CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Microsoft : Security Vulnerabilities Published In 2002

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2002-2401 264 Bypass 2002-12-31 2019-04-30
3.6
 None Local Low Not required Partial Partial None
NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs.
2 CVE-2002-2328 20 DoS 2002-12-31 2019-04-30
7.1
 None Remote Medium Not required None None Complete
Active Directory in Windows 2000, when supporting Kerberos V authentication and GSSAPI, allows remote attackers to cause a denial of service (hang) via an LDAP client that sets the page length to zero during a large request.
3 CVE-2002-2324 264 2002-12-31 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
The "System Restore" directory and subdirectories, and possibly other subdirectories in the "System Volume Information" directory on Windows XP Professional, have insecure access control list (ACL) permissions, which allows local users to access restricted files and modify registry settings.
4 CVE-2002-2311 264 2002-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the vendor has disputed the severity of this issue.
5 CVE-2002-2283 264 2002-12-31 2017-08-17
1.9
 None Local Medium Not required Partial None None
Microsoft Windows XP with Fast User Switching (FUS) enabled does not remove the "show processes from all users" privilege when the user is removed from the administrator group, which allows that user to view processes of other users.
6 CVE-2002-2202 2002-12-31 2008-09-05
3.8
 None Local High ??? Complete None None
Outlook Express 6.0 does not delete messages from dbx files, even when a user empties the Deleted items folder, which allows local users to read other users email.
7 CVE-2002-2189 XSS 2002-12-31 2008-09-05
5.1
 None Remote High Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in ActiveXperts Software ActiveWebserver allows remote attackers to execute arbitrary web script via a link.
8 CVE-2002-2185 DoS 2002-12-31 2018-10-19
4.9
 None Local Low Not required None None Complete
The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Ethernet address instead of the Multicast group address, which causes the target to stop sending reports to the router and effectively disconnect the group from the network.
9 CVE-2002-2164 DoS Overflow 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Buffer overflow in Microsoft Outlook Express 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (crash) via a long <A HREF> link.
10 CVE-2002-2132 2002-12-31 2017-11-21
2.1
 None Local Low Not required None Partial None
Windows File Protection (WFP) in Windows 2000 and XP does not remove old security catalog .CAT files, which could allow local users to replace new files with vulnerable old files that have valid hash codes.
11 CVE-2002-2125 2002-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM) attack.
12 CVE-2002-2117 DoS 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Microsoft Windows XP allows remote attackers to cause a denial of service (CPU consumption) by flooding UDP port 500 (ISAKMP).
13 CVE-2002-2105 2002-12-31 2017-12-19
2.1
 None Local Low Not required None None Partial
Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.
14 CVE-2002-2101 Exec Code 2002-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
15 CVE-2002-2100 Bypass 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Microsoft Outlook 2002 allows remote attackers to embed bypass the file download restrictions for attachments via an HTML email message that uses an IFRAME to reference malicious content.
16 CVE-2002-2081 DoS 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
17 CVE-2002-2077 +Info 2002-12-31 2019-04-30
5.0
 None Remote Low Not required Partial None None
The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
18 CVE-2002-2073 XSS 2002-12-31 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
19 CVE-2002-2062 XSS 2002-12-31 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP URL.
20 CVE-2002-2031 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files via a script tag with a src parameter that references a non-JavaScript file, then using the onError event handler to monitor the results.
21 CVE-2002-2028 2002-12-31 2019-04-30
2.1
 None Local Low Not required Partial None None
The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing.
22 CVE-2002-1984 DoS 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 5.0.1 through 6.0 on Windows 2000 or Windows XP allows remote attackers to cause a denial of service (crash) via an OBJECT tag that contains a crafted CLASSID (CLSID) value of "CLSID:00022613-0000-0000-C000-000000000046".
23 CVE-2002-1981 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings.
24 CVE-2002-1973 DoS Exec Code Overflow 2002-12-31 2018-08-13
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0, and 6.0 before SP3, as used in multiple products including BadBlue, allows remote attackers to cause a denial of service (access violation and crash) and possibly execute arbitrary code via a long query string that causes a parsing error.
