CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 2 and 2.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
6451 CVE-2003-0279 Sql 2003-06-16 2017-07-11
2.6
None Remote High Not required Partial None None
Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 5.x through 6.5 allows remote attackers to steal sensitive information via numeric fields, as demonstrated using (1) the viewlink function and cid parameter, or (2) index.php.
6452 CVE-2003-0207 2003-05-05 2008-09-10
2.1
None Local Low Not required None Partial None
ps2epsi creates insecure temporary files when calling ghostscript, which allows local attackers to overwrite arbitrary files.
6453 CVE-2003-0193 2004-08-18 2017-07-11
2.1
None Local Low Not required None Partial None
msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").
6454 CVE-2003-0175 DoS 2004-02-03 2017-07-11
2.1
None Local Low Not required None None Partial
SGI IRIX before 6.5.21 allows local users to cause a denial of service (kernel panic) via a certain call to the PIOCSWATCH ioctl.
6455 CVE-2003-0136 2003-05-05 2017-10-11
2.1
None Local Low Not required None Partial None
psbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file.
6456 CVE-2003-0079 DoS 2003-03-03 2016-10-18
2.1
None Local Low Not required None None Partial
The DEC UDK processing feature in the hanterm (hanterm-xf) terminal emulator before 2.0.5 allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.
6457 CVE-2003-0071 DoS 2003-03-03 2016-10-18
2.1
None Local Low Not required None None Partial
The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.
6458 CVE-2003-0012 2003-01-17 2016-10-18
2.1
None Local Low Not required None Partial None
The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.
6459 CVE-2002-2412 255 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Winamp 2.80 stores authentication credentials in plaintext in the (1) [HTTP-AUTH] and (2) [winamp] sections in winamp.ini, which allows local users to gain access to other accounts.
6460 CVE-2002-2280 16 2002-12-31 2018-10-30
2.1
None Local Low Not required None Partial None
syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which can cause incorrect information to be sent to the syslog server.
6461 CVE-2002-2275 Bypass 2002-12-31 2017-07-29
2.1
None Local Low Not required None None Partial
Fortres 101 4.1 allows local users to bypass Fortres by pressing the Windows and "F" key together for 30 seconds, which opens multiple windows and eventually causes explorer.exe to crash, which then opens an unrestricted explorer.exe.
6462 CVE-2002-2274 2002-12-31 2017-07-29
2.1
None Local Low Not required None Partial None
akfingerd 0.5 allows local users to read arbitrary files as the akfingerd user (nobody) via a symlink attack on the .plan file.
6463 CVE-2002-2254 264 2002-12-31 2017-07-29
2.1
None Local Low Not required None Partial None
The experimental IP packet queuing feature in Netfilter / IPTables in Linux kernel 2.4 up to 2.4.19 and 2.5 up to 2.5.31, when a privileged process exits and network traffic is not being queued, may allow a later process with the same Process ID (PID) to access certain network traffic that would otherwise be restricted.
6464 CVE-2002-2244 362 DoS 2002-12-31 2017-07-29
2.1
None Local Low Not required None None Partial
Akfingerd 0.5 and earlier versions allow local users to cause a denial of service (crash) via a .plan with a symlink to /dev/urandom or other device, then disconnecting while data is being transferred, which causes a SIGPIPE error that Akfingerd cannot handle.
6465 CVE-2002-2177 +Info 2002-12-31 2008-09-10
2.6
None Remote High Not required Partial None None
BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
6466 CVE-2002-2172 +Info 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Informed (1) Designer and (2) Filler 3.05 does not zero out newly allocated disk blocks as an encrypted file grows in size, which may allow attackers to obtain sensitive information.
6467 CVE-2002-2165 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which allows local users to read another user's inbox.
6468 CVE-2002-2132 2002-12-31 2017-11-21
2.1
None Local Low Not required None Partial None
Windows File Protection (WFP) in Windows 2000 and XP does not remove old security catalog .CAT files, which could allow local users to replace new files with vulnerable old files that have valid hash codes.
6469 CVE-2002-2127 2002-12-31 2017-07-11
2.1
None Local Low Not required None Partial None
Integrity Protection Driver (IPD) 1.2 and earlier blocks access to \Device\PhysicalMemory by its name, which could allow local privileged processes to overwrite kernel memory by accessing the device through a symlink.
6470 CVE-2002-2126 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
restrictEnabled in Integrity Protection Driver (IPD) 1.2 delays driver installation for 20 minutes, which allows local users to insert malicious code by setting system clock to an earlier time.
