# CVEs published 2005-07-14

176 CVEs were published on July 14, 2005: 0 critical, 1 high. Days are UTC.

- [CVE-2000-1228](https://cve.now/CVE-2000-1228.md): Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that set (no CVSS)
- [CVE-2000-1229](https://cve.now/CVE-2000-1229.md): Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." (dot dot) sequences i (no CVSS)
- [CVE-2000-1230](https://cve.now/CVE-2000-1230.md): Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP\_AUTH\_USER para (no CVSS)
- [CVE-2000-1231](https://cve.now/CVE-2000-1231.md): code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string. (no CVSS)
- [CVE-2000-1232](https://cve.now/CVE-2000-1232.md): upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method. (no CVSS)
- [CVE-2000-1233](https://cve.now/CVE-2000-1233.md): SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the (no CVSS)
- [CVE-2000-1234](https://cve.now/CVE-2000-1234.md): violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by s (no CVSS)
- [CVE-2000-1235](https://cve.now/CVE-2000-1235.md): The default configurations of (1) the port listener and (2) modplsql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allow rem (no CVSS)
- [CVE-2000-1236](https://cve.now/CVE-2000-1236.md): SQL injection vulnerability in mod\_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbi (no CVSS)
- [CVE-2000-1237](https://cve.now/CVE-2000-1237.md): The POP3 server in FTGate returns an -ERR code after receiving an invalid USER request, which makes it easier for remote attackers to determ (no CVSS)
- [CVE-2001-1507](https://cve.now/CVE-2001-1507.md): OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged. (no CVSS)
- [CVE-2001-1508](https://cve.now/CVE-2001-1508.md): Buffer overflow in lpstat in SCO OpenServer 5.0 through 5.0.6a allows local users to execute arbitrary code as group bin via a long command (no CVSS)
- [CVE-2001-1509](https://cve.now/CVE-2001-1509.md): geteuid in Itanium Architecture (IA) running on HP-UX 11.20 does not properly identify a user's effective user id, which could allow local u (no CVSS)
- [CVE-2001-1510](https://cve.now/CVE-2001-1510.md): Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows re (no CVSS)
- [CVE-2001-1511](https://cve.now/CVE-2001-1511.md): JRun 3.0 and 3.1 running on JRun Web Server (JWS) and IIS allows remote attackers to read arbitrary JavaServer Pages (JSP) source code via a (no CVSS)
- [CVE-2001-1512](https://cve.now/CVE-2001-1512.md): Unknown vulnerability in Allaire JRun 3.1 allows remote attackers to directly access the WEB-INF and META-INF directories and execute arbitr (no CVSS)
- [CVE-2001-1513](https://cve.now/CVE-2001-1513.md): Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL (no CVSS)
- [CVE-2001-1514](https://cve.now/CVE-2001-1514.md): ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass secu (no CVSS)
- [CVE-2001-1515](https://cve.now/CVE-2001-1515.md): Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS (no CVSS)
- [CVE-2001-1516](https://cve.now/CVE-2001-1516.md): Cross-site scripting (XSS) vulnerability in phpReview 0.9.0 rc2 and earlier allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2001-1517](https://cve.now/CVE-2001-1517.md): RunAs (runas.exe) in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and (no CVSS)
- [CVE-2001-1518](https://cve.now/CVE-2001-1518.md): RunAs (runas.exe) in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service (RunAs (no CVSS)
- [CVE-2001-1519](https://cve.now/CVE-2001-1519.md): RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext user (no CVSS)
- [CVE-2001-1520](https://cve.now/CVE-2001-1520.md): Xircom REX 6000 allows local users to obtain the 10 digit PIN by starting a serial monitor, connecting to the personal digital assistant (PD (no CVSS)
- [CVE-2001-1521](https://cve.now/CVE-2001-1521.md): Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2001-1522](https://cve.now/CVE-2001-1522.md): Cross-site scripting (XSS) vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2001-1523](https://cve.now/CVE-2001-1523.md): Cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2001-1524](https://cve.now/CVE-2001-1524.md): Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2001-1525](https://cve.now/CVE-2001-1525.md): Directory traversal vulnerability in the comments action in easyNews 1.5 and earlier allows remote attackers to modify news.dat, template.da (no CVSS)
