CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 9 and 10)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
15601 CVE-2002-0513 +Priv 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
15602 CVE-2002-0508 Exec Code 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
wwwisis 3.45 and earlier allows remote attackers to execute arbitrary commands and read files via the parameters (1) prolog or (2) epilog.
15603 CVE-2002-0495 Exec Code 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi.
15604 CVE-2002-0491 +Priv Bypass 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
admin.php in AlGuest 1.0 guestbook checks for the existence of the admin cookie to authenticate the AlGuest administrator, which allows remote attackers to bypass the authentication and gain privileges by setting the admin cookie to an arbitrary value.
15605 CVE-2002-0490 Exec Code 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php.
15606 CVE-2002-0489 Exec Code 2002-08-12 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
Linux Directory Penguin NsLookup CGI script (nslookup.pl) 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the (1) query or (2) type parameters.
15607 CVE-2002-0488 Exec Code 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Linux Directory Penguin traceroute.pl CGI script 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter.
15608 CVE-2002-0480 2002-08-12 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d is configured to allow a user "skank" on a machine "starscream" to become a key manager when the "first time connection" feature is enabled and before any legitimate administrators have connected, which could allow remote attackers to gain access to the device during installation.
15609 CVE-2002-0473 Exec Code 2002-08-12 2016-09-16
10.0
Admin Remote Low Not required Complete Complete Complete
db.php in phpBB 2.0 (aka phpBB2) RC-3 and earlier allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter.
15610 CVE-2002-0471 Exec Code 2002-08-12 2008-09-24
10.0
Admin Remote Low Not required Complete Complete Complete
PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the a_query variable.
15611 CVE-2002-0467 Exec Code Overflow 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflows in Ecartis (formerly Listar) 1.0.0 before snapshot 20020125 allows remote attackers to execute arbitrary code via (1) address_match() of mystring.c or (2) other functions in tolist.c.
15612 CVE-2002-0465 Exec Code Dir. Trav. 2002-08-12 2017-12-18
10.0
Admin Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in filemanager.asp for Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arbitrary files, and execute commands, via a .. (dot dot) in the OpenPath parameter.
15613 CVE-2002-0450 Exec Code Overflow 2002-07-26 2008-09-10
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.
15614 CVE-2002-0449 Exec Code Overflow 2002-07-26 2017-07-18
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to webplus.exe program, which triggers the overflow in webpsvc.exe.
15615 CVE-2002-0437 Exec Code 2002-07-26 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, as described with the term "string format vulnerability" by some sources.
15616 CVE-2002-0436 Exec Code 2002-07-26 2018-10-30
10.0
Admin Remote Low Not required Complete Complete Complete
sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.
15617 CVE-2002-0434 Exec Code 2002-07-26 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Marcus S. Xenakis directory.php script allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter.
15618 CVE-2002-0432 DoS Exec Code Overflow 2002-07-26 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server.
15619 CVE-2002-0427 Overflow +Priv 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflows in fpexec in mod_frontpage before 1.6.1 may allow attackers to gain root privileges.
15620 CVE-2002-0423 DoS Exec Code Overflow 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a finger request from an IP address with a long hostname that is obtained via a reverse DNS lookup.
15621 CVE-2002-0416 DoS Exec Code Overflow 2002-08-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.
15622 CVE-2002-0405 DoS Exec Code Overflow 2002-07-26 2017-12-18
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Transsoft Broker FTP Server 5.0 evaluation allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CWD command with a large number of . (dot) characters.
15623 CVE-2002-0398 DoS Exec Code 2002-07-26 2017-10-09
10.0
Admin Remote Low Not required Complete Complete Complete
Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name.
15624 CVE-2002-0395 2002-07-26 2017-10-09
10.0
Admin Remote Low Not required Complete Complete Complete
The TFTP server for Red-M 1050 (Bluetooth Access Point) can not be disabled and makes it easier for remote attackers to crack the administration password via brute force methods.
15625 CVE-2002-0394 2002-07-26 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords.
15626 CVE-2002-0393 DoS Exec Code Overflow 2002-07-26 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Red-M 1050 (Bluetooth Access Point) management web interface allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password.
15627 CVE-2002-0391 Exec Code Overflow Bypass 2002-08-12 2018-10-30
10.0
Admin Remote Low Not required Complete Complete Complete
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
15628 CVE-2002-0369 DoS Exec Code Overflow 2002-07-26 2018-10-12
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode.
