# CVEs published 2002-05-03

218 CVEs were published on May 3, 2002: 0 critical, 0 high. Days are UTC.

- [CVE-2001-1232](https://cve.now/CVE-2001-1232.md): GroupWise WebAccess 5.5 with directory indexing enabled allows a remote attacker to view arbitrary directory contents via an HTTP request wi (no CVSS)
- [CVE-2001-1233](https://cve.now/CVE-2001-1233.md): Netware Enterprise Web Server 5.1 running GroupWise WebAccess 5.5 with Novell Directory Services (NDS) enabled allows remote attackers to en (no CVSS)
- [CVE-2001-1238](https://cve.now/CVE-2001-1238.md): Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) s (no CVSS)
- [CVE-2001-1239](https://cve.now/CVE-2001-1239.md): PowerNet IX allows remote attackers to cause a denial of service via a port scan. (no CVSS)
- [CVE-2001-1241](https://cve.now/CVE-2001-1241.md): Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to ex (no CVSS)
- [CVE-2001-1242](https://cve.now/CVE-2001-1242.md): Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. (no CVSS)
- [CVE-2001-1243](https://cve.now/CVE-2001-1243.md): Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) vi (no CVSS)
- [CVE-2001-1244](https://cve.now/CVE-2001-1244.md): Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum (no CVSS)
- [CVE-2001-1245](https://cve.now/CVE-2001-1245.md): Opera 5.0 for Linux does not properly handle malformed HTTP headers, which allows remote attackers to cause a denial of service, possibly wi (no CVSS)
- [CVE-2001-1248](https://cve.now/CVE-2001-1248.md): vWebServer 1.2.0 allows remote attackers to view arbitrary ASP scripts via a request for an ASP script that ends with a URL-encoded space ch (no CVSS)
- [CVE-2001-1249](https://cve.now/CVE-2001-1249.md): vWebServer 1.2.0 allows remote attackers to cause a denial of service via a URL that contains MS-DOS device names. (no CVSS)
- [CVE-2001-1250](https://cve.now/CVE-2001-1250.md): vWebServer 1.2.0 allows remote attackers to cause a denial of service (hang) via a small number of long URL requests, possibly due to a buff (no CVSS)
- [CVE-2001-1253](https://cve.now/CVE-2001-1253.md): Alexis 2.0 and 2.1 in COM2001 InternetPBX stores voicemail passwords in plain text in the com2001.ini file, which could allow local users to (no CVSS)
- [CVE-2001-1254](https://cve.now/CVE-2001-1254.md): Web Access component for COM2001 Alexis 2.0 and 2.1 in InternetPBX sends username and voice mail passwords in the clear via a Java applet th (no CVSS)
- [CVE-2001-1255](https://cve.now/CVE-2001-1255.md): WinMySQLadmin 1.1 stores the MySQL password in plain text in the my.ini file, which allows local users to obtain unathorized access the MySQ (no CVSS)
- [CVE-2001-1256](https://cve.now/CVE-2001-1256.md): kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable files via a symlink attack on the (1) /tmp/. (no CVSS)
- [CVE-2001-1257](https://cve.now/CVE-2001-1257.md): Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbit (no CVSS)
- [CVE-2001-1258](https://cve.now/CVE-2001-1258.md): Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password (no CVSS)
- [CVE-2001-1259](https://cve.now/CVE-2001-1259.md): Avaya Argent Office allows remote attackers to cause a denial of service by sending UDP packets to port 53 with no payload. (no CVSS)
- [CVE-2001-1260](https://cve.now/CVE-2001-1260.md): Avaya Argent Office uses weak encryption (trivial encoding) for passwords, which allows remote attackers to gain administrator privileges by (no CVSS)
- [CVE-2001-1261](https://cve.now/CVE-2001-1261.md): Avaya Argent Office 2.1 may allow remote attackers to change hold music by spoofing a legitimate server's response to a TFTP broadcast and p (no CVSS)
- [CVE-2001-1262](https://cve.now/CVE-2001-1262.md): Avaya Argent Office 2.1 compares a user-provided SNMP community string with the correct string only up to the length of the user-provided st (no CVSS)
- [CVE-2001-1263](https://cve.now/CVE-2001-1263.md): telnet95.exe in Pragma InterAccess 4.0 build 5 allows remote attackers to cause a denial of service (crash) via a large number of characters (no CVSS)
- [CVE-2001-1264](https://cve.now/CVE-2001-1264.md): Vulnerability in mkacct in HP-UX 11.04 running Virtualvault Operating System (VVOS) 4.0 and 4.5 allows attackers to elevate privileges. (no CVSS)
- [CVE-2001-1265](https://cve.now/CVE-2001-1265.md): Directory traversal vulnerability in IBM alphaWorks Java TFTP server 1.21 allows remote attackers to conduct unauthorized operations on arbi (no CVSS)
- [CVE-2001-1268](https://cve.now/CVE-2001-1268.md): Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction (no CVSS)