- [CVE-2001-1526](https://cve.now/CVE-2001-1526.md): Cross-site scripting (XSS) vulnerability in the comments action in index.php in easyNews 1.5 and earlier allows remote attackers to inject a (no CVSS)
- [CVE-2001-1527](https://cve.now/CVE-2001-1527.md): easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and (no CVSS)
- [CVE-2001-1528](https://cve.now/CVE-2001-1528.md): AmTote International homebet program returns different error messages when invalid account numbers and PIN codes are provided, which allows (no CVSS)
- [CVE-2001-1529](https://cve.now/CVE-2001-1529.md): Buffer overflow in rpc.yppasswdd (yppasswd server) in AIX allows attackers to gain unauthorized access via a long string. (no CVSS)
- [CVE-2001-1530](https://cve.now/CVE-2001-1530.md): run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions, which allows local users to execute arbitrary comma (no CVSS)
- [CVE-2001-1531](https://cve.now/CVE-2001-1531.md): Buffer overflow in Claris Emailer 2.0v2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an emai (no CVSS)
- [CVE-2001-1532](https://cve.now/CVE-2001-1532.md): WebX stores authentication information in the HTTP\_REFERER variable, which is included in URL links within bulletin board messages posted by (no CVSS)
- [CVE-2001-1533](https://cve.now/CVE-2001-1533.md): Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmente (CVSS 5.3)
- [CVE-2001-1534](https://cve.now/CVE-2001-1534.md): mod\_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time an (no CVSS)
- [CVE-2001-1535](https://cve.now/CVE-2001-1535.md): Slashcode 2.0 creates new accounts with an 8-character random password, which could allow local users to obtain session ID's from cookies an (no CVSS)
- [CVE-2001-1536](https://cve.now/CVE-2001-1536.md): Autogalaxy stores usernames and passwords in cleartext in cookies, which makes it easier for remote attackers to obtain authentication infor (no CVSS)
- [CVE-2001-1537](https://cve.now/CVE-2001-1537.md): The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, (no CVSS)
- [CVE-2001-1538](https://cve.now/CVE-2001-1538.md): SpeedXess HA-120 DSL router has a default administrative password of "speedxess", which allows remote attackers to gain access. (no CVSS)
- [CVE-2001-1539](https://cve.now/CVE-2001-1539.md): Stack consumption vulnerability in Internet Explorer The JavaScript settimeout function in Internet Explorer allows remote attackers to caus (no CVSS)
- [CVE-2001-1540](https://cve.now/CVE-2001-1540.md): IPRoute 0.973, 0.974 and 1.18 allows remote attackers to cause a denial of service via fragmented IP packets that split the TCP header. (no CVSS)
- [CVE-2001-1541](https://cve.now/CVE-2001-1541.md): Buffer overflow in Unix-to-Unix Copy Protocol (UUCP) in BSDI BSD/OS 3.0 through 4.2 allows local users to execute arbitrary code via a long (no CVSS)
- [CVE-2001-1542](https://cve.now/CVE-2001-1542.md): NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter improperly MIME encoded email attachments, which could allow remote attackers t (no CVSS)
- [CVE-2001-1543](https://cve.now/CVE-2001-1543.md): Axis network camera 2120, 2110, 2100, 200+ and 200 contains a default administration password "pass", which allows remote attackers to gain (no CVSS)
- [CVE-2001-1544](https://cve.now/CVE-2001-1544.md): Directory traversal vulnerability in Macromedia JRun Web Server (JWS) 2.3.3, 3.0 and 3.1 allows remote attackers to read arbitrary files via (no CVSS)
- [CVE-2001-1545](https://cve.now/CVE-2001-1545.md): Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests (a.k.a. (no CVSS)
- [CVE-2001-1546](https://cve.now/CVE-2001-1546.md): Pathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passw (CVSS 7.8)
- [CVE-2001-1547](https://cve.now/CVE-2001-1547.md): Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email a (no CVSS)
- [CVE-2001-1548](https://cve.now/CVE-2001-1548.md): ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non (no CVSS)
