# CVEs published 2003-04-02

350 CVEs were published on April 2, 2003: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-1999-1337](https://cve.now/CVE-1999-1337.md): FTP client in Midnight Commander (mc) before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable hist (no CVSS)
- [CVE-1999-1468](https://cve.now/CVE-1999-1468.md): rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Interna (no CVSS)
- [CVE-1999-1490](https://cve.now/CVE-1999-1490.md): xosview 1.5.1 in Red Hat 5.1 allows local users to gain root access via a long HOME environmental variable. (no CVSS)
- [CVE-2000-0502](https://cve.now/CVE-2000-0502.md): Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows l (no CVSS)
- [CVE-2000-0590](https://cve.now/CVE-2000-0590.md): Poll It 2.0 CGI script allows remote attackers to read arbitrary files by specifying the file name in the data\_dir parameter. (no CVSS)
- [CVE-2000-1210](https://cve.now/CVE-2000-1210.md): Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2000-1211](https://cve.now/CVE-2000-1211.md): Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects (no CVSS, zope)
- [CVE-2000-1212](https://cve.now/CVE-2000-1212.md): Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editin (no CVSS, zope)
- [CVE-2001-0724](https://cve.now/CVE-2001-0724.md): Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which ca (no CVSS)
- [CVE-2001-0748](https://cve.now/CVE-2001-0748.md): Acme.Serve 1.7, as used in Cisco Secure ACS Unix and possibly other products, allows remote attackers to read arbitrary files by prepending (no CVSS)
- [CVE-2001-0763](https://cve.now/CVE-2001-0763.md): Buffer overflow in Linux xinetd 2.1.8.9pre11-1 and earlier may allow remote attackers to execute arbitrary code via a long ident response, w (no CVSS)
- [CVE-2001-0873](https://cve.now/CVE-2001-0873.md): uuxqt in Taylor UUCP package does not properly remove dangerous long options, which allows local users to gain privileges by calling uux and (no CVSS)
- [CVE-2001-0891](https://cve.now/CVE-2001-0891.md): Format string vulnerability in NQS daemon (nqsdaemon) in NQE 3.3.0.16 for CRAY UNICOS and SGI IRIX allows a local user to gain root privileg (no CVSS)
- [CVE-2001-0921](https://cve.now/CVE-2001-0921.md): Netscape 4.79 and earlier for MacOS allows an attacker with access to the browser to obtain passwords from form fields by printing the docum (no CVSS)
- [CVE-2001-0959](https://cve.now/CVE-2001-0959.md): Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$, which allows remote attackers to (no CVSS)
- [CVE-2001-0960](https://cve.now/CVE-2001-0960.md): Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 stores the backup agent user name and password in cleartext in the aremo (no CVSS)
- [CVE-2001-0978](https://cve.now/CVE-2001-0978.md): login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brute force password gue (no CVSS)
- [CVE-2001-1008](https://cve.now/CVE-2001-1008.md): Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauth (no CVSS)
- [CVE-2001-1028](https://cve.now/CVE-2001-1028.md): Buffer overflow in ultimate\_source function of man 1.5 and earlier allows local users to gain privileges. (no CVSS)
- [CVE-2001-1036](https://cve.now/CVE-2001-1036.md): GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) (no CVSS)
- [CVE-2001-1059](https://cve.now/CVE-2001-1059.md): VMWare creates a temporary file vmware-log.USERNAME with insecure permissions, which allows local users to read or modify license informatio (no CVSS)
- [CVE-2001-1106](https://cve.now/CVE-2001-1106.md): The default configuration of Sambar Server 5 and earlier uses a symmetric key that is compiled into the binary program for encrypting passwo (no CVSS)
- [CVE-2001-1145](https://cve.now/CVE-2001-1145.md): fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different d (no CVSS)
- [CVE-2001-1251](https://cve.now/CVE-2001-1251.md): SmallHTTP 1.204 through 3.00 beta 8 allows remote attackers to cause a denial of service via multiple long URL requests. (no CVSS)
- [CVE-2001-1291](https://cve.now/CVE-2001-1291.md): The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect userna (no CVSS)
- [CVE-2001-1296](https://cve.now/CVE-2001-1296.md): More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the include (no CVSS)
- [CVE-2001-1301](https://cve.now/CVE-2001-1301.md): rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other packages, allows local users to modify fil (no CVSS)
- [CVE-2001-1303](https://cve.now/CVE-2001-1303.md): The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for (no CVSS)
- [CVE-2001-1327](https://cve.now/CVE-2001-1327.md): pmake before 2.1.35 in Turbolinux 6.05 and earlier is installed with setuid root privileges, which could allow local users to gain privilege (no CVSS)
- [CVE-2001-1334](https://cve.now/CVE-2001-1334.md): Block\_render\_url.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating (no CVSS)
- [CVE-2001-1349](https://cve.now/CVE-2001-1349.md): Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and possibly corrupt the heap and g (no CVSS)
- [CVE-2001-1359](https://cve.now/CVE-2001-1359.md): Volution clients 1.0.7 and earlier attempt to contact the computer creation daemon (CCD) when an LDAP authentication failure occurs, which a (no CVSS)
- [CVE-2001-1369](https://cve.now/CVE-2001-1369.md): Leon J Breedt pam-pgsql before 0.5.2 allows remote attackers to execute arbitrary SQL code and bypass authentication or modify user account (no CVSS)
- [CVE-2001-1370](https://cve.now/CVE-2001-1370.md): prepend.php3 in PHPLib before 7.2d, when register\_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HT (no CVSS)
- [CVE-2001-1371](https://cve.now/CVE-2001-1371.md): The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by defaul (no CVSS)
- [CVE-2001-1372](https://cve.now/CVE-2001-1372.md): Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a n (no CVSS)
- [CVE-2001-1373](https://cve.now/CVE-2001-1373.md): MailSafe in Zone Labs ZoneAlarm 2.6 and earlier and ZoneAlarm Pro 2.6 and 2.4 does not block prohibited file types with long file names, whi (no CVSS)
- [CVE-2001-1374](https://cve.now/CVE-2001-1374.md): expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges vi (no CVSS)
- [CVE-2001-1375](https://cve.now/CVE-2001-1375.md): tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local u (no CVSS)
- [CVE-2001-1378](https://cve.now/CVE-2001-1378.md): fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files. (no CVSS)
- [CVE-2001-1380](https://cve.now/CVE-2001-1380.md): OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized\_keys2 file, may not properly handle (no CVSS)
- [CVE-2001-1382](https://cve.now/CVE-2001-1382.md): The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carri (no CVSS)
- [CVE-2001-1383](https://cve.now/CVE-2001-1383.md): initscript in setserial 2.17-4 and earlier uses predictable temporary file names, which could allow local users to conduct unauthorized oper (no CVSS)