- [CVE-2001-1269](https://cve.now/CVE-2001-1269.md): Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that be (no CVSS)
- [CVE-2001-1270](https://cve.now/CVE-2001-1270.md): Directory traversal vulnerability in the console version of PKZip (pkzipc) 4.00 and earlier allows attackers to overwrite arbitrary files du (no CVSS)
- [CVE-2001-1271](https://cve.now/CVE-2001-1271.md): Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (no CVSS)
- [CVE-2001-1272](https://cve.now/CVE-2001-1272.md): wmtv 0.6.5 and earlier does not properly drop privileges, which allows local users to execute arbitrary commands via the -e (external comman (no CVSS)
- [CVE-2001-1273](https://cve.now/CVE-2001-1273.md): The "mxcsr P4" vulnerability in the Linux kernel before 2.2.17-14, when running on certain Intel CPUs, allows local users to cause a denial (no CVSS)
- [CVE-2001-1274](https://cve.now/CVE-2001-1274.md): Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service and possibly gain privileges. (no CVSS)
- [CVE-2001-1275](https://cve.now/CVE-2001-1275.md): MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from th (no CVSS)
- [CVE-2001-1278](https://cve.now/CVE-2001-1278.md): Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt at (no CVSS)
- [CVE-2001-1280](https://cve.now/CVE-2001-1280.md): POP3 Server for Ipswitch IMail 7.04 and earlier generates different responses to valid and invalid user names, which allows remote attackers (no CVSS)
- [CVE-2001-1281](https://cve.now/CVE-2001-1281.md): Web Messaging Server for Ipswitch IMail 7.04 and earlier allows remote authenticated users to change information for other users by modifyin (no CVSS)
- [CVE-2001-1282](https://cve.now/CVE-2001-1282.md): Ipswitch IMail 7.04 and earlier records the physical path of attachments in an e-mail message header, which could allow remote attackers to (no CVSS)
- [CVE-2001-1283](https://cve.now/CVE-2001-1283.md): The webmail interface for Ipswitch IMail 7.04 and earlier allows remote authenticated users to cause a denial of service (crash) via a mailb (no CVSS)
- [CVE-2001-1284](https://cve.now/CVE-2001-1284.md): Ipswitch IMail 7.04 and earlier uses predictable session IDs for authentication, which allows remote attackers to hijack sessions of other u (no CVSS)
- [CVE-2001-1285](https://cve.now/CVE-2001-1285.md): Directory traversal vulnerability in readmail.cgi for Ipswitch IMail 7.04 and earlier allows remote attackers to access the mailboxes of oth (no CVSS)
- [CVE-2001-1286](https://cve.now/CVE-2001-1286.md): Ipswitch IMail 7.04 and earlier stores a user's session ID in a URL, which could allow remote attackers to hijack sessions by obtaining the (no CVSS)
- [CVE-2001-1287](https://cve.now/CVE-2001-1287.md): Buffer overflow in Web Calendar in Ipswitch IMail 7.04 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET req (no CVSS)
- [CVE-2001-1288](https://cve.now/CVE-2001-1288.md): Windows 2000 and Windows NT allows local users to cause a denial of service (reboot) by executing a command at the command prompt and pressi (no CVSS)
- [CVE-2001-1289](https://cve.now/CVE-2001-1289.md): Quake 3 arena 1.29f and 1.29g allows remote attackers to cause a denial of service (crash) via a malformed connection packet that begins wit (no CVSS)
- [CVE-2001-1290](https://cve.now/CVE-2001-1290.md): admin.cgi in Active Classifieds Free Edition 1.0, and possibly commercial versions, allows remote attackers to modify the configuration, gai (no CVSS)
- [CVE-2001-1292](https://cve.now/CVE-2001-1292.md): Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password. (no CVSS)
- [CVE-2001-1293](https://cve.now/CVE-2001-1293.md): Buffer overflow in web server of 3com HomeConnect Cable Modem External with USB (#3CR29223) allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2001-1294](https://cve.now/CVE-2001-1294.md): Buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier allows remote attackers to cause a denial of service (crash) in the Webmail interf (no CVSS)
- [CVE-2001-1298](https://cve.now/CVE-2001-1298.md): Webodex PHP script 1.0 and earlier allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets th (no CVSS)
- [CVE-2001-1300](https://cve.now/CVE-2001-1300.md): Directory traversal vulnerability in Dynu FTP server 1.05 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2001-1304](https://cve.now/CVE-2001-1304.md): Buffer overflow in SHOUTcast Server 1.8.2 allows remote attackers to cause a denial of service (crash) via several HTTP requests with a long (no CVSS)