- [CVE-2001-1549](https://cve.now/CVE-2001-1549.md): Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol ada (no CVSS)
- [CVE-2001-1550](https://cve.now/CVE-2001-1550.md): CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to (no CVSS)
- [CVE-2001-1551](https://cve.now/CVE-2001-1551.md): Linux kernel 2.2.19 enables CAP\_SYS\_RESOURCE for setuid processes, which allows local users to exceed disk quota restrictions during executi (no CVSS)
- [CVE-2001-1552](https://cve.now/CVE-2001-1552.md): ssdpsrv.exe in Windows ME allows remote attackers to cause a denial of service by sending multiple newlines in a Simple Service Discovery Pr (no CVSS)
- [CVE-2001-1553](https://cve.now/CVE-2001-1553.md): Buffer overflow in setiathome for SETI@home 3.03, if installed setuid, could allow local users to execute arbitrary code via long command li (no CVSS)
- [CVE-2001-1554](https://cve.now/CVE-2001-1554.md): IBM AIX 430 does not properly unlock IPPMTU\_LOCK, which allows remote attackers to cause a denial of service (hang) via Path Maximum Transmi (no CVSS)
- [CVE-2001-1555](https://cve.now/CVE-2001-1555.md): pt\_chmod in Solaris 8 does not call fdetach to reset terminal privileges when users log out of terminals, which allows local users to write (no CVSS)
- [CVE-2001-1556](https://cve.now/CVE-2001-1556.md): The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which c (no CVSS)
- [CVE-2001-1557](https://cve.now/CVE-2001-1557.md): Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges. (no CVSS)
- [CVE-2001-1558](https://cve.now/CVE-2001-1558.md): Unknown vulnerability in IP defragmenter (frag2) in Snort before 1.8.3 allows attackers to cause a denial of service (crash). (no CVSS)
- [CVE-2001-1559](https://cve.now/CVE-2001-1559.md): The uipc system calls (uipc\_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdr (no CVSS)
- [CVE-2001-1560](https://cve.now/CVE-2001-1560.md): Win32k.sys (aka Graphics Device Interface (GDI)) in Windows 2000 and XP allows local users to cause a denial of service (system crash) by ca (no CVSS)
- [CVE-2001-1561](https://cve.now/CVE-2001-1561.md): Buffer overflow in Xvt 2.1 in Debian Linux 2.2 allows local users to execute arbitrary code via long (1) -name and (2) -T arguments. (no CVSS)
- [CVE-2001-1562](https://cve.now/CVE-2001-1562.md): Format string vulnerability in nvi before 1.79 allows local users to gain privileges via format string specifiers in a filename. (no CVSS)
- [CVE-2001-1563](https://cve.now/CVE-2001-1563.md): Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. (no CVSS)
- [CVE-2001-1564](https://cve.now/CVE-2001-1564.md): setrlimit in HP-UX 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11 does not properly enforce core file size on processes after setuid or (no CVSS)
- [CVE-2001-1565](https://cve.now/CVE-2001-1565.md): Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which (no CVSS)
- [CVE-2001-1566](https://cve.now/CVE-2001-1566.md): Format string vulnerability in libvanessa\_logger 0.0.1 in Perdition 0.1.8 allows remote attackers to execute arbitrary code via format strin (no CVSS)
- [CVE-2001-1567](https://cve.now/CVE-2001-1567.md): Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database files and possibly se (no CVSS)
- [CVE-2001-1568](https://cve.now/CVE-2001-1568.md): CMG WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows (no CVSS)
- [CVE-2001-1569](https://cve.now/CVE-2001-1569.md): Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which al (no CVSS)
- [CVE-2001-1570](https://cve.now/CVE-2001-1570.md): Windows XP with fast user switching and account lockout enabled allows local users to deny user account access by setting the fast user swit (no CVSS)
- [CVE-2001-1571](https://cve.now/CVE-2001-1571.md): The Remote Desktop client in Windows XP sends the most recent user account name in cleartext, which could allow remote attackers to obtain t (no CVSS)
- [CVE-2001-1572](https://cve.now/CVE-2001-1572.md): The MAC module in Netfilter in Linux kernel 2.4.1 through 2.4.11, when configured to filter based on MAC addresses, allows remote attackers (no CVSS)
- [CVE-2002-1987](https://cve.now/CVE-2002-1987.md): Directory traversal vulnerability in view\_source.jsp in Resin 2.1.2 allows remote attackers to read arbitrary files via a "\\.." (backslash d (no CVSS)
