CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Security Vulnerabilities Published In September 2002

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2002-1615 Exec Code Overflow 2002-09-13 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Multiple buffer overflows in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allow local users to execute arbitrary code via (1) msgchk or (2) .upd..loader.
2 CVE-2002-1614 Exec Code Overflow 2002-09-09 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in HP Tru64 UNIX allows local users to execute arbitrary code via a long argument to /usr/bin/at.
3 CVE-2002-1613 Overflow +Priv 2002-09-10 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in ps in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to gain privileges.
4 CVE-2002-1612 Overflow +Priv 2002-09-13 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in mailcv in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to gain privileges.
5 CVE-2002-1605 Exec Code Overflow 2002-09-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows attackers to execute arbitrary code via a long _XKB_CHARSET environment variable to (1) dxpause, (2) dxconsole, or (3) dtsession.
6 CVE-2002-1604 Exec Code Overflow 2002-09-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in HP Tru64 UNIX allow local and possibly remote attackers to execute arbitrary code via a long NLSPATH environment variable to (1) csh, (2) dtsession, (3) dxsysinfo, (4) imapd, (5) inc, (6) uucp, (7) uux, (8) rdist, or (9) deliver.
7 CVE-2002-1593 DoS 2002-09-25 2021-06-06
5.0
 None Remote Low Not required None None Partial
mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.
8 CVE-2002-1126 2002-09-24 2016-10-18
2.6
 None Remote High Not required Partial None None
Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler.
9 CVE-2002-1125 2002-09-24 2016-10-18
2.1
 None Local Low Not required Partial None None
FreeBSD port programs that use libkvm for FreeBSD 4.6.2-RELEASE and earlier, including (1) asmon, (2) ascpu, (3) bubblemon, (4) wmmon, and (5) wmnet2, leave open file descriptors for /dev/mem and /dev/kmem, which allows local users to read kernel memory.
10 CVE-2002-1124 Overflow +Priv 2002-09-24 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Multiple buffer overflows in purity 1-16 allow local users to gain privileges and modify high scores tables.
11 CVE-2002-1123 Exec Code Overflow 2002-09-24 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.
12 CVE-2002-1122 Exec Code Overflow 2002-09-24 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the parsing mechanism for ISS Internet Scanner 6.2.1, when using the license banner HTTP check, allows remote attackers to execute arbitrary code via a long web server response.
13 CVE-2002-1121 Bypass 2002-09-24 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default configuration of MIMEDefang before 2.21, and possibly other products, do not detect fragmented emails as defined in RFC2046 ("Message Fragmentation and Reassembly") and supported in such products as Outlook Express, which allows remote attackers to bypass content filtering, including virus checking, via fragmented emails of the message/partial content type.
14 CVE-2002-1120 Exec Code Overflow 2002-09-24 2017-10-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
15 CVE-2002-0989 2002-09-24 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
The URL handler in the manual browser option for Gaim before 0.59.1 allows remote attackers to execute arbitrary script via shell metacharacters in a link.
16 CVE-2002-0988 Overflow 2002-09-24 2008-09-10
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1, possibly related to XBM/xkbcomp capabilities.
17 CVE-2002-0987 +Priv 2002-09-24 2008-09-10
7.2
 None Local Low Not required Complete Complete Complete
X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which could allow local users to gain privileges.
18 CVE-2002-0986 2002-09-24 2017-10-10
5.0
 None Remote Low Not required None Partial None
The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."
19 CVE-2002-0985 Bypass 2002-09-24 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.
20 CVE-2002-0984 Exec Code 2002-09-24 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code.
21 CVE-2002-0983 DoS Overflow 2002-09-24 2017-07-11
5.0
 None Remote Low Not required None None Partial
IRC client irssi in irssi-text before 0.8.4 allows remote attackers to cause a denial of service (crash) via an IRC channel that has a long topic followed by a certain string, possibly triggering a buffer overflow.
22 CVE-2002-0982 Exec Code 2002-09-24 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure.
23 CVE-2002-0981 Exec Code Overflow 2002-09-24 2008-09-10
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line.
24 CVE-2002-0980 Exec Code 2002-09-24 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message file via a mhtml: URL.
25 CVE-2002-0979 Exec Code 2002-09-24 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a known pathname, which can be used to execute arbitrary code.