- [CVE-2001-1305](https://cve.now/CVE-2001-1305.md): ICQ 2001a Alpha and earlier allows remote attackers to automatically add arbitrary UINs to an ICQ user's contact list via a URL to a web pag (no CVSS)
- [CVE-2001-1306](https://cve.now/CVE-2001-1306.md): iPlanet Directory Server 4.1.4 and earlier (LDAP) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrar (no CVSS)
- [CVE-2001-1307](https://cve.now/CVE-2001-1307.md): Buffer overflows in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possib (no CVSS)
- [CVE-2001-1308](https://cve.now/CVE-2001-1308.md): Format string vulnerabilities in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (cras (no CVSS)
- [CVE-2001-1309](https://cve.now/CVE-2001-1309.md): Buffer overflows in IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as (no CVSS)
- [CVE-2001-1310](https://cve.now/CVE-2001-1310.md): IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings f (no CVSS)
- [CVE-2001-1311](https://cve.now/CVE-2001-1311.md): Buffer overflows in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrar (no CVSS)
- [CVE-2001-1312](https://cve.now/CVE-2001-1312.md): Format string vulnerabilities in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly exe (no CVSS)
- [CVE-2001-1313](https://cve.now/CVE-2001-1313.md): Lotus Domino R5 before R5.0.7a allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via miscella (no CVSS)
- [CVE-2001-1314](https://cve.now/CVE-2001-1314.md): Buffer overflows in Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of servi (no CVSS)
- [CVE-2001-1315](https://cve.now/CVE-2001-1315.md): Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possi (no CVSS)
- [CVE-2001-1316](https://cve.now/CVE-2001-1316.md): Buffer overflows in Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute a (no CVSS)
- [CVE-2001-1317](https://cve.now/CVE-2001-1317.md): Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via i (no CVSS)
- [CVE-2001-1318](https://cve.now/CVE-2001-1318.md): Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service (crash) and possibly execute arb (no CVSS)
- [CVE-2001-1319](https://cve.now/CVE-2001-1319.md): Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptional BER encodings for the LDAP filter ty (no CVSS)
- [CVE-2001-1320](https://cve.now/CVE-2001-1320.md): Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via ex (no CVSS)
- [CVE-2001-1321](https://cve.now/CVE-2001-1321.md): Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitra (no CVSS)
- [CVE-2001-1323](https://cve.now/CVE-2001-1323.md): Buffer overflow in MIT Kerberos 5 (krb5) 1.2.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitra (no CVSS)
- [CVE-2001-1324](https://cve.now/CVE-2001-1324.md): cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec\_env function, (no CVSS)
- [CVE-2001-1325](https://cve.now/CVE-2001-1325.md): Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled (no CVSS)
- [CVE-2001-1326](https://cve.now/CVE-2001-1326.md): Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables in (no CVSS)
- [CVE-2001-1329](https://cve.now/CVE-2001-1329.md): Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument. (no CVSS)
- [CVE-2001-1330](https://cve.now/CVE-2001-1330.md): Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument. (no CVSS)
- [CVE-2001-1331](https://cve.now/CVE-2001-1331.md): mandb in the man-db package before 2.3.16-3 allows local users to overwrite arbitrary files via the command line options (1) -u or (2) -c, w (no CVSS)
- [CVE-2001-1332](https://cve.now/CVE-2001-1332.md): Buffer overflows in Linux CUPS before 1.1.6 may allow remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2001-1333](https://cve.now/CVE-2001-1333.md): Linux CUPS before 1.1.6 does not securely handle temporary files, possibly due to a symlink vulnerability that could allow local users to ov (no CVSS)
- [CVE-2001-1335](https://cve.now/CVE-2001-1335.md): Directory traversal vulnerability in CesarFTP 0.98b and earlier allows remote authenticated users (such as anonymous) to read arbitrary file (no CVSS)
- [CVE-2001-1336](https://cve.now/CVE-2001-1336.md): CesarFTP 0.98b and earlier stores usernames and passwords in plaintext in the settings.ini file, which allows attackers to gain privileges. (no CVSS)
- [CVE-2001-1337](https://cve.now/CVE-2001-1337.md): Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request. (no CVSS)
- [CVE-2001-1338](https://cve.now/CVE-2001-1338.md): Beck IPC GmbH IPC@CHIP TelnetD server generates different responses when given valid and invalid login names, which allows remote attackers (no CVSS)