- [CVE-2002-1988](https://cve.now/CVE-2002-1988.md): Resin 2.1.1 allows remote attackers to cause a denial of service (memory consumption and hang) via a URL with long variables for non-existen (no CVSS)
- [CVE-2002-1989](https://cve.now/CVE-2002-1989.md): Resin 2.1.1 allows remote attackers to cause a denial of service (thread and connection consumption) via multiple URL requests containing th (no CVSS)
- [CVE-2002-1990](https://cve.now/CVE-2002-1990.md): Resin 2.0.5 through 2.1.2 allows remote attackers to reveal physical path information via a URL request for the example Java class file Hell (no CVSS)
- [CVE-2002-1991](https://cve.now/CVE-2002-1991.md): PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include\_file parameter to include\_once.php. (no CVSS)
- [CVE-2002-1992](https://cve.now/CVE-2002-1992.md): Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote attackers to cause a denial of service in IIS via (1) (no CVSS)
- [CVE-2002-1993](https://cve.now/CVE-2002-1993.md): webbbs\_post.pl in WebBBS 4 and 5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the followup parameter. (no CVSS)
- [CVE-2002-1994](https://cve.now/CVE-2002-1994.md): advserver.exe in Advanced Web Server (AdvServer) Professional 1.030000 allows remote attackers to cause a denial of service via multiple HTT (no CVSS)
- [CVE-2002-1995](https://cve.now/CVE-2002-1995.md): Cross-site scripting (XSS) vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2002-1996](https://cve.now/CVE-2002-1996.md): Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2002-1997](https://cve.now/CVE-2002-1997.md): ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing (no CVSS)
- [CVE-2002-1998](https://cve.now/CVE-2002-1998.md): Buffer overflow in rpc.cmsd in SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows remote attackers to execute arbitrary commands via a long param (no CVSS)
- [CVE-2002-1999](https://cve.now/CVE-2002-1999.md): HP Praesidium Webproxy 1.0 running on HP-UX 11.04 VVOS could allow remote attackers to cause Webproxy to forward requests to the internal ne (no CVSS)
- [CVE-2002-2000](https://cve.now/CVE-2002-2000.md): ACMS 4.3 and 4.4 in OpenVMS Alpha 7.2 and 7.3 does not properly use process privileges, which allows attackers to access data. (no CVSS)
- [CVE-2002-2001](https://cve.now/CVE-2002-2001.md): jmcce 1.3.8 in Mandrake 8.1 creates log files in /tmp with predictable names, which allows local users to overwrite arbitrary files via a sy (no CVSS)
- [CVE-2002-2002](https://cve.now/CVE-2002-2002.md): Buffer overflow in libc in Compaq Tru64 4.0F, 5.0, 5.1 and 5.1A allows attackers to execute arbitrary code via long (1) LANG and (2) LOCPATH (no CVSS)
- [CVE-2002-2003](https://cve.now/CVE-2002-2003.md): ypbind in Compaq Tru64 4.0F, 4.0G, 5.0A, 5.1 and 5.1A allows remote attackers to cause the process to core dump via certain network packets (no CVSS)
- [CVE-2002-2004](https://cve.now/CVE-2002-2004.md): portmapper in Compaq Tru64 4.0G and 5.0A allows remote attackers to cause a denial of service via a flood of packets. (no CVSS)
- [CVE-2002-2005](https://cve.now/CVE-2002-2005.md): Unknown vulnerability in Java web start 1.0.1\_01, 1.0.1, 1.0 and 1.0.1.01 (HP-UX 11.x only) allows attackers to gain access to restricted re (no CVSS)
- [CVE-2002-2006](https://cve.now/CVE-2002-2006.md): The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2002-2007](https://cve.now/CVE-2002-2007.md): The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory (no CVSS)
- [CVE-2002-2008](https://cve.now/CVE-2002-2008.md): Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2002-2009](https://cve.now/CVE-2002-2009.md): Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) \>/, (3) \</, (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2002-2010](https://cve.now/CVE-2002-2010.md): Cross-site scripting (XSS) vulnerability in htsearch.cgi in htdig (ht://Dig) 3.1.5, 3.1.6, and 3.2 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2002-2011](https://cve.now/CVE-2002-2011.md): Cross-site scripting (XSS) vulnerability in the fom CGI program (fom.cgi) in Faq-O-Matic 2.711 and 2.712 allows remote attackers to inject a (no CVSS)
