CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In April 2002

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2002-1640 XSS 2002-04-01 2018-09-26
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via (1) Text Features in the DHTML UI or (2) the test parameter to the oracle.apps.cz.servlet.UiServlet servlet.
2 CVE-2002-1639 +Info 2002-04-01 2018-09-26
7.5
 None Remote Low Not required Partial Partial Partial
Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter set to "version" or "host".
3 CVE-2002-1621 Exec Code Overflow 2002-04-22 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code.
4 CVE-2002-1620 2002-04-01 2017-07-11
5.0
 None Remote Low Not required Partial None None
Unknown vulnerability in IBM AIX Parallel Systems Support Programs (PSSP) 3.1.1, 3.2, and 3.4 allows remote attackers to read arbitrary files from a file collection.
5 CVE-2002-1602 Exec Code Overflow 2002-04-23 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in the Braille module for GNU screen 3.9.11, when HAVE_BRAILLE is defined, allows local users to execute arbitrary code.
6 CVE-2002-1598 Exec Code Overflow 2002-04-05 2021-04-09
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflows in Computer Associates MLink (CA-MLink) 6.5 and earlier may allow local users to execute arbitrary code via long command line arguments to (1) mlclear or (2) mllock.
7 CVE-2002-1591 Bypass 2002-04-08 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
AOL Instant Messenger (AIM) 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions.
8 CVE-2002-0181 XSS 2002-04-22 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.
9 CVE-2002-0180 Exec Code Overflow 2002-04-22 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Webalizer 2.01-06, when configured to use reverse DNS lookups, allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.
10 CVE-2002-0179 Exec Code Overflow 2002-04-22 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code.
11 CVE-2002-0177 Exec Code Overflow 2002-04-22 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflows in icecast 1.3.11 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client.
12 CVE-2002-0176 2002-04-22 2008-09-11
4.6
 None Local Low Not required Partial Partial Partial
The printf wrappers in libsafe 2.0-11 and earlier do not properly handle argument indexing specifiers, which could allow attackers to exploit certain function calls through arguments that are not verified by libsafe.
13 CVE-2002-0175 Bypass 2002-04-22 2008-09-11
4.6
 None Local Low Not required Partial Partial Partial
libsafe 2.0-11 and earlier allows attackers to bypass protection against format string vulnerabilities via format strings that use the "'" and "I" characters, which are implemented in libc but not libsafe.
14 CVE-2002-0170 2002-04-22 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
15 CVE-2002-0168 DoS Exec Code 2002-04-22 2008-09-11
7.5
 None Remote Low Not required Partial Partial Partial
Vulnerability in Imlib before 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments that are passed to malloc, which results in a heap corruption.
16 CVE-2002-0167 DoS Exec Code 2002-04-22 2008-09-11
7.5
 None Remote Low Not required Partial Partial Partial
Imlib before 1.9.13 sometimes uses the NetPBM package to load trusted images, which could allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain weaknesses of NetPBM.
17 CVE-2002-0166 XSS 2002-04-22 2008-09-11
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in analog before 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is entered into a web logfile and not properly filtered by analog during display.
18 CVE-2002-0165 +Priv 2002-04-03 2016-10-18
7.2
 None Local Low Not required Complete Complete Complete
LogWatch 2.5 allows local users to gain root privileges via a symlink attack, a different vulnerability than CVE-2002-0162.
19 CVE-2002-0160 2002-04-22 2016-10-18
5.0
 None Remote Low Not required Partial None None
The administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to read HTML, Java class, and image files outside the web root via a ..\.. (modified ..) in the URL to port 2002.
20 CVE-2002-0159 134 DoS Exec Code 2002-04-22 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or execute arbitrary code via format strings in the URL to port 2002.
21 CVE-2002-0158 Overflow +Priv 2002-04-02 2018-10-30
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.
22 CVE-2002-0153 Bypass 2002-04-22 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, aka the "Local Applescript Invocation" vulnerability.
23 CVE-2002-0152 DoS Exec Code Overflow 2002-04-22 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in various Microsoft applications for Macintosh allows remote attackers to cause a denial of service (crash) or execute arbitrary code by invoking the file:// directive with a large number of / characters, which affects Internet Explorer 5.1, Outlook Express 5.0 through 5.0.2, Entourage v. X and 2001, PowerPoint v. X, 2001, and 98, and Excel v. X and 2001 for Macintosh.
24 CVE-2002-0151 DoS Overflow +Priv 2002-04-04 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.
25 CVE-2002-0150 DoS Exec Code Overflow 2002-04-22 2020-11-23
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.
26 CVE-2002-0149 DoS Exec Code Overflow 2002-04-22 2020-11-23
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.
27 CVE-2002-0148 XSS 2002-04-22 2020-11-23
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.
28 CVE-2002-0147 DoS Exec Code Overflow 2002-04-22 2020-11-23
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."
29 CVE-2002-0079 DoS Exec Code Overflow 2002-04-22 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.
30 CVE-2002-0075 XSS 2002-04-22 2020-11-23
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message.
31 CVE-2002-0074 XSS 2002-04-22 2020-11-23
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session.
32 CVE-2002-0073 DoS 2002-04-22 2020-11-23
5.0
 None Remote Low Not required None None Partial
The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters.
33 CVE-2002-0072 DoS 2002-04-22 2020-11-23
5.0
 None Remote Low Not required None None Partial
The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.
34 CVE-2002-0071 DoS Exec Code Overflow 2002-04-22 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.
35 CVE-2002-0066 +Priv 2002-04-22 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control, which allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.
36 CVE-2002-0065 +Priv 2002-04-22 2008-09-10
7.2
 None Local Low Not required Complete Complete Complete
Funk Software Proxy Host 3.x uses weak encryption for the Proxy Host password, which allows local users to gain privileges by recovering the passwords from the PHOST.INI file or the Windows registry.
37 CVE-2002-0064 2002-04-22 2008-09-10
7.2
 None Local Low Not required Complete Complete Complete
Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.
38 CVE-2002-0051 2002-04-04 2019-04-30
4.6
 None Local Low Not required Partial Partial Partial
Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.
39 CVE-2002-0041 2002-04-22 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in Mail for SGI IRIX 6.5 through 6.5.15f, and possibly earlier versions, when running with the -R option, allows local and remote attackers to cause a core dump.
40 CVE-2002-0037 Bypass 2002-04-22 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Lotus Domino Servers 5.x, 4.6x, and 4.5x allows attackers to bypass the intended Reader and Author access list for a document's object via a Notes API call (NSFDbReadObject) that directly accesses the object.
41 CVE-2002-0017 Exec Code Overflow 2002-04-03 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request.
42 CVE-2001-1175 2002-04-01 2017-10-10
7.2
 None Local Low Not required Complete Complete Complete
vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing.
43 CVE-2001-1174 Exec Code Overflow 2002-04-01 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header.
44 CVE-2001-1171 +Priv 2002-04-01 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow local users to gain privileges or modify the firewall policy.
45 CVE-2001-1165 +Priv 2002-04-01 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which allows local users to gain privileges by decrypting the information, e.g., with the Disengage tool.
Total number of vulnerabilities : 45   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.