- [CVE-2001-1339](https://cve.now/CVE-2001-1339.md): Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it eas (no CVSS)
- [CVE-2001-1340](https://cve.now/CVE-2001-1340.md): Beck GmbH IPC@Chip TelnetD service supports only one connection and does not disconnect a user who does not complete the login process, whic (no CVSS)
- [CVE-2001-1341](https://cve.now/CVE-2001-1341.md): The Beck GmbH IPC@Chip embedded web server installs the chipcfg.cgi program by default, which allows remote attackers to obtain sensitive ne (no CVSS)
- [CVE-2001-1343](https://cve.now/CVE-2001-1343.md): ws\_mail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacter (no CVSS)
- [CVE-2001-1344](https://cve.now/CVE-2001-1344.md): WSSecurity.pl in WebStore allows remote attackers to bypass authentication by providing the program with a filename that exists, which is ma (no CVSS)
- [CVE-2001-1346](https://cve.now/CVE-2001-1346.md): Computer Associates ARCserveIT 6.61 and 6.63 (also called ARCservIT) allows local users to overwrite arbitrary files via a symlink attack on (no CVSS)
- [CVE-2001-1348](https://cve.now/CVE-2001-1348.md): TWIG 2.6.2 and earlier allows remote attackers to perform unauthorized database operations via a SQL injection attack on the id parameter. (no CVSS)
- [CVE-2002-0198](https://cve.now/CVE-2002-0198.md): Buffer overflow in plDaniels ripMime 1.2.6 and earlier, as used in other programs such as xamime and inflex, allows remote attackers to exec (no CVSS)
- [CVE-2002-0199](https://cve.now/CVE-2002-0199.md): Buffer overflow in admin.cgi for Nullsoft Shoutcast Server 1.8.3 allows remote attackers to cause a denial of service and possibly execute a (no CVSS)
- [CVE-2002-0200](https://cve.now/CVE-2002-0200.md): Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name. (no CVSS)
- [CVE-2002-0201](https://cve.now/CVE-2002-0201.md): Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (no CVSS)
- [CVE-2002-0202](https://cve.now/CVE-2002-0202.md): PaintBBS 1.2 installs certain files and directories with insecure permissions, which allows local users to (1) obtain the encrypted server p (no CVSS)
- [CVE-2002-0203](https://cve.now/CVE-2002-0203.md): ttawebtop.cgi in Tarantella Enterprise 3.20 on SPARC Solaris and Linux, and 3.1x and 3.0x including 3.11.903, allows remote attackers to vie (no CVSS)
- [CVE-2002-0204](https://cve.now/CVE-2002-0204.md): Buffer overflow in GNU Chess (gnuchess) 5.02 and earlier, if modified or used in a networked capacity contrary to its own design as a single (no CVSS)
- [CVE-2002-0205](https://cve.now/CVE-2002-0205.md): Cross-site scripting (CSS) vulnerability in error.asp for Plumtree Corporate Portal 3.5 through 4.5 allows remote attackers to execute arbit (no CVSS)
- [CVE-2002-0206](https://cve.now/CVE-2002-0206.md): index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2002-0208](https://cve.now/CVE-2002-0208.md): PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows remot (no CVSS)
- [CVE-2002-0210](https://cve.now/CVE-2002-0210.md): setlicense for TOLIS Group Backup and Restore Utility (BRU) 17.0 allows local users to overwrite arbitrary files via a symlink attack on the (no CVSS)
- [CVE-2002-0212](https://cve.now/CVE-2002-0212.md): The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows r (no CVSS)
- [CVE-2002-0214](https://cve.now/CVE-2002-0214.md): Compaq Intel PRO/Wireless 2011B LAN USB Device Driver 1.5.16.0 through 1.5.18.0 stores the 128-bit WEP (Wired Equivalent Privacy) key in pla (no CVSS)
- [CVE-2002-0215](https://cve.now/CVE-2002-0215.md): Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the full pathname of the agora.cgi file by requesting a (no CVSS)
- [CVE-2002-0216](https://cve.now/CVE-2002-0216.md): userinfo.php in XOOPS 1.0 RC1 allows remote attackers to obtain sensitive information via a SQL injection attack in the "uid" parameter. (no CVSS)
- [CVE-2002-0217](https://cve.now/CVE-2002-0217.md): Cross-site scripting (CSS) vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on o (no CVSS)
- [CVE-2002-0218](https://cve.now/CVE-2002-0218.md): Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local (no CVSS)
- [CVE-2002-0219](https://cve.now/CVE-2002-0219.md): Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to exe (no CVSS)
- [CVE-2002-0220](https://cve.now/CVE-2002-0220.md): phpsmssend.php in PhpSmsSend 1.0 allows remote attackers to execute arbitrary commands via an SMS message containing shell metacharacters. (no CVSS)
- [CVE-2002-0221](https://cve.now/CVE-2002-0221.md): Etype Eserv 2.97 allows remote attackers to cause a denial of service (resource exhaustion) via a large number of PASV commands that consume (no CVSS)