- [CVE-2002-2012](https://cve.now/CVE-2002-2012.md): Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HT (no CVSS)
- [CVE-2002-2013](https://cve.now/CVE-2002-2013.md): Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-en (no CVSS)
- [CVE-2002-2014](https://cve.now/CVE-2002-2014.md): Lotus Domino 5.0.8 web server returns different error messages when a valid or invalid user is provided in HTTP requests, which allows remot (no CVSS)
- [CVE-2002-2015](https://cve.now/CVE-2002-2015.md): PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code (no CVSS)
- [CVE-2002-2016](https://cve.now/CVE-2002-2016.md): User-mode Linux (UML) 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code. (no CVSS)
- [CVE-2002-2017](https://cve.now/CVE-2002-2017.md): sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious p (no CVSS)
- [CVE-2002-2018](https://cve.now/CVE-2002-2018.md): sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the netencralg environment variable, which causes a segmentati (no CVSS)
- [CVE-2002-2019](https://cve.now/CVE-2002-2019.md): PHP remote file inclusion vulnerability in include\_once.php in osCommerce (a.k.a. (no CVSS)
- [CVE-2002-2020](https://cve.now/CVE-2002-2020.md): Netgear RP114 Cable/DSL Web Safe Router Firmware 3.26 uses a default administrator password and accepts admin logins on the external interfa (no CVSS)
- [CVE-2002-2021](https://cve.now/CVE-2002-2021.md): Cross-site scripting (XSS) vulnerability in WoltLab Burning Board (wbboard) 1.1.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2002-2022](https://cve.now/CVE-2002-2022.md): Format string vulnerability in Kaffe OpenVM 1.0.6 and earlier allows local users to execute arbitrary code, when a java.lang.NoClassDefFound (no CVSS)
- [CVE-2002-2023](https://cve.now/CVE-2002-2023.md): The get\_parameter\_from\_freqency\_source function in beep2 1.0, 1.1 and 1.2, when installed setuid root, allows local users to read arbitrary (no CVSS)
- [CVE-2002-2024](https://cve.now/CVE-2002-2024.md): Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reaso (CVSS 5.3)
- [CVE-2002-2025](https://cve.now/CVE-2002-2025.md): Lotus Domino server 5.0.9a and earlier allows remote attackers to cause a denial of service by exhausting the number of working threads via (no CVSS)
- [CVE-2002-2026](https://cve.now/CVE-2002-2026.md): Buffer overflow in BrowseFTP 1.62 client allows remote FTP servers to execute arbitrary code via a long FTP "220" message reply. (no CVSS)
- [CVE-2002-2027](https://cve.now/CVE-2002-2027.md): Database of Our Owlish Wisdom (DOOW) 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform u (no CVSS)
- [CVE-2002-2028](https://cve.now/CVE-2002-2028.md): The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is p (no CVSS)
- [CVE-2002-2029](https://cve.now/CVE-2002-2029.md): PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and pos (no CVSS)
- [CVE-2002-2030](https://cve.now/CVE-2002-2030.md): Stack-based buffer overflow in SQLData Enterprise Server 3.0 allows remote attacker to execute arbitrary code and cause a denial of service (no CVSS)
- [CVE-2002-2031](https://cve.now/CVE-2002-2031.md): Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files (no CVSS)
- [CVE-2002-2032](https://cve.now/CVE-2002-2032.md): sql\_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query in (no CVSS)
- [CVE-2002-2033](https://cve.now/CVE-2002-2033.md): faqmanager.cgi in FAQManager 2.2.5 and earlier allows remote attackers to read arbitrary files by specifying the filename in the toc paramet (no CVSS)
- [CVE-2002-2034](https://cve.now/CVE-2002-2034.md): The Email Sanitizer before 1.133 for Procmail allows remote attackers to bypass the mail filter and execute arbitrary code via crafted recur (no CVSS)
- [CVE-2002-2035](https://cve.now/CVE-2002-2035.md): SQL injection vulnerability in RealityScape MyLogin 2000 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2002-2036](https://cve.now/CVE-2002-2036.md): Sun Ray Server Software (SRSS) 1.3, when Non-Smartcard Mobility (NSCM) is enabled, allows remote attackers to login as another user by runni (no CVSS)
