CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 2 and 2.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
3901 CVE-2003-0079 DoS 2003-03-03 2016-10-17
2.1
None Local Low Not required None None Partial
The DEC UDK processing feature in the hanterm (hanterm-xf) terminal emulator before 2.0.5 allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.
3902 CVE-2003-0071 DoS 2003-03-03 2016-10-17
2.1
None Local Low Not required None None Partial
The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.
3903 CVE-2003-0012 2003-01-17 2016-10-17
2.1
None Local Low Not required None Partial None
The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.
3904 CVE-2002-2412 255 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Winamp 2.80 stores authentication credentials in plaintext in the (1) [HTTP-AUTH] and (2) [winamp] sections in winamp.ini, which allows local users to gain access to other accounts.
3905 CVE-2002-2280 16 2002-12-31 2018-10-30
2.1
None Local Low Not required None Partial None
syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which can cause incorrect information to be sent to the syslog server.
3906 CVE-2002-2275 Bypass 2002-12-31 2017-07-28
2.1
None Local Low Not required None None Partial
Fortres 101 4.1 allows local users to bypass Fortres by pressing the Windows and "F" key together for 30 seconds, which opens multiple windows and eventually causes explorer.exe to crash, which then opens an unrestricted explorer.exe.
3907 CVE-2002-2274 2002-12-31 2017-07-28
2.1
None Local Low Not required None Partial None
akfingerd 0.5 allows local users to read arbitrary files as the akfingerd user (nobody) via a symlink attack on the .plan file.
3908 CVE-2002-2254 264 2002-12-31 2017-07-28
2.1
None Local Low Not required None Partial None
The experimental IP packet queuing feature in Netfilter / IPTables in Linux kernel 2.4 up to 2.4.19 and 2.5 up to 2.5.31, when a privileged process exits and network traffic is not being queued, may allow a later process with the same Process ID (PID) to access certain network traffic that would otherwise be restricted.
3909 CVE-2002-2244 362 DoS 2002-12-31 2017-07-28
2.1
None Local Low Not required None None Partial
Akfingerd 0.5 and earlier versions allow local users to cause a denial of service (crash) via a .plan with a symlink to /dev/urandom or other device, then disconnecting while data is being transferred, which causes a SIGPIPE error that Akfingerd cannot handle.
3910 CVE-2002-2177 +Info 2002-12-31 2008-09-10
2.6
None Remote High Not required Partial None None
BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
3911 CVE-2002-2172 +Info 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Informed (1) Designer and (2) Filler 3.05 does not zero out newly allocated disk blocks as an encrypted file grows in size, which may allow attackers to obtain sensitive information.
3912 CVE-2002-2165 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which allows local users to read another user's inbox.
3913 CVE-2002-2132 2002-12-31 2017-11-21
2.1
None Local Low Not required None Partial None
Windows File Protection (WFP) in Windows 2000 and XP does not remove old security catalog .CAT files, which could allow local users to replace new files with vulnerable old files that have valid hash codes.
3914 CVE-2002-2127 2002-12-31 2017-07-10
2.1
None Local Low Not required None Partial None
Integrity Protection Driver (IPD) 1.2 and earlier blocks access to \Device\PhysicalMemory by its name, which could allow local privileged processes to overwrite kernel memory by accessing the device through a symlink.
3915 CVE-2002-2126 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
restrictEnabled in Integrity Protection Driver (IPD) 1.2 delays driver installation for 20 minutes, which allows local users to insert malicious code by setting system clock to an earlier time.
3916 CVE-2002-2122 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Pointsec before 1.2 for PalmOS stores a user's PIN number in memory in plaintext, which allows a local attacker who steals an unlocked Palm to retrieve the PIN by dumping memory.
3917 CVE-2002-2105 2002-12-31 2017-12-18
2.1
None Local Low Not required None None Partial
Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.
3918 CVE-2002-2093 2002-12-31 2017-12-18
2.1
None Local Low Not required Partial None None
The Video Control Panel on SGI O2/IRIX 6.5, when the Default Input is set to "Output Video", allows attackers to access a console session by running videoout then videoin.
3919 CVE-2002-2083 Bypass 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help feature, which can be launched from the Novell Netware login screen.
3920 CVE-2002-2051 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
The processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a symlink attack on files specified as hostnames in a log file.
3921 CVE-2002-2050 Dir. Trav. 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Directory traversal vulnerability in processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a .. (dot dot) in the hostname of a log entry.
3922 CVE-2002-2039 +Info 2002-12-31 2016-10-17
2.1
None Local Low Not required Partial None None
/bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
3923 CVE-2002-2028 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing.
3924 CVE-2002-2023 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The get_parameter_from_freqency_source function in beep2 1.0, 1.1 and 1.2, when installed setuid root, allows local users to read arbitrary files via unknown attack vectors.