- [CVE-2002-0222](https://cve.now/CVE-2002-0222.md): Etype Eserv 2.97 allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command. (no CVSS)
- [CVE-2002-0223](https://cve.now/CVE-2002-0223.md): Infopop UBB.Threads 5.4 and Wired Community Software WWWThreads 5.0 through 5.0.9 allows remote attackers to upload arbitrary files by using (no CVSS)
- [CVE-2002-0224](https://cve.now/CVE-2002-0224.md): The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through S (no CVSS)
- [CVE-2002-0225](https://cve.now/CVE-2002-0225.md): tac\_plus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and wr (no CVSS)
- [CVE-2002-0227](https://cve.now/CVE-2002-0227.md): KICQ 2.0.0b1 allows remote attackers to cause a denial of service (crash) via a malformed message. (no CVSS)
- [CVE-2002-0228](https://cve.now/CVE-2002-0228.md): Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as (no CVSS)
- [CVE-2002-0229](https://cve.now/CVE-2002-0229.md): Safe Mode feature (safe\_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restric (no CVSS)
- [CVE-2002-0230](https://cve.now/CVE-2002-0230.md): Cross-site scripting vulnerability in fom.cgi of Faq-O-Matic 2.712 allows remote attackers to execute arbitrary Javascript on other clients (no CVSS)
- [CVE-2002-0231](https://cve.now/CVE-2002-0231.md): Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname. (no CVSS)
- [CVE-2002-0232](https://cve.now/CVE-2002-0232.md): Directory traversal vulnerability in Multi Router Traffic Grapher (MRTG) allows remote attackers to read portions of arbitrary files via a . (no CVSS)
- [CVE-2002-0233](https://cve.now/CVE-2002-0233.md): Directory traversal vulnerability in eshare Expressions 4 Web server allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-0234](https://cve.now/CVE-2002-0234.md): NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trust (no CVSS)
- [CVE-2002-0235](https://cve.now/CVE-2002-0235.md): Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username (no CVSS)
- [CVE-2002-0236](https://cve.now/CVE-2002-0236.md): Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentica (no CVSS)
- [CVE-2002-0238](https://cve.now/CVE-2002-0238.md): Cross-site scripting vulnerability in web administration interface for NetGear RT314 and RT311 Gateway Routers allows remote attackers to ex (no CVSS)
- [CVE-2002-0239](https://cve.now/CVE-2002-0239.md): Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3) (no CVSS)
- [CVE-2002-0240](https://cve.now/CVE-2002-0240.md): PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pat (no CVSS)
- [CVE-2002-0242](https://cve.now/CVE-2002-0242.md): Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML F (no CVSS)
- [CVE-2002-0243](https://cve.now/CVE-2002-0243.md): Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, w (no CVSS)
- [CVE-2002-0244](https://cve.now/CVE-2002-0244.md): Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (no CVSS)
- [CVE-2002-0245](https://cve.now/CVE-2002-0245.md): Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a (no CVSS)
- [CVE-2002-0247](https://cve.now/CVE-2002-0247.md): Buffer overflows in wmtv 0.6.5 and earlier may allow local users to gain privileges. (no CVSS)
- [CVE-2002-0248](https://cve.now/CVE-2002-0248.md): wmtv 0.6.5 and earlier allows local users to modify arbitrary files via a symlink attack on a configuration file. (no CVSS)
- [CVE-2002-0249](https://cve.now/CVE-2002-0249.md): PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the (no CVSS)
- [CVE-2002-0252](https://cve.now/CVE-2002-0252.md): Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long (no CVSS)
- [CVE-2002-0253](https://cve.now/CVE-2002-0253.md): PHP, when not configured with the "display\_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an incl (no CVSS)
- [CVE-2002-0254](https://cve.now/CVE-2002-0254.md): ICQ 2001b Build 3659 allows remote attackers to cause a denial of service (crash) via a malformed picture that contains large height and wid (no CVSS)
- [CVE-2002-0255](https://cve.now/CVE-2002-0255.md): The default configuration of Arescom NetDSL 800 does not require authentication, which allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2002-0256](https://cve.now/CVE-2002-0256.md): The telnet port in Arescom NetDSL 1000 router allows remote attackers to cause a denial of service via a series of connections with long str (no CVSS)
- [CVE-2002-0257](https://cve.now/CVE-2002-0257.md): Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other use (no CVSS)