- [CVE-2001-1385](https://cve.now/CVE-2001-1385.md): The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for othe (no CVSS)
- [CVE-2001-1406](https://cve.now/CVE-2001-1406.md): process\_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug (no CVSS)
- [CVE-2001-1407](https://cve.now/CVE-2001-1407.md): Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds (no CVSS)
- [CVE-2002-0006](https://cve.now/CVE-2002-0006.md): XChat 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allows remote attackers to execute arbitrary IRC commands as o (no CVSS)
- [CVE-2002-0009](https://cve.now/CVE-2002-0009.md): show\_bug.cgi in Bugzilla before 2.14.1 allows a user with "Bugs Access" privileges to see other products that are not accessible to the user (no CVSS)
- [CVE-2002-0011](https://cve.now/CVE-2002-0011.md): Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login. (no CVSS)
- [CVE-2002-0014](https://cve.now/CVE-2002-0014.md): URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and con (no CVSS)
- [CVE-2002-0017](https://cve.now/CVE-2002-0017.md): Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request (no CVSS)
- [CVE-2002-0024](https://cve.now/CVE-2002-0024.md): File Download box in Internet Explorer 5.01, 5.5 and 6.0 allows an attacker to use the Content-Disposition and Content-Type HTML header fiel (no CVSS)
- [CVE-2002-0032](https://cve.now/CVE-2002-0032.md): Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ym (no CVSS)
- [CVE-2002-0033](https://cve.now/CVE-2002-0033.md): Heap-based buffer overflow in cfsd\_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with (no CVSS)
- [CVE-2002-0042](https://cve.now/CVE-2002-0042.md): Vulnerability in the XFS file system for SGI IRIX before 6.5.12 allows local users to cause a denial of service (hang) by creating a file th (no CVSS)
- [CVE-2002-0054](https://cve.now/CVE-2002-0054.md): SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses t (no CVSS)
- [CVE-2002-0061](https://cve.now/CVE-2002-0061.md): Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (no CVSS)
- [CVE-2002-0062](https://cve.now/CVE-2002-0062.md): Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, rela (no CVSS)
- [CVE-2002-0067](https://cve.now/CVE-2002-0067.md): Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcp\_port 0" is specified in squid.conf, which could allow remote a (no CVSS)
- [CVE-2002-0068](https://cve.now/CVE-2002-0068.md): Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code with an f (no CVSS)
- [CVE-2002-0069](https://cve.now/CVE-2002-0069.md): Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2002-0071](https://cve.now/CVE-2002-0071.md): Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attacke (no CVSS)
- [CVE-2002-0072](https://cve.now/CVE-2002-0072.md): The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not prop (no CVSS)
- [CVE-2002-0073](https://cve.now/CVE-2002-0073.md): The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial (no CVSS)
- [CVE-2002-0074](https://cve.now/CVE-2002-0074.md): Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attacke (no CVSS)
- [CVE-2002-0075](https://cve.now/CVE-2002-0075.md): Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary scrip (no CVSS)
- [CVE-2002-0076](https://cve.now/CVE-2002-0076.md): Java Runtime Environment (JRE) Bytecode Verifier allows remote attackers to escape the Java sandbox and execute commands via an applet conta (no CVSS)
- [CVE-2002-0079](https://cve.now/CVE-2002-0079.md): Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attac (no CVSS)
- [CVE-2002-0094](https://cve.now/CVE-2002-0094.md): config\_converters.py in BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2002-0095](https://cve.now/CVE-2002-0095.md): The default configuration of BSCW (Basic Support for Cooperative Work) 3.x and possibly version 4 enables user self registration, which coul (no CVSS)
- [CVE-2002-0120](https://cve.now/CVE-2002-0120.md): Apple Palm Desktop 4.0b76 and 4.0b77 creates world-readable backup files and folders when a hotsync is performed, which could allow a local (no CVSS)
- [CVE-2002-0123](https://cve.now/CVE-2002-0123.md): MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier, and possibly 3.5.3, allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2002-0146](https://cve.now/CVE-2002-0146.md): fetchmail email client before 5.9.10 does not properly limit the maximum number of messages available, which allows a remote IMAP server to (no CVSS)
- [CVE-2002-0147](https://cve.now/CVE-2002-0147.md): Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a (no CVSS)
- [CVE-2002-0148](https://cve.now/CVE-2002-0148.md): Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script (no CVSS)
- [CVE-2002-0149](https://cve.now/CVE-2002-0149.md): Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibl (no CVSS)
- [CVE-2002-0150](https://cve.now/CVE-2002-0150.md): Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers an (no CVSS)
- [CVE-2002-0155](https://cve.now/CVE-2002-0155.md): Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, all (no CVSS)
- [CVE-2002-0157](https://cve.now/CVE-2002-0157.md): Nautilus 1.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the .nautilus-metafile.xml metadata file. (no CVSS)
- [CVE-2002-0163](https://cve.now/CVE-2002-0163.md): Heap-based buffer overflow in Squid before 2.4 STABLE4, and Squid 2.5 and 2.6 until March 12, 2002 distributions, allows remote attackers to (no CVSS)
- [CVE-2002-0169](https://cve.now/CVE-2002-0169.md): The default stylesheet for DocBook on Red Hat Linux 6.2 through 7.2 is installed with an insecure option enabled, which could allow users to (no CVSS)
- [CVE-2002-0170](https://cve.now/CVE-2002-0170.md): Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents (no CVSS, zope)
- [CVE-2002-0171](https://cve.now/CVE-2002-0171.md): IRISconsole 2.0 may allow users to log into the icadmin account with an incorrect password in some circumstances, which could allow users to (no CVSS)
- [CVE-2002-0172](https://cve.now/CVE-2002-0172.md): /dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions (644), which could allow a local user to cause (no CVSS)
- [CVE-2002-0173](https://cve.now/CVE-2002-0173.md): Buffer overflow in cpr for the eoe.sw.cpr SGI Checkpoint-Restart Software package on SGI IRIX 6.5.10 and earlier may allow local users to ga (no CVSS)
- [CVE-2002-0174](https://cve.now/CVE-2002-0174.md): nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump (no CVSS)
- [CVE-2002-0178](https://cve.now/CVE-2002-0178.md): uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symboli (no CVSS)
- [CVE-2002-0181](https://cve.now/CVE-2002-0181.md): Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and (no CVSS)
- [CVE-2002-0184](https://cve.now/CVE-2002-0184.md): Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privi (no CVSS)