- [CVE-2002-2037](https://cve.now/CVE-2002-2037.md): The Cisco Media Gateway Controller (MGC) in (1) SC2200 7.4 and earlier, (2) VSC3000 9.1 and earlier, (3) PGW 2200 9.1 and earlier, (4) Billi (no CVSS)
- [CVE-2002-2038](https://cve.now/CVE-2002-2038.md): Next Generation POSIX Threading (NGPT) 1.9.0 uses a filesystem-based shared memory entry, which allows local users to cause a denial of serv (no CVSS)
- [CVE-2002-2039](https://cve.now/CVE-2002-2039.md): /bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by se (no CVSS)
- [CVE-2002-2040](https://cve.now/CVE-2002-2040.md): The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges befor (no CVSS)
- [CVE-2002-2041](https://cve.now/CVE-2002-2041.md): Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allows local users to execute arbitrary code via (1) a long ABLANG envir (no CVSS)
- [CVE-2002-2042](https://cve.now/CVE-2002-2042.md): ptrace in the QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows programs to attach to privileged processes, which could allow local (no CVSS)
- [CVE-2002-2043](https://cve.now/CVE-2002-2043.md): SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute a (no CVSS)
- [CVE-2002-2044](https://cve.now/CVE-2002-2044.md): Cross-site scripting (XSS) vulnerability in x\_stat\_admin.php in x-stat 2.3 and earlier allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2002-2045](https://cve.now/CVE-2002-2045.md): x\_stat\_admin.php in x-stat 2.3 and earlier allows remote attackers to (1) execute PHP commands such as phpinfo or (2) obtain the full path o (no CVSS)
- [CVE-2002-2046](https://cve.now/CVE-2002-2046.md): x\_news.php in X-News (x\_news) 1.1 and earlier allows remote attackers to gain administrative privileges by stealing and replaying the md5\_pa (no CVSS)
- [CVE-2002-2047](https://cve.now/CVE-2002-2047.md): The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters i (no CVSS)
- [CVE-2002-2048](https://cve.now/CVE-2002-2048.md): Buffer overflow in PFinger 0.7.8 client allows remote attackers to execute arbitrary code via a long query value passed to the (1) finger pr (no CVSS)
- [CVE-2002-2049](https://cve.now/CVE-2002-2049.md): configure for Dsniff 2.3, fragroute 1.2, and fragrouter 1.6, when downloaded from monkey.org on May 17, 2002, has been modified to contain a (no CVSS)
- [CVE-2002-2050](https://cve.now/CVE-2002-2050.md): Directory traversal vulnerability in processor\_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local (no CVSS)
- [CVE-2002-2051](https://cve.now/CVE-2002-2051.md): The processor\_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary fil (no CVSS)
- [CVE-2002-2052](https://cve.now/CVE-2002-2052.md): Cisco 2611 router running IOS 12.1(6.5), possibly an interim release, allows remote attackers to cause a denial of service via port scans su (no CVSS)
- [CVE-2002-2053](https://cve.now/CVE-2002-2053.md): The design of the Hot Standby Routing Protocol (HSRP), as implemented on Cisco IOS 12.1, when using IRPAS, allows remote attackers to cause (no CVSS)
- [CVE-2002-2054](https://cve.now/CVE-2002-2054.md): TeeKai Forum 1.2 allows remote attackers to authenticate as the administrator and and gain privileged web forum access by setting the valid\_ (no CVSS)
- [CVE-2002-2055](https://cve.now/CVE-2002-2055.md): Cross-site scripting (XSS) vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2002-2056](https://cve.now/CVE-2002-2056.md): Cross-site scripting (XSS) vulnerability in TeeKai Forum 1.2 allows remote attackers to inject arbitrary web script or HTML via the valid\_us (no CVSS)
- [CVE-2002-2057](https://cve.now/CVE-2002-2057.md): TeeKai Forum 1.2 uses weak encryption of web usage statistics in data/member\_log.txt, which is stored under the web document root with insuf (no CVSS)
- [CVE-2002-2058](https://cve.now/CVE-2002-2058.md): TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify I (no CVSS)
- [CVE-2002-2059](https://cve.now/CVE-2002-2059.md): BIOS D845BG, D845HV, D845PT and D845WN on Intel motherboards does not properly restrict access to configuration information when BIOS passwo (no CVSS)
- [CVE-2002-2060](https://cve.now/CVE-2002-2060.md): Buffer overflow in Links 2.0 pre4 allows remote attackers to crash client browsers and possibly execute arbitrary code via gamma tables in l (no CVSS)