- [CVE-2002-0258](https://cve.now/CVE-2002-0258.md): Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote att (no CVSS)
- [CVE-2002-0259](https://cve.now/CVE-2002-0259.md): InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache (no CVSS)
- [CVE-2002-0260](https://cve.now/CVE-2002-0260.md): Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, whic (no CVSS)
- [CVE-2002-0261](https://cve.now/CVE-2002-0261.md): Directory traversal vulnerability in InstantServers MiniPortal 1.1.5 and earlier allows remote authenticated users to read arbitrary files v (no CVSS)
- [CVE-2002-0262](https://cve.now/CVE-2002-0262.md): Directory traversal vulnerability in netget for Sybex E-Trainer web server allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-0263](https://cve.now/CVE-2002-0263.md): Buffer overflow in EasyBoard 2000 1.27 (aka EZboard) allows remote attackers to execute arbitrary code via a long boundary value in a multip (no CVSS)
- [CVE-2002-0264](https://cve.now/CVE-2002-0264.md): PowerFTP Personal FTP Server 2.03 through 2.10 stores sensitive account information in plaintext in the ftpserver.ini file, which allows att (no CVSS)
- [CVE-2002-0266](https://cve.now/CVE-2002-0266.md): Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which ge (no CVSS)
- [CVE-2002-0268](https://cve.now/CVE-2002-0268.md): Identix BioLogon 3 allows users with physical access to the system to gain administrative privileges by using CTRL-ALT-DEL and running a "Br (no CVSS)
- [CVE-2002-0269](https://cve.now/CVE-2002-0269.md): Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote (no CVSS)
- [CVE-2002-0270](https://cve.now/CVE-2002-0270.md): Opera, when configured with the "Determine action by MIME type" option disabled, interprets an object as an HTML document even when its MIME (no CVSS)
- [CVE-2002-0271](https://cve.now/CVE-2002-0271.md): Runtime library in GNU Ada compiler (GNAT) 3.12p through 3.14p allows local users to modify files of other users via a symlink attack on tem (no CVSS)
- [CVE-2002-0272](https://cve.now/CVE-2002-0272.md): Buffer overflows in mpg321 before 0.2.9 allows local and possibly remote attackers to execute arbitrary code via a long URL to (1) a command (no CVSS)
- [CVE-2002-0273](https://cve.now/CVE-2002-0273.md): Buffer overflow in CWMail.exe in NetWin before 2.8a allows remote authenticated users to execute arbitrary code via a long item parameter. (no CVSS)
- [CVE-2002-0277](https://cve.now/CVE-2002-0277.md): Add2it Mailman Free 1.73 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the list parameter. (no CVSS)
- [CVE-2002-0278](https://cve.now/CVE-2002-0278.md): Directory traversal vulnerability in Add2it Mailman Free 1.73 and earlier allows remote attackers to modify arbitrary files via a .. (no CVSS)
- [CVE-2002-0279](https://cve.now/CVE-2002-0279.md): The kernel in HP-UX 11.11 does not properly provide arguments for setrlimit, which could allow local attackers to cause a denial of service (no CVSS)
- [CVE-2002-0280](https://cve.now/CVE-2002-0280.md): Buffer overflow in CodeBlue 4 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via a long string (no CVSS)
- [CVE-2002-0281](https://cve.now/CVE-2002-0281.md): Cross-site scripting vulnerability in DCP-Portal 4.2 and earlier allows remote attackers to gain privileges of other portal users by providi (no CVSS)
- [CVE-2002-0282](https://cve.now/CVE-2002-0282.md): DCP-Portal 3.7 through 4.5 allows remote attackers to obtain the physical path of the server via (1) a direct request to add\_user.php, or vi (no CVSS)
- [CVE-2002-0283](https://cve.now/CVE-2002-0283.md): Windows XP with port 445 open allows remote attackers to cause a denial of service (CPU consumption) via a flood of TCP SYN packets containi (no CVSS)
- [CVE-2002-0284](https://cve.now/CVE-2002-0284.md): Winamp 2.78 and 2.77, when opening a wma file that requires a license, sends the full path of the Temporary Internet Files directory to the (no CVSS)
- [CVE-2002-0285](https://cve.now/CVE-2002-0285.md): Outlook Express 5.5 and 6.0 on Windows treats a carriage return ("CR") in a message header as if it were a valid carriage return/line feed c (no CVSS)
- [CVE-2002-0286](https://cve.now/CVE-2002-0286.md): The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a n (no CVSS)
- [CVE-2002-0288](https://cve.now/CVE-2002-0288.md): Directory traversal vulnerability in Phusion web server 1.0 allows remote attackers to read arbitrary files via a ... (no CVSS)
- [CVE-2002-0289](https://cve.now/CVE-2002-0289.md): Buffer overflow in Phusion web server 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long HTTP re (no CVSS)