- [CVE-2002-0185](https://cve.now/CVE-2002-0185.md): mod\_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which (no CVSS)
- [CVE-2002-0186](https://cve.now/CVE-2002-0186.md): Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data querie (no CVSS)
- [CVE-2002-0187](https://cve.now/CVE-2002-0187.md): Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via t (no CVSS)
- [CVE-2002-0190](https://cve.now/CVE-2002-0190.md): Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malf (no CVSS)
- [CVE-2002-0191](https://cve.now/CVE-2002-0191.md): Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script cont (no CVSS)
- [CVE-2002-0213](https://cve.now/CVE-2002-0213.md): xkas in Xinet K-AShare 0.011.01 for IRIX allows local users to read arbitrary files via a symlink attack on the VOLICON file, which is copie (no CVSS)
- [CVE-2002-0241](https://cve.now/CVE-2002-0241.md): NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Di (no CVSS)
- [CVE-2002-0246](https://cve.now/CVE-2002-0246.md): Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying th (no CVSS)
- [CVE-2002-0250](https://cve.now/CVE-2002-0250.md): Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users (no CVSS)
- [CVE-2002-0267](https://cve.now/CVE-2002-0267.md): preferences.php in Simple Internet Publishing System (SIPS) before 0.3.1 allows remote attackers to gain administrative privileges via a lin (no CVSS)
- [CVE-2002-0274](https://cve.now/CVE-2002-0274.md): Exim 3.34 and earlier may allow local users to gain privileges via a buffer overflow in long -C (configuration file) and other command line (no CVSS)
- [CVE-2002-0276](https://cve.now/CVE-2002-0276.md): Buffer overflow in various decoders in Ettercap 0.6.3.1 and earlier, when running on networks with an MTU greater than 2000, allows remote a (no CVSS)
- [CVE-2002-0287](https://cve.now/CVE-2002-0287.md): pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain adminis (no CVSS)
- [CVE-2002-0290](https://cve.now/CVE-2002-0290.md): Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument. (no CVSS)
- [CVE-2002-0292](https://cve.now/CVE-2002-0292.md): Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and a (no CVSS)
- [CVE-2002-0299](https://cve.now/CVE-2002-0299.md): CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such a (no CVSS)
- [CVE-2002-0300](https://cve.now/CVE-2002-0300.md): gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by d (no CVSS)
- [CVE-2002-0302](https://cve.now/CVE-2002-0302.md): The Notify daemon for Symantec Enterprise Firewall (SEF) 6.5.x drops large alerts when SNMP is used as the transport, which could prevent so (no CVSS)
- [CVE-2002-0309](https://cve.now/CVE-2002-0309.md): SMTP proxy in Symantec Enterprise Firewall (SEF) 6.5.x includes the firewall's physical interface name and address in an SMTP protocol excha (no CVSS)
- [CVE-2002-0318](https://cve.now/CVE-2002-0318.md): FreeRADIUS RADIUS server allows remote attackers to cause a denial of service (CPU consumption) via a flood of Access-Request packets. (no CVSS)
- [CVE-2002-0329](https://cve.now/CVE-2002-0329.md): Cross-site scripting vulnerability in Snitz Forums 2000 3.3.03 and earlier allows remote attackers to execute arbitrary script as other Foru (no CVSS)
- [CVE-2002-0330](https://cve.now/CVE-2002-0330.md): Cross-site scripting vulnerability in codeparse.php of Open Bulletin Board (OpenBB) 1.0.0 allows remote attackers to execute arbitrary scrip (no CVSS)
- [CVE-2002-0339](https://cve.now/CVE-2002-0339.md): Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC leve (no CVSS)
- [CVE-2002-0355](https://cve.now/CVE-2002-0355.md): netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the ap (no CVSS)
- [CVE-2002-0356](https://cve.now/CVE-2002-0356.md): Vulnerability in XFS filesystem reorganizer (fsr\_xfs) in SGI IRIX 6.5.10 and earlier allows local users to gain root privileges by overwriti (no CVSS)
- [CVE-2002-0358](https://cve.now/CVE-2002-0358.md): MediaMail and MediaMail Pro in SGI IRIX 6.5.16 and earlier allows local users to force the program to dump core via certain arguments, which (no CVSS)
- [CVE-2002-0359](https://cve.now/CVE-2002-0359.md): xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, which allows remote attackers to call dangerous RPC functions, including those t (no CVSS)
- [CVE-2002-0363](https://cve.now/CVE-2002-0363.md): ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice. (no CVSS)
- [CVE-2002-0364](https://cve.now/CVE-2002-0364.md): Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing (no CVSS)
- [CVE-2002-0366](https://cve.now/CVE-2002-0366.md): Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows lo (no CVSS)
- [CVE-2002-0367](https://cve.now/CVE-2002-0367.md): smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which al (CVSS 7.8, KEV)
- [CVE-2002-0368](https://cve.now/CVE-2002-0368.md): The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with (no CVSS)
- [CVE-2002-0369](https://cve.now/CVE-2002-0369.md): Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code (no CVSS)
- [CVE-2002-0372](https://cve.now/CVE-2002-0372.md): Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE (no CVSS)
- [CVE-2002-0373](https://cve.now/CVE-2002-0373.md): The Windows Media Device Manager (WMDM) Service in Microsoft Windows Media Player 7.1 on Windows 2000 systems allows local users to obtain L (no CVSS)
- [CVE-2002-0374](https://cve.now/CVE-2002-0374.md): Format string vulnerability in the logging function for the pam\_ldap PAM LDAP module before version 144 allows attackers to execute arbitrar (no CVSS)
- [CVE-2002-0377](https://cve.now/CVE-2002-0377.md): Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access (no CVSS)
- [CVE-2002-0379](https://cve.now/CVE-2002-0379.md): Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RF (no CVSS)
- [CVE-2002-0381](https://cve.now/CVE-2002-0381.md): The TCP implementation in various BSD operating systems (tcp\_input.c) does not properly block connections to broadcast addresses, which coul (no CVSS)
- [CVE-2002-0382](https://cve.now/CVE-2002-0382.md): XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell (no CVSS)
- [CVE-2002-0389](https://cve.now/CVE-2002-0389.md): Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to re (no CVSS)
- [CVE-2002-0391](https://cve.now/CVE-2002-0391.md): Integer overflow in xdr\_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including di (CVSS 9.8)
- [CVE-2002-0392](https://cve.now/CVE-2002-0392.md): Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrar (no CVSS)
- [CVE-2002-0394](https://cve.now/CVE-2002-0394.md): Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing a (no CVSS)
- [CVE-2002-0401](https://cve.now/CVE-2002-0401.md): SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malfo (no CVSS)
- [CVE-2002-0402](https://cve.now/CVE-2002-0402.md): Buffer overflow in X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly exe (no CVSS)