- [CVE-2002-2061](https://cve.now/CVE-2002-2061.md): Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitr (no CVSS)
- [CVE-2002-2062](https://cve.now/CVE-2002-2062.md): Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view (no CVSS)
- [CVE-2002-2063](https://cve.now/CVE-2002-2063.md): AtGuard 3.2 allows remote attackers to bypass firwall filters and execute prohibited programs by changing the filenames to permitted filenam (no CVSS)
- [CVE-2002-2064](https://cve.now/CVE-2002-2064.md): isadmin.php in PhpWebGallery 1.0 allows remote attackers to gain administrative access via by setting the photo\_login cookie to pseudo. (no CVSS)
- [CVE-2002-2065](https://cve.now/CVE-2002-2065.md): WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .i (no CVSS)
- [CVE-2002-2066](https://cve.now/CVE-2002-2066.md): BestCrypt BCWipe 1.0.7 and 2.0 through 2.35.1 does not clear Windows alternate data streams that are attached to files on NTFS file systems, (no CVSS)
- [CVE-2002-2067](https://cve.now/CVE-2002-2067.md): East-Tec Eraser 2002 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers t (no CVSS)
- [CVE-2002-2068](https://cve.now/CVE-2002-2068.md): Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover (no CVSS)
- [CVE-2002-2069](https://cve.now/CVE-2002-2069.md): PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to rec (no CVSS)
- [CVE-2002-2070](https://cve.now/CVE-2002-2070.md): SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attacker (no CVSS)
- [CVE-2002-2071](https://cve.now/CVE-2002-2071.md): Compaq Tru64 4.0 d allows remote attackers to cause a denial of service in (1) telnet, (2) FTP, (3) ypbind, (4) rpc.lockd, (5) snmp, (6) ttd (no CVSS)
- [CVE-2002-2072](https://cve.now/CVE-2002-2072.md): java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2002-2073](https://cve.now/CVE-2002-2073.md): Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to (no CVSS)
- [CVE-2002-2074](https://cve.now/CVE-2002-2074.md): SQL injection vulnerability in Mailidx before 20020105 allows remote attackers to execute arbitrary SQL commands via the search web page. (no CVSS)
- [CVE-2002-2075](https://cve.now/CVE-2002-2075.md): ICQ 2001a and 2002b allows remote attackers to cause a denial of service (memory consumption and hang) via a contact message with a large co (no CVSS)
- [CVE-2002-2076](https://cve.now/CVE-2002-2076.md): Directory traversal vulnerability in Lil' HTTP server 2.1 and 2.2 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-2077](https://cve.now/CVE-2002-2077.md): The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote (no CVSS)
- [CVE-2002-2078](https://cve.now/CVE-2002-2078.md): Heap-based buffer overflow in Floositek (1) FTGate Pro 1.05 and (2) FTGate Office 1.05 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2002-2079](https://cve.now/CVE-2002-2079.md): mosix-protocol-stack in Multicomputer Operating System for UnIX (MOSIX) 1.5.7 allows remote attackers to cause a denial of service via malfo (no CVSS)
- [CVE-2002-2080](https://cve.now/CVE-2002-2080.md): Floositek FTGate PRO 1.05 allows remote attackers to cause a denial of service (memory and CPU consumption) via a large number of RCPT TO: m (no CVSS)
- [CVE-2002-2081](https://cve.now/CVE-2002-2081.md): cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file w (no CVSS)
- [CVE-2002-2082](https://cve.now/CVE-2002-2082.md): FTGate and FTGate Pro 1.05 lock user mailboxes before authentication succeeds, which allows remote attackers to lock the mailboxes of other (no CVSS)
- [CVE-2002-2083](https://cve.now/CVE-2002-2083.md): The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help (no CVSS)
- [CVE-2002-2084](https://cve.now/CVE-2002-2084.md): Directory traversal vulnerability in index.php of Portix 0.4.02 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-2085](https://cve.now/CVE-2002-2085.md): Directory traversal vulnerability in page.cgi of WWWeBBB Forum 3.82 beta and earlier allows remote attackers to read arbitrary files via a . (no CVSS)
- [CVE-2002-2086](https://cve.now/CVE-2002-2086.md): Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-07-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.