15629 CVE-2002-0359 +Priv 2002-07-03 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, which allows remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems, to gain root privileges.
15630 CVE-2002-0335 DoS Exec Code Overflow 2002-06-25 2016-10-17
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long HTTP GET request.
15631 CVE-2002-0311 +Priv 2002-05-31 2008-09-10
10.0
Admin Remote Low Not required Complete Complete Complete
Vulnerability in webtop in UnixWare 7.1.1 and Open UNIX 8.0.0 allows local and possibly remote attackers to gain root privileges via shell metacharacters in the -c argument for (1) in scoadminreg.cgi or (2) service_action.cgi.
15632 CVE-2002-0308 +Priv Sql Bypass 2002-05-31 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments.
15633 CVE-2002-0287 +Priv Sql Bypass 2002-05-31 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default.
15634 CVE-2002-0272 Exec Code Overflow 2002-05-31 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflows in mpg321 before 0.2.9 allows local and possibly remote attackers to execute arbitrary code via a long URL to (1) a command line option, (2) an HTTP request, or (3) an FTP request.
15635 CVE-2002-0267 +Priv 2002-05-29 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
preferences.php in Simple Internet Publishing System (SIPS) before 0.3.1 allows remote attackers to gain administrative privileges via a linebreak in the "theme" field followed by the Status::admin command, which causes the Status line to be entered into the password file.
15636 CVE-2002-0255 DoS 2002-05-29 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
The default configuration of Arescom NetDSL 800 does not require authentication, which allows remote attackers to cause a denial of service or reconfigure the router.
15637 CVE-2002-0198 Exec Code Overflow 2002-05-16 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in plDaniels ripMime 1.2.6 and earlier, as used in other programs such as xamime and inflex, allows remote attackers to execute arbitrary code via an attachment in a long filename.
15638 CVE-2002-0083 189 +Priv 2002-03-15 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.
15639 CVE-2002-0048 DoS Exec Code 2002-02-27 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server.
15640 CVE-2002-0033 Exec Code Overflow 2002-05-29 2018-10-30
10.0
Admin Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.
15641 CVE-2002-0018 +Priv 2002-03-08 2018-10-12
10.0
Admin Remote Low Not required Complete Complete Complete
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
15642 CVE-2002-0013 264 DoS +Priv 2002-02-13 2018-10-12
10.0
Admin Remote Low Not required Complete Complete Complete
Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.
15643 CVE-2002-0012 264 DoS +Priv 2002-02-13 2018-10-12
10.0
Admin Remote Low Not required Complete Complete Complete
Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.
15644 CVE-2002-0007 2002-01-31 2017-10-09
10.0
Admin Remote Low Not required Complete Complete Complete
CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which causes a null password to be sent to the LDAP server.
15645 CVE-2002-0005 Exec Code Overflow 2002-01-31 2017-10-09
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in AOL Instant Messenger (AIM) 4.7.2480, 4.8.2616, and other versions allows remote attackers to execute arbitrary code via a long argument in a game request (AddGame).
15646 CVE-2001-1594 255 2015-08-04 2018-03-27
10.0
None Remote Low Not required Complete Complete Complete
GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Polestar/Polestar-i Starlink 4 upgrade, (3) 0 for the entegra user of the Codonics printer FTP service, (4) eNTEGRA for the eNTEGRA P&R user account, (5) insite for the WinVNC Login, and possibly other accounts, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
15647 CVE-2001-1586 22 Exec Code Dir. Trav. 2010-02-12 2017-08-16
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in SimpleServer:WWW 1.13 and earlier allows remote attackers to execute arbitrary programs via encoded ../ ("%2E%2E%2F%") sequences in a request to the cgi-bin/ directory, a different vulnerability than CVE-2000-0664.
15648 CVE-2001-1583 Exec Code 2001-12-31 2018-10-30
10.0
Admin Remote Low Not required Complete Complete Complete
lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220.
15649 CVE-2001-1574 Exec Code Overflow 2001-12-31 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in (1) HttpSaveCVP.dll and (2) HttpSaveCSP.dll in Trend Micro InterScan VirusWall 3.5.1 allows remote attackers to execute arbitrary code.
15650 CVE-2001-1573 Exec Code Overflow 2001-12-31 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in smtpscan.dll for Trend Micro InterScan VirusWall 3.51 for Windows NT has allows remote attackers to execute arbitrary code via a certain configuration parameter.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.