26 CVE-2002-0978 2002-09-24 2008-09-10
5.0
 None Remote Low Not required None Partial None
Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to upload or download arbitrary files to arbitrary locations via a man-in-the-middle attack with modified TGT and TGN parameters in a call to the "Persist" function.
27 CVE-2002-0977 Exec Code Overflow 2002-09-24 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to execute arbitrary code via a long TS value.
28 CVE-2002-0976 2002-09-24 2021-07-23
6.4
 None Remote Low Not required Partial Partial None
Internet Explorer 4.0 and later allows remote attackers to read arbitrary files via a web page that accesses a legacy XML Datasource applet (com.ms.xml.dso.XMLDSO.class) and modifies the base URL to point to the local system, which is trusted by the applet.
29 CVE-2002-0975 Overflow 2002-09-24 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Microsoft DirectX Files Viewer ActiveX control (xweb.ocx) 2.0.6.15 and earlier allows remote attackers to execute arbitrary via a long File parameter.
30 CVE-2002-0974 2002-09-24 2018-10-12
5.0
 None Remote Low Not required None Partial None
Help and Support Center for Windows XP allows remote attackers to delete arbitrary files via a link to the hcp: protocol that accesses uplddrvinfo.htm.
31 CVE-2002-0973 2002-09-24 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel memory via large negative values to the (1) accept, (2) getsockname, and (3) getpeername system calls, and the (4) vesa FBIO_GETPALETTE ioctl.
32 CVE-2002-0972 DoS Exec Code Overflow 2002-09-24 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to the functions (1) lpad or (2) rpad.
33 CVE-2002-0971 Exec Code Bypass 2002-09-24 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box.
34 CVE-2002-0970 2002-09-24 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.
35 CVE-2002-0875 2002-09-05 2008-09-10
2.1
 None Local Low Not required Partial None None
Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to the root group.
36 CVE-2002-0874 2002-09-05 2008-09-10
5.0
 None Remote Low Not required Partial None None
Vulnerability in Interchange 4.8.6, 4.8.3, and other versions, when running in INET mode, allows remote attackers to read arbitrary files.
37 CVE-2002-0873 Overflow 2002-09-05 2008-09-10
5.0
 None Remote Low Not required None Partial None
Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attribute/value pair, possibly via a buffer overflow.
38 CVE-2002-0872 2002-09-05 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions.
39 CVE-2002-0871 DoS 2002-09-05 2016-12-08
2.1
 None Local Low Not required None None Partial
xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe.
40 CVE-2002-0870 +Priv Bypass 2002-09-05 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through the interface, possibly via a variant of the original attack, as identified by Cisco bug ID CSCdw08549.
41 CVE-2002-0861 Bypass 2002-09-24 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object.
42 CVE-2002-0860 2002-09-24 2018-10-12
5.0
 None Remote Low Not required Partial None None
The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that redirects to the target file.
43 CVE-2002-0859 Exec Code Overflow 2002-09-05 2018-08-13
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code.
44 CVE-2002-0858 +Priv 2002-09-05 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
catsnmp in Oracle 9i and 8i is installed with a dbsnmp user with a default dbsnmp password, which allows attackers to perform restricted database operations and possibly gain other privileges.
45 CVE-2002-0857 Exec Code 2002-09-05 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.
46 CVE-2002-0856 DoS 2002-09-05 2008-09-10
5.0
 None Remote Low Not required None None Partial
SQL*NET listener for Oracle Net Oracle9i 9.0.x and 9.2 allows remote attackers to cause a denial of service (crash) via certain debug requests that are not properly handled by the debugging feature.
47 CVE-2002-0855 XSS 2002-09-05 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature.
48 CVE-2002-0854 Overflow +Priv 2002-09-05 2017-11-02
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflows in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the i4l package on SuSE 7.3, 8.0, and possibly other operating systems, may allow local users to gain privileges.
49 CVE-2002-0853 DoS 2002-09-05 2008-09-10
5.0
 None Remote Low Not required None None Partial
Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload.
50 CVE-2002-0852 DoS Overflow 2002-09-05 2008-09-10
5.0
 None Remote Low Not required None None Partial
Buffer overflows in Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service via (1) an Internet Key Exchange (IKE) with a large Security Parameter Index (SPI) payload, or (2) an IKE packet with a large number of valid payloads.
Total number of vulnerabilities : 68   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.