6471 CVE-2002-2122 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Pointsec before 1.2 for PalmOS stores a user's PIN number in memory in plaintext, which allows a local attacker who steals an unlocked Palm to retrieve the PIN by dumping memory.
6472 CVE-2002-2105 2002-12-31 2017-12-19
2.1
None Local Low Not required None None Partial
Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.
6473 CVE-2002-2093 2002-12-31 2017-12-19
2.1
None Local Low Not required Partial None None
The Video Control Panel on SGI O2/IRIX 6.5, when the Default Input is set to "Output Video", allows attackers to access a console session by running videoout then videoin.
6474 CVE-2002-2083 Bypass 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help feature, which can be launched from the Novell Netware login screen.
6475 CVE-2002-2051 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
The processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a symlink attack on files specified as hostnames in a log file.
6476 CVE-2002-2050 Dir. Trav. 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Directory traversal vulnerability in processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a .. (dot dot) in the hostname of a log entry.
6477 CVE-2002-2039 +Info 2002-12-31 2016-10-18
2.1
None Local Low Not required Partial None None
/bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
6478 CVE-2002-2028 2002-12-31 2019-04-30
2.1
None Local Low Not required Partial None None
The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing.
6479 CVE-2002-2023 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The get_parameter_from_freqency_source function in beep2 1.0, 1.1 and 1.2, when installed setuid root, allows local users to read arbitrary files via unknown attack vectors.
6480 CVE-2002-2000 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
ACMS 4.3 and 4.4 in OpenVMS Alpha 7.2 and 7.3 does not properly use process privileges, which allows attackers to access data.
6481 CVE-2002-1996 XSS 2002-12-31 2008-09-05
2.6
None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and (2) catid parameter in index.php.
6482 CVE-2002-1983 DoS Exec Code 2002-12-31 2017-07-11
2.1
None Local Low Not required None None Partial
The timer implementation in QNX RTOS 6.1.0 allows local users to cause a denial of service (hang) and possibly execute arbitrary code by creating multiple timers with a 1-ms tick.
6483 CVE-2002-1977 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Network Associates PGP 7.0.4 and 7.1 does not time out according to the value set in the "Passphrase Cache" option, which could allow attackers to open encrypted files without providing a passphrase.
6484 CVE-2002-1976 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKET_MR_PROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap.
6485 CVE-2002-1975 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Sharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password as stored in the Security.conf file, which makes it easier for local users to guess the password via brute force methods.
6486 CVE-2002-1970 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
SnortCenter 0.9.5, when configured to push Snort rules, stores the rules in a temporary file with world-readable and world-writable permissions, which allows local users to obtain usernames and passwords for the alert database servers.
6487 CVE-2002-1968 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Com21 DOXport 1100 series cable modem running firmware 2.1.1.106, and possibly other versions before 2.1.1.108.003, downloads a DOCSIS configuration file from a TFTP server running on the internal network, which allows local users to modify configuration of the modem via a malicious TFTP server.
6488 CVE-2002-1963 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
Linux kernel 2.4.1 through 2.4.19 sets root's NR_RESERVED_FILES limit to 10 files, which allows local users to cause a denial of service (resource exhaustion) by opening 10 setuid binaries.
6489 CVE-2002-1956 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
ROX Filer 1.1.9 and 1.2 is installed with world writable permissions, which allows local users to write to arbitrary files.
6490 CVE-2002-1946 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software 1.2.000, when the "Save Password" option is used, stores the password with a weak encryption scheme (one-to-one mapping) in a registry key, which allows local users to obtain and decrypt the password.
6491 CVE-2002-1939 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
FlashFXP 1.4 prints FTP passwords in plaintext when there are transfers in the queue, which allows attackers to obtain FTP passwords of other users by editing the queue properties.
6492 CVE-2002-1927 2002-12-31 2017-07-11
2.1
None Local Low Not required None Partial None
Aquonics File Manager 1.5 allows users with edit privileges to modify user accounts by editing the userlist.cgi file.
6493 CVE-2002-1915 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.
6494 CVE-2002-1914 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file.
6495 CVE-2002-1892 +Info 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.
6496 CVE-2002-1890 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
rhmask 1.0-9 in Red Hat Linux 7.1 allows local users to overwrite arbitrary files via a symlink attack on the mask file.
6497 CVE-2002-1888 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allows those organizations to obtain internal server names.
6498 CVE-2002-1876 400 DoS 2002-12-31 2020-04-09
2.1
None Local Low Not required None None Partial
Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS.
6499 CVE-2002-1869 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.
6500 CVE-2002-1848 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which could allow local users to access passwords.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.