- [CVE-2002-0291](https://cve.now/CVE-2002-0291.md): Dino's Webserver 1.2 allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via several (no CVSS)
- [CVE-2002-0293](https://cve.now/CVE-2002-0293.md): FTP service in Alcatel OmniPCX 4400 allows the "halt" user to gain root privileges by modifying root's .profile file. (no CVSS)
- [CVE-2002-0294](https://cve.now/CVE-2002-0294.md): Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system. (no CVSS)
- [CVE-2002-0295](https://cve.now/CVE-2002-0295.md): Alcatel OmniPCX 4400 installs files with world-writable permissions, which allows local users to reconfigure the system and possibly gain pr (no CVSS)
- [CVE-2002-0296](https://cve.now/CVE-2002-0296.md): The installation of Tarantella Enterprise 3 allows local users to overwrite arbitrary files via a symlink attack on the "spinning" temporary (no CVSS)
- [CVE-2002-0297](https://cve.now/CVE-2002-0297.md): Buffer overflow in ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrar (no CVSS)
- [CVE-2002-0298](https://cve.now/CVE-2002-0298.md): ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) via certain HTTP GET requests containing (1) a % (no CVSS)
- [CVE-2002-0301](https://cve.now/CVE-2002-0301.md): Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with inval (no CVSS)
- [CVE-2002-0303](https://cve.now/CVE-2002-0303.md): GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of o (no CVSS)
- [CVE-2002-0304](https://cve.now/CVE-2002-0304.md): Lil HTTP Server 2.1 allows remote attackers to read password-protected files via a /./ in the HTTP request. (no CVSS)
- [CVE-2002-0305](https://cve.now/CVE-2002-0305.md): Zero One Tech (ZOT) P100s print server does not properly disable the SNMP service or change the default password, which could leave the serv (no CVSS)
- [CVE-2002-0306](https://cve.now/CVE-2002-0306.md): ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (no CVSS)
- [CVE-2002-0307](https://cve.now/CVE-2002-0307.md): Directory traversal vulnerability in ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to determine the existen (no CVSS)
- [CVE-2002-0308](https://cve.now/CVE-2002-0308.md): admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and (no CVSS)
- [CVE-2002-0310](https://cve.now/CVE-2002-0310.md): Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, whic (no CVSS)
- [CVE-2002-0311](https://cve.now/CVE-2002-0311.md): Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell m (no CVSS)
- [CVE-2002-0312](https://cve.now/CVE-2002-0312.md): Directory traversal vulnerability in Essentia Web Server 2.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-0314](https://cve.now/CVE-2002-0314.md): fasttrack p2p, as used in (1) KaZaA before 1.5, (2) grokster, and (3) morpheus allows remote attackers to cause a denial of service (memory (no CVSS)
- [CVE-2002-0315](https://cve.now/CVE-2002-0315.md): fasttrack p2p, as used in (1) KaZaA, (2) grokster, and (3) morpheus allows remote attackers to spoof other users by modifying the username a (no CVSS)
- [CVE-2002-0316](https://cve.now/CVE-2002-0316.md): Cross-site scripting vulnerability in eXtreme message board (XMB) 1.6x and earlier allows remote attackers to execute script as other XMB us (no CVSS)
- [CVE-2002-0317](https://cve.now/CVE-2002-0317.md): Gator ActiveX component (IEGator.dll) 3.0.6.1 allows remote web sites to install arbitrary software by specifying a Trojan Gator installatio (no CVSS)
- [CVE-2002-0319](https://cve.now/CVE-2002-0319.md): Cross-site scripting vulnerability in edituser.php for pforum 1.14 and earlier allows remote attackers to execute script and steal cookies f (no CVSS)
- [CVE-2002-0320](https://cve.now/CVE-2002-0320.md): Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (no CVSS)
- [CVE-2002-0321](https://cve.now/CVE-2002-0321.md): Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engine (no CVSS)
- [CVE-2002-0322](https://cve.now/CVE-2002-0322.md): Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing. (no CVSS)
- [CVE-2002-0323](https://cve.now/CVE-2002-0323.md): comment2.jse in ScriptEase:WebServer allows remote attackers to read arbitrary files by specifying the target file as an argument in the URL (no CVSS)
- [CVE-2002-0324](https://cve.now/CVE-2002-0324.md): Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrati (no CVSS)
- [CVE-2002-0325](https://cve.now/CVE-2002-0325.md): Directory traversal vulnerability in BadBlue before 1.6.1 allows remote attackers to read arbitrary files via a ... (no CVSS)