3925 CVE-2002-2000 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
ACMS 4.3 and 4.4 in OpenVMS Alpha 7.2 and 7.3 does not properly use process privileges, which allows attackers to access data.
3926 CVE-2002-1996 XSS 2002-12-31 2008-09-05
2.6
None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and (2) catid parameter in index.php.
3927 CVE-2002-1983 DoS Exec Code 2002-12-31 2017-07-10
2.1
None Local Low Not required None None Partial
The timer implementation in QNX RTOS 6.1.0 allows local users to cause a denial of service (hang) and possibly execute arbitrary code by creating multiple timers with a 1-ms tick.
3928 CVE-2002-1977 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Network Associates PGP 7.0.4 and 7.1 does not time out according to the value set in the "Passphrase Cache" option, which could allow attackers to open encrypted files without providing a passphrase.
3929 CVE-2002-1976 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKET_MR_PROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap.
3930 CVE-2002-1975 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Sharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password as stored in the Security.conf file, which makes it easier for local users to guess the password via brute force methods.
3931 CVE-2002-1970 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
SnortCenter 0.9.5, when configured to push Snort rules, stores the rules in a temporary file with world-readable and world-writable permissions, which allows local users to obtain usernames and passwords for the alert database servers.
3932 CVE-2002-1968 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Com21 DOXport 1100 series cable modem running firmware 2.1.1.106, and possibly other versions before 2.1.1.108.003, downloads a DOCSIS configuration file from a TFTP server running on the internal network, which allows local users to modify configuration of the modem via a malicious TFTP server.
3933 CVE-2002-1963 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
Linux kernel 2.4.1 through 2.4.19 sets root's NR_RESERVED_FILES limit to 10 files, which allows local users to cause a denial of service (resource exhaustion) by opening 10 setuid binaries.
3934 CVE-2002-1956 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
ROX Filer 1.1.9 and 1.2 is installed with world writable permissions, which allows local users to write to arbitrary files.
3935 CVE-2002-1946 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software 1.2.000, when the "Save Password" option is used, stores the password with a weak encryption scheme (one-to-one mapping) in a registry key, which allows local users to obtain and decrypt the password.
3936 CVE-2002-1939 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
FlashFXP 1.4 prints FTP passwords in plaintext when there are transfers in the queue, which allows attackers to obtain FTP passwords of other users by editing the queue properties.
3937 CVE-2002-1927 2002-12-31 2017-07-10
2.1
None Local Low Not required None Partial None
Aquonics File Manager 1.5 allows users with edit privileges to modify user accounts by editing the userlist.cgi file.
3938 CVE-2002-1915 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.
3939 CVE-2002-1914 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file.
3940 CVE-2002-1892 +Info 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.
3941 CVE-2002-1890 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
rhmask 1.0-9 in Red Hat Linux 7.1 allows local users to overwrite arbitrary files via a symlink attack on the mask file.
3942 CVE-2002-1888 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
CommonName Toolbar 3.5.2.0 sends unqualified domain name requests to the CommonName organization and possibly other web servers for name resolution, which allows those organizations to obtain internal server names.
3943 CVE-2002-1876 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS.
3944 CVE-2002-1869 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.
3945 CVE-2002-1848 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which could allow local users to access passwords.
3946 CVE-2002-1827 DoS 2002-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock on the (1) alias, (2) map, (3) statistics, and (4) pid files.
3947 CVE-2002-1813 Dir. Trav. 2002-12-31 2008-09-05
2.6
None Remote High Not required None Partial None
Directory traversal vulnerability in AOL Instant Messenger (AIM) 4.8.2790 allows remote attackers to execute arbitrary programs by specifying the program in the href attribute of a link.
3948 CVE-2002-1791 2002-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
SGI IRIX 6.5 through 6.5.17 creates temporary desktop files with world-writable permissions, which allows local users to overwrite or corrupt those files.
3949 CVE-2002-1786 +Info 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
SGI IRIX 6.5 through 6.5.14 applies a umask of 022 to root core dumps, which allows local users to read the core dumps and possibly obtain sensitive information.
3950 CVE-2002-1782 2002-12-31 2017-07-10
2.1
None Local Low Not required Partial None None
The default configuration of University of Washington IMAP daemon (wu-imapd), when running on a system that does not allow shell access, allows a local user with a valid IMAP account to read arbitrary files as that user.
Total number of vulnerabilities : 4392   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 (This Page)80 81 82 83 84 85 86 87 88
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.