- [CVE-2002-0403](https://cve.now/CVE-2002-0403.md): DNS dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet that ca (no CVSS)
- [CVE-2002-0404](https://cve.now/CVE-2002-0404.md): Vulnerability in GIOP dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (memory consumption). (no CVSS)
- [CVE-2002-0406](https://cve.now/CVE-2002-0406.md): Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to (no CVSS)
- [CVE-2002-0412](https://cve.now/CVE-2002-0412.md): Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote attackers to execute arbitrary code by causing format s (no CVSS)
- [CVE-2002-0414](https://cve.now/CVE-2002-0414.md): KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Poli (no CVSS)
- [CVE-2002-0423](https://cve.now/CVE-2002-0423.md): Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly exec (no CVSS)
- [CVE-2002-0424](https://cve.now/CVE-2002-0424.md): efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user (typically "nobody"), which (no CVSS)
- [CVE-2002-0425](https://cve.now/CVE-2002-0425.md): mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message i (no CVSS)
- [CVE-2002-0429](https://cve.now/CVE-2002-0429.md): The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary proces (no CVSS)
- [CVE-2002-0431](https://cve.now/CVE-2002-0431.md): XTux allows remote attackers to cause a denial of service (CPU consumption) via random inputs in the initial connection. (no CVSS)
- [CVE-2002-0435](https://cve.now/CVE-2002-0435.md): Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local (no CVSS)
- [CVE-2002-0437](https://cve.now/CVE-2002-0437.md): Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) (no CVSS)
- [CVE-2002-0441](https://cve.now/CVE-2002-0441.md): Directory traversal vulnerability in imlist.php for Php Imglist allows remote attackers to read arbitrary code via a .. (no CVSS)
- [CVE-2002-0442](https://cve.now/CVE-2002-0442.md): Buffer overflow in dlvr\_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges. (no CVSS)
- [CVE-2002-0451](https://cve.now/CVE-2002-0451.md): filemanager\_forms.php in PHProjekt 3.1 and 3.1a allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in t (no CVSS)
- [CVE-2002-0454](https://cve.now/CVE-2002-0454.md): Qpopper (aka in.qpopper or popper) 4.0.3 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a very large (no CVSS)
- [CVE-2002-0462](https://cve.now/CVE-2002-0462.md): bigsam\_guestbook.php for Big Sam (Built-In Guestbook Stand-Alone Module) 1.1.08 and earlier allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2002-0463](https://cve.now/CVE-2002-0463.md): home.php in ARSC (Really Simple Chat) 1.0.1 and earlier allows remote attackers to determine the full pathname of the web server via an inva (no CVSS)
- [CVE-2002-0464](https://cve.now/CVE-2002-0464.md): Directory traversal vulnerability in Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arbitrary files and dir (no CVSS)
- [CVE-2002-0473](https://cve.now/CVE-2002-0473.md): db.php in phpBB 2.0 (aka phpBB2) RC-3 and earlier allows remote attackers to execute arbitrary code from remote servers via the phpbb\_root\_p (no CVSS)
- [CVE-2002-0484](https://cve.now/CVE-2002-0484.md): move\_uploaded\_file in PHP does not does not check for the base directory (open\_basedir), which could allow remote attackers to upload files (no CVSS)
- [CVE-2002-0488](https://cve.now/CVE-2002-0488.md): Linux Directory Penguin traceroute.pl CGI script 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the host (no CVSS)
- [CVE-2002-0490](https://cve.now/CVE-2002-0490.md): Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands v (no CVSS)
- [CVE-2002-0493](https://cve.now/CVE-2002-0493.md): Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow at (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2002-0494](https://cve.now/CVE-2002-0494.md): Cross-site scripting vulnerability in WebSight Directory System 0.1 allows remote attackers to execute arbitrary Javascript and gain access (no CVSS)
- [CVE-2002-0495](https://cve.now/CVE-2002-0495.md): csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup para (no CVSS)
- [CVE-2002-0497](https://cve.now/CVE-2002-0497.md): Buffer overflow in mtr 0.46 and earlier, when installed setuid root, allows local users to access a raw socket via a long MTR\_OPTIONS enviro (no CVSS)
- [CVE-2002-0501](https://cve.now/CVE-2002-0501.md): Format string vulnerability in log\_print() function of Posadis DNS server before version m5pre2 allows local users and possibly remote attac (no CVSS)
- [CVE-2002-0505](https://cve.now/CVE-2002-0505.md): Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote a (no CVSS)
- [CVE-2002-0506](https://cve.now/CVE-2002-0506.md): Buffer overflow in newt.c of newt windowing library (libnewt) 0.50.33 and earlier may allow attackers to cause a denial of service or execut (no CVSS)
- [CVE-2002-0511](https://cve.now/CVE-2002-0511.md): The default configuration of Name Service Cache Daemon (nscd) in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulti (no CVSS)
- [CVE-2002-0512](https://cve.now/CVE-2002-0512.md): startkde in KDE for Caldera OpenLinux 2.3 through 3.1.1 sets the LD\_LIBRARY\_PATH environment variable to include the current working directo (no CVSS)
- [CVE-2002-0513](https://cve.now/CVE-2002-0513.md): The PHP administration script in popper\_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to ga (no CVSS)
- [CVE-2002-0516](https://cve.now/CVE-2002-0516.md): SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a co (no CVSS)
- [CVE-2002-0531](https://cve.now/CVE-2002-0531.md): Directory traversal vulnerability in emumail.cgi in EMU Webmail 4.5.x and 5.1.0 allows remote attackers to read arbitrary files or list arbi (no CVSS)
- [CVE-2002-0532](https://cve.now/CVE-2002-0532.md): EMU Webmail allows local users to execute arbitrary programs via a .. (no CVSS)
- [CVE-2002-0536](https://cve.now/CVE-2002-0536.md): PHPGroupware 0.9.12 and earlier, when running with the magic\_quotes\_gpc feature disabled, allows remote attackers to compromise the database (no CVSS)
- [CVE-2002-0538](https://cve.now/CVE-2002-0538.md): FTP proxy in Symantec Raptor Firewall 6.5.3 and Enterprise 7.0 rewrites an FTP server's "FTP PORT" responses in a way that allows remote att (no CVSS)
- [CVE-2002-0539](https://cve.now/CVE-2002-0539.md): Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored i (no CVSS)
- [CVE-2002-0542](https://cve.now/CVE-2002-0542.md): mail in OpenBSD 2.9 and 3.0 processes a tilde (~) escape character in a message even when it is not in interactive mode, which could allow l (no CVSS)
- [CVE-2002-0543](https://cve.now/CVE-2002-0543.md): Directory traversal vulnerability in Aprelium Abyss Web Server (abyssws) before 1.0.0.2 allows remote attackers to read files outside the we (no CVSS)
- [CVE-2002-0545](https://cve.now/CVE-2002-0545.md): Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts (no CVSS)