25 CVE-2002-1933 2002-12-31 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
The terminal services screensaver for Microsoft Windows 2000 does not automatically lock the terminal window if the window is minimized, which could allow local users to gain access to the terminal server window.
26 CVE-2002-1932 2002-12-31 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events (clear log manually)" option is set, does not notify the administrator when the log reaches its maximum size, which allows local users and remote attackers to avoid detection.
27 CVE-2002-1918 Overflow 2002-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown attack vectors. NOTE: due to the lack of details available regarding this issue, perhaps it should be REJECTED.
28 CVE-2002-1908 DoS 2002-12-31 2020-11-23
5.0
 None Remote Low Not required None None Partial
Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.
29 CVE-2002-1876 400 DoS 2002-12-31 2020-04-09
2.1
 None Local Low Not required None None Partial
Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS.
30 CVE-2002-1873 400 DoS 2002-12-31 2020-04-09
5.0
 None Remote Low Not required None None Partial
Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.
31 CVE-2002-1872 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.
32 CVE-2002-1847 Exec Code Overflow 2002-12-31 2021-06-15
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. NOTE: since the only known attack vector requires command line access, this may not be a vulnerability.
33 CVE-2002-1844 +Priv 2002-12-31 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Microsoft Windows Media Player (WMP) 6.3, when installed on Solaris, installs executables with world-writable permissions, which allows local users to delete or modify the executables to gain privileges.
34 CVE-2002-1831 DoS 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-encoded spaces (%20) in the Invitation-Cookie field.
35 CVE-2002-1824 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Microsoft Internet Explorer 6.0, when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake, does not prompt the user before searching for and finding a newer certificate, which may allow attackers to perform a man-in-the-middle attack. NOTE: it is not clear whether this poses a vulnerability.
36 CVE-2002-1795 XSS 2002-12-31 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in connect.asp in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
37 CVE-2002-1790 Bypass 2002-12-31 2020-04-09
5.0
 None Remote Low Not required None Partial None
The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed messages via encapsulated SMTP addresses, a similar vulnerability to CVE-1999-0682.
38 CVE-2002-1769 2002-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the "Log on locally" privilege.
39 CVE-2002-1762 +Info 2002-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Microsoft Baseline Security Analyzer (MBSA) 1.0 stores security scans in a known location C:\Documents and Settings\username\SecurityScans in plaintext, which could allow remote attackers to obtain sensitive information about the system via malicious active content such as ActiveX controls or Java.
40 CVE-2002-1749 +Priv 2002-12-31 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
Windows 2000 Terminal Services, when using the disconnect feature of the client, does not properly lock itself if it is left idle until the screen saver activates and the user disconnects, which could allow attackers to gain administrator privileges.
41 CVE-2002-1745 2002-12-31 2018-10-30
5.0
 None Remote Low Not required Partial None None
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
42 CVE-2002-1744 Dir. Trav. 2002-12-31 2018-10-30
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).
43 CVE-2002-1718 200 +Info 2002-12-31 2020-12-09
5.0
 None Remote Low Not required Partial None None
Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
44 CVE-2002-1717 200 +Info 2002-12-31 2020-12-09
5.0
 None Remote Low Not required Partial None None
Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.
45 CVE-2002-1716 2002-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability.
46 CVE-2002-1714 DoS 2002-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type "text/html" with the DATA field that identifies the HTML document that contains the object, which may cause infinite recursion.
47 CVE-2002-1712 DoS 2002-12-31 2019-04-30
5.0
 None Remote Low Not required None None Partial
Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the ACK and FIN bits set to the NetBIOS port (TCP/139), as demonstrated by stream3.
48 CVE-2002-1705 DoS 2002-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to cause a denial of service (crash) via a Cascading Style Sheet (CSS) with the p{cssText} element declared and a bold font weight.
49 CVE-2002-1700 79 XSS 2002-12-31 2018-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.
50 CVE-2002-1698 DoS Overflow 2002-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument in the message header.
Total number of vulnerabilities : 242   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.