- [CVE-2002-0326](https://cve.now/CVE-2002-0326.md): Cross-site scripting vulnerability in BadBlue before 1.6.1 beta allows remote attackers to execute arbitrary script and possibly additional (no CVSS)
- [CVE-2002-0327](https://cve.now/CVE-2002-0327.md): Buffer overflow in Century Software TERM allows local users to gain root privileges via a long tty argument to the callin program. (no CVSS)
- [CVE-2002-0328](https://cve.now/CVE-2002-0328.md): Cross-site scripting vulnerability in Ikonboard 3.0.1 allows remote attackers to execute arbitrary script as other Ikonboard users and steal (no CVSS)
- [CVE-2002-0331](https://cve.now/CVE-2002-0331.md): Directory traversal vulnerability in the HTTP server for BPM Studio Pro 4.2 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-0332](https://cve.now/CVE-2002-0332.md): Buffer overflows in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to execute arbitrary code via (1) a long (no CVSS)
- [CVE-2002-0333](https://cve.now/CVE-2002-0333.md): Directory traversal vulnerability in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to read files with short (no CVSS)
- [CVE-2002-0334](https://cve.now/CVE-2002-0334.md): xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file. (no CVSS)
- [CVE-2002-0335](https://cve.now/CVE-2002-0335.md): Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly exe (no CVSS)
- [CVE-2002-0336](https://cve.now/CVE-2002-0336.md): Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly exe (no CVSS)
- [CVE-2002-0337](https://cve.now/CVE-2002-0337.md): RealPlayer 8 allows remote attackers to cause a denial of service (CPU utilization) via malformed .mp3 files. (no CVSS)
- [CVE-2002-0338](https://cve.now/CVE-2002-0338.md): The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service (crash) via an attachment who (no CVSS)
- [CVE-2002-0340](https://cve.now/CVE-2002-0340.md): Windows Media Player (WMP) 8.00.00.4477, and possibly other versions, automatically detects and executes .wmf and other content, even when t (no CVSS)
- [CVE-2002-0341](https://cve.now/CVE-2002-0341.md): GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server (no CVSS)
- [CVE-2002-0342](https://cve.now/CVE-2002-0342.md): Kmail 1.2 on KDE 2.1.1 allows remote attackers to cause a denial of service (crash) via an email message whose body is approximately 55 K lo (no CVSS)
- [CVE-2002-0343](https://cve.now/CVE-2002-0343.md): Hotline Client 1.8.5 stores sensitive user information, including passwords, in plaintext in the bookmarks file, which could allow local use (no CVSS)
- [CVE-2002-0344](https://cve.now/CVE-2002-0344.md): Symantec LiveUpdate 1.5 and earlier in Norton Antivirus stores usernames and passwords for a local LiveUpdate server in cleartext in the reg (no CVSS)
- [CVE-2002-0345](https://cve.now/CVE-2002-0345.md): Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\\params registry key, which could allow an attacker to gain pr (no CVSS)
- [CVE-2002-0346](https://cve.now/CVE-2002-0346.md): Cross-site scripting vulnerability in Cobalt RAQ 4 allows remote attackers to execute arbitrary script as other Cobalt users via Javascript (no CVSS)
- [CVE-2002-0347](https://cve.now/CVE-2002-0347.md): Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the w (no CVSS)
- [CVE-2002-0348](https://cve.now/CVE-2002-0348.md): service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long service ar (no CVSS)
- [CVE-2002-0349](https://cve.now/CVE-2002-0349.md): Tiny Personal Firewall (TPF) 2.0.15, under certain configurations, will pop up an alert to the system even when the screen is locked, which (no CVSS)
- [CVE-2002-0350](https://cve.now/CVE-2002-0350.md): HP Procurve Switch 4000M running firmware C.08.22 and C.09.09 allows remote attackers to cause a denial of service via a port scan of the ma (no CVSS)
- [CVE-2002-0351](https://cve.now/CVE-2002-0351.md): Buffer overflows in CFS daemon (cfsd) before 1.3.3-8.1, and 1.4x before 1.4.1-5, allow remote attackers to cause a denial of service and pos (no CVSS)
- [CVE-2002-0352](https://cve.now/CVE-2002-0352.md): Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php (no CVSS)
- [CVE-2002-0353](https://cve.now/CVE-2002-0353.md): The ASN.1 parser in Ethereal 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a certain malformed packet, (no CVSS)
- [CVE-2002-0354](https://cve.now/CVE-2002-0354.md): The XMLHttpRequest object (XMLHTTP) in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories o (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2002-05-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.