- [CVE-2002-0553](https://cve.now/CVE-2002-0553.md): Cross-site scripting vulnerability in SunShop 2.5 and earlier allows remote attackers to gain administrative privileges to SunShop by inject (no CVSS)
- [CVE-2002-0567](https://cve.now/CVE-2002-0567.md): Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrar (no CVSS)
- [CVE-2002-0569](https://cve.now/CVE-2002-0569.md): Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL (no CVSS)
- [CVE-2002-0571](https://cve.now/CVE-2002-0571.md): Oracle Oracle9i database server 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax. (no CVSS)
- [CVE-2002-0573](https://cve.now/CVE-2002-0573.md): Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2002-0574](https://cve.now/CVE-2002-0574.md): Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that t (no CVSS)
- [CVE-2002-0575](https://cve.now/CVE-2002-0575.md): Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, (no CVSS)
- [CVE-2002-0576](https://cve.now/CVE-2002-0576.md): ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP r (no CVSS)
- [CVE-2002-0594](https://cve.now/CVE-2002-0594.md): Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to determine the existence of files on the client system via a LINK eleme (no CVSS)
- [CVE-2002-0597](https://cve.now/CVE-2002-0597.md): LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malfor (no CVSS)
- [CVE-2002-0598](https://cve.now/CVE-2002-0598.md): Format string vulnerability in Foundstone FScan 1.12 with banner grabbing enabled allows remote attackers to execute arbitrary code on the s (no CVSS)
- [CVE-2002-0599](https://cve.now/CVE-2002-0599.md): Blahz-DNS 0.2 and earlier allows remote attackers to bypass authentication and modify configuration by directly requesting CGI programs such (no CVSS)
- [CVE-2002-0601](https://cve.now/CVE-2002-0601.md): ISS RealSecure Network Sensor 5.x through 6.5 allows remote attackers to cause a denial of service (crash) via malformed DHCP packets that c (no CVSS)
- [CVE-2002-0605](https://cve.now/CVE-2002-0605.md): Buffer overflow in Flash OCX for Macromedia Flash 6 revision 23 (6,0,23,0) allows remote attackers to execute arbitrary code via a long movi (no CVSS)
- [CVE-2002-0613](https://cve.now/CVE-2002-0613.md): dnstools.php for DNSTools 2.0 beta 4 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user\_lo (no CVSS)
- [CVE-2002-0616](https://cve.now/CVE-2002-0616.md): The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by attaching an inline macro t (no CVSS)
- [CVE-2002-0617](https://cve.now/CVE-2002-0617.md): The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by creating a hyperlink on a d (no CVSS)
- [CVE-2002-0618](https://cve.now/CVE-2002-0618.md): The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code in the Local Computer zone by (no CVSS)
- [CVE-2002-0619](https://cve.now/CVE-2002-0619.md): The Mail Merge Tool in Microsoft Word 2002 for Windows, when Microsoft Access is present on a system, allows remote attackers to execute Vis (no CVSS)
- [CVE-2002-0621](https://cve.now/CVE-2002-0621.md): Buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000 allows remote attackers to cause (no CVSS)
- [CVE-2002-0622](https://cve.now/CVE-2002-0622.md): The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing (no CVSS)
- [CVE-2002-0623](https://cve.now/CVE-2002-0623.md): Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2002-0631](https://cve.now/CVE-2002-0631.md): Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root (no CVSS)
- [CVE-2002-0638](https://cve.now/CVE-2002-0638.md): setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a te (no CVSS)
- [CVE-2002-0639](https://cve.now/CVE-2002-0639.md): Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentica (no CVSS)
- [CVE-2002-0640](https://cve.now/CVE-2002-0640.md): Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses du (no CVSS)
- [CVE-2002-0642](https://cve.now/CVE-2002-0642.md): The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop (no CVSS)
- [CVE-2002-0647](https://cve.now/CVE-2002-0647.md): Buffer overflow in a legacy ActiveX control used to display specially formatted text in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allow (no CVSS)
- [CVE-2002-0648](https://cve.now/CVE-2002-0648.md): The legacy \<script\> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitra (no CVSS)
- [CVE-2002-0650](https://cve.now/CVE-2002-0650.md): The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a "p (no CVSS)
- [CVE-2002-0653](https://cve.now/CVE-2002-0653.md): Off-by-one buffer overflow in the ssl\_compat\_directive function, as called by the rewrite\_command hook for mod\_ssl Apache module 2.8.9 and e (no CVSS)
- [CVE-2002-0658](https://cve.now/CVE-2002-0658.md): OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attac (no CVSS)
- [CVE-2002-0663](https://cve.now/CVE-2002-0663.md): Buffer overflow in HTTP Proxy for Symantec Norton Personal Internet Firewall 3.0.4.91 and Norton Internet Security 2001 allows remote attack (no CVSS)
- [CVE-2002-0665](https://cve.now/CVE-2002-0665.md): Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL. (no CVSS)
- [CVE-2002-0671](https://cve.now/CVE-2002-0671.md): Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the inte (no CVSS)
- [CVE-2002-0676](https://cve.now/CVE-2002-0676.md): SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execut (no CVSS)
- [CVE-2002-0678](https://cve.now/CVE-2002-0678.md): CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file u (no CVSS)
- [CVE-2002-0679](https://cve.now/CVE-2002-0679.md): Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitr (no CVSS)
- [CVE-2002-0685](https://cve.now/CVE-2002-0685.md): Heap-based buffer overflow in the message decoding functionality for PGP Outlook Encryption Plug-In, as used in NAI PGP Desktop Security 7.0 (no CVSS)
- [CVE-2002-0687](https://cve.now/CVE-2002-0687.md): The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers. (no CVSS, zope)
- [CVE-2002-0688](https://cve.now/CVE-2002-0688.md): ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictio (no CVSS, zope)
- [CVE-2002-0691](https://cve.now/CVE-2002-0691.md): Microsoft Internet Explorer 5.01 and 5.5 allows remote attackers to execute scripts in the Local Computer zone via a URL that references a l (no CVSS)
- [CVE-2002-0695](https://cve.now/CVE-2002-0695.md): Buffer overflow in the Transact-SQL (T-SQL) OpenRowSet component of Microsoft Data Access Components (MDAC) 2.5 through 2.7 for SQL Server 7 (no CVSS)
- [CVE-2002-0697](https://cve.now/CVE-2002-0697.md): Microsoft Metadirectory Services (MMS) 2.2 allows remote attackers to bypass authentication and modify sensitive data by using an LDAP clien (no CVSS)
- [CVE-2002-0698](https://cve.now/CVE-2002-0698.md): Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an (no CVSS)
