A allows local and remote attackers to read arbitrary files.
20 CVE-2002-1201 DoS 2002-10-28 2016-10-18
5.0
 None Remote Low Not required None None Partial
IBM AIX 4.3.3 and AIX 5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a flood of malformed TCP packets without any flags set, which prevents AIX from releasing the associated memory buffers.
21 CVE-2002-1200 119 DoS Exec Code Overflow 2002-10-28 2020-05-19
7.5
 None Remote Low Not required Partial Partial Partial
Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.
22 CVE-2002-1199 Dir. Trav. 2002-10-28 2018-10-30
5.0
 None Remote Low Not required Partial None None
The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments.
23 CVE-2002-1198 Sql 2002-10-28 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL injection attack.
24 CVE-2002-1197 Exec Code 2002-10-28 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail.
25 CVE-2002-1196 2002-10-28 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.
26 CVE-2002-1194 Exec Code Overflow 2002-10-28 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in talkd on NetBSD 1.6 and earlier, and possibly other operating systems, may allow remote attackers to execute arbitrary code via a long inbound message.
27 CVE-2002-1191 DoS 2002-10-28 2016-10-18
5.0
 None Remote Low Not required None None Partial
The Sabserv client component in Sabre Desktop Reservation Software 4.2 through 4.4 allows remote attackers to cause a denial of service via malformed input to TCP port 1001.
28 CVE-2002-1190 2002-10-28 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Cisco Unity 2.x and 3.x uses well-known default user accounts, which could allow remote attackers to gain access and place arbitrary calls.
29 CVE-2002-1179 Exec Code Overflow 2002-10-28 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long "From" address, which triggers the overflow when the user views or previews the message.
30 CVE-2002-1178 Exec Code Dir. Trav. 2002-10-11 2016-10-18
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\ (dot-dot backslash) sequences in an HTTP request to the cgi-bin directory.
31 CVE-2002-1175 20 DoS 2002-10-11 2016-10-18
5.0
 None Remote Low Not required None None Partial
The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.
32 CVE-2002-1174 119 DoS Exec Code Overflow 2002-10-11 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.
33 CVE-2002-1170 DoS 2002-10-11 2018-05-03
5.0
 None Remote Low Not required None None Partial
The handle_var_requests function in snmp_agent.c for the SNMP daemon in the Net-SNMP (formerly ucd-snmp) package 5.0.1 through 5.0.5 allows remote attackers to cause a denial of service (crash) via a NULL dereference.
34 CVE-2002-1166 Exec Code Overflow 2002-10-11 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in John Franks WN Server 1.18.2 through 2.0.0 allows remote attackers to execute arbitrary code via a long GET request.
35 CVE-2002-1156 2002-10-11 2021-06-06
5.0
 None Remote Low Not required Partial None None
Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
36 CVE-2002-1154 DoS 2002-10-11 2008-09-05
5.0
 None Remote Low Not required None None Partial
anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cause a denial of service (disk consumption) by using the command to report updates more frequently and fill the web server error log.
37 CVE-2002-1153 DoS Exec Code 2002-10-11 2016-10-18
5.0
 None Remote Low Not required None None Partial
IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers, such as "Host".
38 CVE-2002-1152 2002-10-11 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Konqueror in KDE 3.0 through 3.0.2 does not properly detect the "secure" flag in an HTTP cookie, which could cause Konqueror to send the cookie across an unencrypted channel, which could allow remote attackers to steal the cookie via sniffing.
39 CVE-2002-1151 XSS 2002-10-11 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains.
40 CVE-2002-1149 +Info 2002-10-11 2016-10-18
5.0
 None Remote Low Not required Partial None None
The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings.
41 CVE-2002-1148 2002-10-11 2019-03-25
5.0
 None Remote Low Not required Partial None None
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
42 CVE-2002-1147 DoS 2002-10-11 2016-10-18
7.1
 None Remote Medium Not required None None Complete
The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration enabled, does not authenticate requests to reset the device, which allows remote attackers to cause a denial of service via a direct request to the device_reset CGI program.
43 CVE-2002-1146 DoS Overflow 2002-10-11 2008-09-10
5.0
 None Remote Low Not required None None Partial
The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
44 CVE-2002-1145 +Priv 2002-10-28 2018-10-12
10.0
 None Remote Low Not required Complete Complete Complete
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.
45 CVE-2002-1141 DoS 2002-10-11 2018-10-12
5.0
 None Remote Low Not required None None Partial
An input validation error in the Sun Microsystems RPC library Services for Unix 3.0 Interix SD, as implemented on Microsoft Windows NT4, 2000, and XP, allows remote attackers to cause a denial of service via malformed fragmented RPC client packets, aka "Denial of service by sending an invalid RPC request."
46 CVE-2002-1140 DoS 2002-10-11 2018-10-12
5.0
 None Remote Low Not required None None Partial
The Sun Microsystems RPC library Services for Unix 3.0 Interix SD, as implemented on Microsoft Windows NT4, 2000, and XP, allows remote attackers to cause a denial of service (service hang) via malformed packet fragments, aka "Improper parameter size check leading to denial of service."
47 CVE-2002-1139 2002-10-11 2018-10-12
5.0
 None Remote Low Not required None Partial None
The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination folder during the decompression of ZIP files, which allows attackers to place an executable file in a known location on a user's system, aka "Incorrect Target Path for Zipped File Decompression."
48 CVE-2002-1138 2002-10-11 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka "Flaw in Output File Handling for Scheduled Jobs."
49 CVE-2002-1137 Exec Code Overflow 2002-10-11 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a "non-SQL OLEDB data source" such as FoxPro, a variant of CAN-2002-0644.
50 CVE-2002-1135 Exec Code 2002-10-04 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
modsecurity.php 1.10 and earlier, in phpWebSite 0.8.2 and earlier, allows remote attackers to execute arbitrary PHP source code via an inc_prefix parameter that points to the malicious code.
Total number of vulnerabilities : 287   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.