- [CVE-2002-0700](https://cve.now/CVE-2002-0700.md): Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers (no CVSS)
- [CVE-2002-0701](https://cve.now/CVE-2002-0701.md): ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have b (no CVSS)
- [CVE-2002-0703](https://cve.now/CVE-2002-0703.md): An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prev (no CVSS)
- [CVE-2002-0704](https://cve.now/CVE-2002-0704.md): The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error m (no CVSS)
- [CVE-2002-0710](https://cve.now/CVE-2002-0710.md): Directory traversal vulnerability in sendform.cgi 1.44 and earlier allows remote attackers to read arbitrary files by specifying the desired (no CVSS)
- [CVE-2002-0714](https://cve.now/CVE-2002-0714.md): FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows re (no CVSS)
- [CVE-2002-0716](https://cve.now/CVE-2002-0716.md): Format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 allows local users to gain privileges via format string specifiers (no CVSS)
- [CVE-2002-0718](https://cve.now/CVE-2002-0718.md): Web authoring command in Microsoft Content Management Server (MCMS) 2001 allows attackers to authenticate and upload executable content, by (no CVSS)
- [CVE-2002-0719](https://cve.now/CVE-2002-0719.md): SQL injection vulnerability in the function that services for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to exe (no CVSS)
- [CVE-2002-0720](https://cve.now/CVE-2002-0720.md): A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that c (no CVSS)
- [CVE-2002-0722](https://cve.now/CVE-2002-0722.md): Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to misrepresent the source of a file in the File Download dialogue bo (no CVSS)
- [CVE-2002-0726](https://cve.now/CVE-2002-0726.md): Buffer overflow in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2002-0727](https://cve.now/CVE-2002-0727.md): The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, whi (no CVSS)
- [CVE-2002-0733](https://cve.now/CVE-2002-0733.md): Cross-site scripting vulnerability in thttpd 2.20 and earlier allows remote attackers to execute arbitrary script via a URL to a nonexistent (no CVSS)
- [CVE-2002-0734](https://cve.now/CVE-2002-0734.md): b2edit.showposts.php in B2 2.0.6pre2 and earlier does not properly load the b2config.php file in some configurations, which allows remote at (no CVSS)
- [CVE-2002-0736](https://cve.now/CVE-2002-0736.md): Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and ac (no CVSS)
- [CVE-2002-0737](https://cve.now/CVE-2002-0737.md): Sambar web server before 5.2 beta 1 allows remote attackers to obtain source code of server-side scripts, or cause a denial of service (reso (no CVSS)
- [CVE-2002-0738](https://cve.now/CVE-2002-0738.md): MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute s (no CVSS)
- [CVE-2002-0741](https://cve.now/CVE-2002-0741.md): psyBNC 2.3 allows remote attackers to cause a denial of service (CPU consumption and resource exhaustion) by sending a PASS command with a l (no CVSS)
- [CVE-2002-0748](https://cve.now/CVE-2002-0748.md): LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request that ends in two n (no CVSS)
- [CVE-2002-0754](https://cve.now/CVE-2002-0754.md): Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which coul (no CVSS)
- [CVE-2002-0755](https://cve.now/CVE-2002-0755.md): Kerberos 5 su (k5su) in FreeBSD 4.5 and earlier does not verify that a user is a member of the wheel group before granting superuser privile (no CVSS)
- [CVE-2002-0758](https://cve.now/CVE-2002-0758.md): ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, whi (no CVSS)
- [CVE-2002-0759](https://cve.now/CVE-2002-0759.md): bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the O\_EXCL flag t (no CVSS)
- [CVE-2002-0760](https://cve.now/CVE-2002-0760.md): Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses (no CVSS)
- [CVE-2002-0761](https://cve.now/CVE-2002-0761.md): bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead (no CVSS)
- [CVE-2002-0762](https://cve.now/CVE-2002-0762.md): shadow package in SuSE 8.0 allows local users to destroy the /etc/passwd and /etc/shadow files or assign extra group privileges to some user (no CVSS)
- [CVE-2002-0765](https://cve.now/CVE-2002-0765.md): sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in wi (no CVSS)
- [CVE-2002-0766](https://cve.now/CVE-2002-0766.md): OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel (no CVSS)
- [CVE-2002-0768](https://cve.now/CVE-2002-0768.md): Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execu (no CVSS)
- [CVE-2002-0776](https://cve.now/CVE-2002-0776.md): getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifyi (no CVSS)
- [CVE-2002-0777](https://cve.now/CVE-2002-0777.md): Buffer overflow in the LDAP component of Ipswitch IMail 7.1 and earlier allows remote attackers to execute arbitrary code via a long "bind D (no CVSS)
- [CVE-2002-0778](https://cve.now/CVE-2002-0778.md): The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connection (no CVSS)
- [CVE-2002-0785](https://cve.now/CVE-2002-0785.md): AOL Instant Messenger (AIM) allows remote attackers to cause a denial of service (crash) via an "AddBuddy" link with the ScreenName paramete (no CVSS)
- [CVE-2002-0788](https://cve.now/CVE-2002-0788.md): An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext (no CVSS)
- [CVE-2002-0789](https://cve.now/CVE-2002-0789.md): Buffer overflow in search.cgi in mnoGoSearch 3.1.19 and earlier allows remote attackers to execute arbitrary code via a long query (q) param (no CVSS)
- [CVE-2002-0790](https://cve.now/CVE-2002-0790.md): clchkspuser and clpasswdremote in AIX expose an encrypted password in the cspoc.log file, which could allow local users to gain privileges. (no CVSS)
- [CVE-2002-0794](https://cve.now/CVE-2002-0794.md): The accept\_filter mechanism in FreeBSD 4 through 4.5 does not properly remove entries from the incomplete listen queue when adding a syncach (no CVSS)
- [CVE-2002-0795](https://cve.now/CVE-2002-0795.md): The rc system startup script for FreeBSD 4 through 4.5 allows local users to delete arbitrary files via a symlink attack on X Windows lock f (no CVSS)
- [CVE-2002-0801](https://cve.now/CVE-2002-0801.md): Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to th (no CVSS)
- [CVE-2002-0802](https://cve.now/CVE-2002-0802.md): The multibyte support in PostgreSQL 6.5.x with SQL\_ASCII encoding consumes an extra character when processing a character that cannot be con (no CVSS)
- [CVE-2002-0804](https://cve.now/CVE-2002-0804.md): Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP r (no CVSS)
- [CVE-2002-0805](https://cve.now/CVE-2002-0805.md): Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, (1) creates new directories with world-writable permissions, and (2) creates the param (no CVSS)
- [CVE-2002-0806](https://cve.now/CVE-2002-0806.md): Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly c (no CVSS)
- [CVE-2002-0808](https://cve.now/CVE-2002-0808.md): Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when performing a mass change, sets the groupset of all bugs to the groupset of the fi (no CVSS)
- [CVE-2002-0809](https://cve.now/CVE-2002-0809.md): Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, (no CVSS)
- [CVE-2002-0810](https://cve.now/CVE-2002-0810.md): Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could l (no CVSS)
- [CVE-2002-0813](https://cve.now/CVE-2002-0813.md): Heap-based buffer overflow in the TFTP server capability in Cisco IOS 11.1, 11.2, and 11.3 allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2002-0814](https://cve.now/CVE-2002-0814.md): Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2002-0816](https://cve.now/CVE-2002-0816.md): Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument. (no CVSS)
- [CVE-2002-0817](https://cve.now/CVE-2002-0817.md): Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument. (no CVSS)
- [CVE-2002-0818](https://cve.now/CVE-2002-0818.md): wwwoffled in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary (no CVSS)
- [CVE-2002-0823](https://cve.now/CVE-2002-0823.md): Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX cont (no CVSS)
- [CVE-2002-0824](https://cve.now/CVE-2002-0824.md): BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device. (no CVSS)
- [CVE-2002-0826](https://cve.now/CVE-2002-0826.md): Buffer overflow in WS\_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command. (no CVSS)
- [CVE-2002-0829](https://cve.now/CVE-2002-0829.md): Integer overflow in the Berkeley Fast File System (FFS) in FreeBSD 4.6.1 RELEASE-p4 and earlier allows local users to access arbitrary file (no CVSS)
- [CVE-2002-0830](https://cve.now/CVE-2002-0830.md): Network File System (NFS) in FreeBSD 4.6.1 RELEASE-p7 and earlier, NetBSD 1.5.3 and earlier, and possibly other operating systems, allows re (no CVSS)
- [CVE-2002-0831](https://cve.now/CVE-2002-0831.md): The kqueue mechanism in FreeBSD 4.3 through 4.6 STABLE allows local users to cause a denial of service (kernel panic) via a pipe call in whi (no CVSS)
- [CVE-2002-0845](https://cve.now/CVE-2002-0845.md): Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chun (no CVSS)
- [CVE-2002-0846](https://cve.now/CVE-2002-0846.md): The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more d (no CVSS)
- [CVE-2002-0847](https://cve.now/CVE-2002-0847.md): tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free (no CVSS)
- [CVE-2002-0848](https://cve.now/CVE-2002-0848.md): Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier, when using RADIUS with a challenge type of (no CVSS)
- [CVE-2002-0851](https://cve.now/CVE-2002-0851.md): Format string vulnerability in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the ISDN4Linux (i4l) package allows local users to gain (no CVSS)
- [CVE-2002-0853](https://cve.now/CVE-2002-0853.md): Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a pa (no CVSS)
- [CVE-2002-0856](https://cve.now/CVE-2002-0856.md): SQL\*NET listener for Oracle Net Oracle9i 9.0.x and 9.2 allows remote attackers to cause a denial of service (crash) via certain debug reques (no CVSS)
- [CVE-2002-0859](https://cve.now/CVE-2002-0859.md): Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2002-0860](https://cve.now/CVE-2002-0860.md): The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbi (no CVSS)
- [CVE-2002-0871](https://cve.now/CVE-2002-0871.md): xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a (no CVSS)
- [CVE-2002-0872](https://cve.now/CVE-2002-0872.md): l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions. (no CVSS)
- [CVE-2002-0873](https://cve.now/CVE-2002-0873.md): Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attribute/value pair, possibly via (no CVSS)
- [CVE-2002-0875](https://cve.now/CVE-2002-0875.md): Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to t (no CVSS)
- [CVE-2002-0887](https://cve.now/CVE-2002-0887.md): scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, (no CVSS)
- [CVE-2002-0889](https://cve.now/CVE-2002-0889.md): Buffer overflow in Qpopper (popper) 4.0.4 and earlier allows local users to cause a denial of service and possibly execute arbitrary code vi (no CVSS)
- [CVE-2002-0891](https://cve.now/CVE-2002-0891.md): The web interface (WebUI) of NetScreen ScreenOS before 2.6.1r8, and certain 2.8.x and 3.0.x versions before 3.0.3r1, allows remote attackers (no CVSS)
- [CVE-2002-0892](https://cve.now/CVE-2002-0892.md): The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct req (no CVSS)
- [CVE-2002-0897](https://cve.now/CVE-2002-0897.md): LocalWEB2000 2.1.0 web server allows remote attackers to bypass access restrictions for restricted files via a URL that contains the "/./" d (no CVSS)
- [CVE-2002-0898](https://cve.now/CVE-2002-0898.md): Opera 6.0.1 and 6.0.2 allows a remote web site to upload arbitrary files from the client system, without prompting the client, via an input (no CVSS)
- [CVE-2002-0900](https://cve.now/CVE-2002-0900.md): Buffer overflow in pks PGP public key web server before 0.9.5 allows remote attackers to cause a denial of service (crash) and possibly exec (no CVSS)
- [CVE-2002-0904](https://cve.now/CVE-2002-0904.md): SayText function in Kismet 2.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters (backtick or pip (no CVSS)
- [CVE-2002-0906](https://cve.now/CVE-2002-0906.md): Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a (no CVSS)
- [CVE-2002-0911](https://cve.now/CVE-2002-0911.md): Caldera Volution Manager 1.1 stores the Directory Administrator password in cleartext in the slapd.conf file, which could allow local users (no CVSS)
- [CVE-2002-0914](https://cve.now/CVE-2002-0914.md): Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely l (no CVSS)
- [CVE-2002-0916](https://cve.now/CVE-2002-0916.md): Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and (no CVSS)
- [CVE-2002-0935](https://cve.now/CVE-2002-0935.md): Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustio (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2002-0938](https://cve.now/CVE-2002-0938.md): Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via (no CVSS)
- [CVE-2002-0941](https://cve.now/CVE-2002-0941.md): The ConsoleCallBack class for nCipher running under JRE 1.4.0 and 1.4.0\_01, as used by the TrustedCodeTool and possibly other applications, (no CVSS)
- [CVE-2002-0945](https://cve.now/CVE-2002-0945.md): Buffer overflow in SeaNox Devwex allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (no CVSS)
- [CVE-2002-0946](https://cve.now/CVE-2002-0946.md): Directory traversal vulnerability in SeaNox Devwex before 1.2002.0601 allows remote attackers to read arbitrary files via ..\\ (dot dot) sequ (no CVSS)
- [CVE-2002-0947](https://cve.now/CVE-2002-0947.md): Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows re (no CVSS)
- [CVE-2002-0952](https://cve.now/CVE-2002-0952.md): Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service (reset) by sending (no CVSS)
- [CVE-2002-0953](https://cve.now/CVE-2002-0953.md): globals.php in PHP Address before 0.2f, with the PHP allow\_url\_fopen and register\_globals variables enabled, allows remote attackers to exec (no CVSS)
- [CVE-2002-0958](https://cve.now/CVE-2002-0958.md): Cross-site scripting vulnerability in browse.php for PHP(Reactor) 1.2.7 allows remote attackers to execute script as other users via the go (no CVSS)
- [CVE-2002-0964](https://cve.now/CVE-2002-0964.md): Half-Life Server 1.1.1.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via multiple responses to th (no CVSS)
- [CVE-2002-0965](https://cve.now/CVE-2002-0965.md): Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrar (no CVSS)
- [CVE-2002-0967](https://cve.now/CVE-2002-0967.md): Buffer overflow in eDonkey 2000 35.16.60 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbit (no CVSS)
- [CVE-2002-0968](https://cve.now/CVE-2002-0968.md): Buffer overflow in AnalogX SimpleServer:WWW 1.16 and earlier allows remote attackers to cause a denial of service (crash) and execute code v (no CVSS)
- [CVE-2002-0981](https://cve.now/CVE-2002-0981.md): Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line (no CVSS)
- [CVE-2002-0984](https://cve.now/CVE-2002-0984.md): The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2002-0987](https://cve.now/CVE-2002-0987.md): X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which cou (no CVSS)
- [CVE-2002-0988](https://cve.now/CVE-2002-0988.md): Buffer overflow in X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1, possibly related to XBM/xkbcomp capabilities. (no CVSS)
- [CVE-2002-0989](https://cve.now/CVE-2002-0989.md): The URL handler in the manual browser option for Gaim before 0.59.1 allows remote attackers to execute arbitrary script via shell metacharac (no CVSS)
- [CVE-2002-0995](https://cve.now/CVE-2002-0995.md): login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert, (no CVSS)
- [CVE-2002-1000](https://cve.now/CVE-2002-1000.md): Buffer overflow in AnalogX SimpleServer:Shout 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long (no CVSS)
- [CVE-2002-1002](https://cve.now/CVE-2002-1002.md): Buffer overflow in Novell iManager (eMFrame 1.2.1) allows remote attackers to cause a denial of service (crash) via a long user name. (no CVSS)
- [CVE-2002-1004](https://cve.now/CVE-2002-1004.md): Directory traversal vulnerability in webmail feature of ArGoSoft Mail Server Plus or Pro 1.8.1.5 and earlier allows remote attackers to read (no CVSS)
- [CVE-2002-1006](https://cve.now/CVE-2002-1006.md): Cross-site scripting (XSS) vulnerability in BBC Education Text to Speech Internet Enhancer (Betsie) 1.5.11 and earlier allows remote attacke (no CVSS)
- [CVE-2002-1013](https://cve.now/CVE-2002-1013.md): Buffer overflow in traffic\_manager for Inktomi Traffic Server 4.0.18 through 5.2.2, Traffic Edge 1.1.2 and 1.5.0, and Media-IXT 3.0.4 allows (no CVSS)
- [CVE-2002-1014](https://cve.now/CVE-2002-1014.md): Buffer overflow in RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2002-1015](https://cve.now/CVE-2002-1015.md): RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary script in the Local (no CVSS)
- [CVE-2002-1024](https://cve.now/CVE-2002-1024.md): Cisco IOS 12.0 through 12.2, when supporting SSH, allows remote attackers to cause a denial of service (CPU consumption) via a large packet (no CVSS)
- [CVE-2002-1025](https://cve.now/CVE-2002-1025.md): JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the serve (no CVSS)
- [CVE-2002-1030](https://cve.now/CVE-2002-1030.md): Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial (no CVSS)
- [CVE-2002-1031](https://cve.now/CVE-2002-1031.md): KeyFocus (KF) web server 1.0.2 allows remote attackers to list directories and read restricted files via an HTTP request containing a %00 (n (no CVSS)
- [CVE-2002-1035](https://cve.now/CVE-2002-1035.md): Omnicron OmniHTTPd 2.09 allows remote attackers to cause a denial of service (crash) via an HTTP request with a long, malformed HTTP 1versio (no CVSS)
- [CVE-2002-1039](https://cve.now/CVE-2002-1039.md): Directory traversal vulnerability in Double Choco Latte (DCL) before 20020706 allows remote attackers to read arbitrary files via .. (no CVSS)
- [CVE-2002-1046](https://cve.now/CVE-2002-1046.md): Dynamic VPN Configuration Protocol service (DVCP) in Watchguard Firebox firmware 5.x.x allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2002-1049](https://cve.now/CVE-2002-1049.md): Format string vulnerability in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service (crash) via the TSI data e (no CVSS)
- [CVE-2002-1050](https://cve.now/CVE-2002-1050.md): Buffer overflow in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, (no CVSS)
- [CVE-2002-1051](https://cve.now/CVE-2002-1051.md): Format string vulnerability in TrACESroute 6.0 GOLD (aka NANOG traceroute) allows local users to execute arbitrary code via the -T (terminat (no CVSS)
- [CVE-2002-1053](https://cve.now/CVE-2002-1053.md): Cross-site scripting (XSS) vulnerability in W3C Jigsaw Proxy Server before 2.2.1 allows remote attackers to execute arbitrary script via a U (no CVSS)
- [CVE-2002-1054](https://cve.now/CVE-2002-1054.md): Directory traversal vulnerability in Pablo FTP server 1.0 build 9 and earlier allows remote authenticated users to list arbitrary directorie (no CVSS)
- [CVE-2002-1057](https://cve.now/CVE-2002-1057.md): Buffer overflow in SmartMax MailMax POP3 daemon (popmax) 4.8 allows remote attackers to execute arbitrary code via a long USER command. (no CVSS)
- [CVE-2002-1059](https://cve.now/CVE-2002-1059.md): Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via (no CVSS)
- [CVE-2002-1060](https://cve.now/CVE-2002-1060.md): Cross-site scripting (XSS) vulnerability in Blue Coat Systems (formerly CacheFlow) CacheOS on Client Accelerator 4.1.06, Security Gateway 2. (no CVSS)
- [CVE-2002-1076](https://cve.now/CVE-2002-1076.md): Buffer overflow in the Web Messaging daemon for Ipswitch IMail before 7.12 allows remote attackers to execute arbitrary code via a long HTTP (no CVSS)
- [CVE-2002-1079](https://cve.now/CVE-2002-1079.md): Directory traversal vulnerability in Abyss Web Server 1.0.3 allows remote attackers to read arbitrary files via ..\\ (dot-dot backslash) sequ (no CVSS)
- [CVE-2002-1081](https://cve.now/CVE-2002-1081.md): The Administration console for Abyss Web Server 1.0.3 allows remote attackers to read files without providing login credentials via an HTTP (no CVSS)
- [CVE-2002-1088](https://cve.now/CVE-2002-1088.md): Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 allows remote attackers to execute arbitrary code via a long RCPT TO command. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2003-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.