CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2002(Gain Information)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2002-2410 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information.
2 CVE-2002-2409 200 +Info 2002-12-31 2008-09-05
3.5
 None Remote Medium Single system Partial None None
Photon microGUI in QNX Neutrino realtime operating system (RTOS) 6.1.0 and 6.2.0 allows attackers to read user clipboard information via a direct request to the 1.TEXT file in a directory whose name is a hex-encoded user ID.
3 CVE-2002-2380 200 +Info 2002-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic.
4 CVE-2002-2369 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL.
5 CVE-2002-2356 264 +Info 2002-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
HAMweather 2.x allows remote attackers to modify administrative settings and obtain sensitive information via a direct request to hwadmin.cgi.
6 CVE-2002-2355 255 +Info 2002-12-31 2008-09-05
7.1
 None Remote Medium Not required Complete None None
Netgear FM114P firmware 1.3 wireless firewall, when configured to backup configuration information, stores DDNS (DynDNS) user name and password, MAC address filtering table and possibly other information in cleartext, which could allow local users to obtain sensitive information.
7 CVE-2002-2349 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information.
8 CVE-2002-2346 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses.
9 CVE-2002-2342 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Bannermatic 1, 2, and 3 stores the (1) ban.log, (2) ban.bak, (3) ban.dat and (4) banmat.pwd data files under the web document root with insufficient access control, which allows attackers to obtain sensitive information via a direct request for the files.
10 CVE-2002-2317 200 DoS +Info 2002-12-31 2008-09-05
7.8
 None Remote Low Not required None None Complete
Memory leak in the (1) httpd, (2) nntpd, and (3) vpn driver in VelociRaptor 1.0 allows remote attackers to cause a denial of service (memory consumption) via an unknown method.
11 CVE-2002-2316 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Cisco Catalyst 4000 series switches running CatOS 5.5.5, 6.3.5, and 7.1.2 do not always learn MAC addresses from a single initial packet, which causes unicast traffic to be broadcast across the switch and allows remote attackers to obtain sensitive network information by sniffing.
12 CVE-2002-2289 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive information including ODBC passwords.
13 CVE-2002-2288 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request to index.php with a parameter that does not exist, which causes the path to be leaked in an error message.
14 CVE-2002-2276 200 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Ultimate PHP Board (UPB) 1.0 allows remote attackers to view the physical path of the message board via a direct request to add.php, which leaks the path in an error message.
15 CVE-2002-2247 16 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
The administrator/phpinfo.php script in Mambo Site Server 4.0.11 allows remote attackers to obtain sensitive information such as the full web root path via phpinfo.php, which calls the phpinfo function.
16 CVE-2002-2216 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Soft3304 04WebServer before 1.20 does not properly process URL strings, which allows remote attackers to obtain unspecified sensitive information.
17 CVE-2002-2191 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Lotus Domino 5.0.9a and earlier, even when configured with the 'DominoNoBanner=1' option, allows remote attackers to obtain potential sensitive information such as the version via a request for a non-existent .nsf database, which leaks the version in the HTTP banner.
18 CVE-2002-2177 +Info 2002-12-31 2008-09-10
2.6
 None Remote High Not required Partial None None
BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
19 CVE-2002-2172 +Info 2002-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
Informed (1) Designer and (2) Filler 3.05 does not zero out newly allocated disk blocks as an encrypted file grows in size, which may allow attackers to obtain sensitive information.
20 CVE-2002-2148 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Lucent Ascend MAX Router 5.0 and earlier, Lucent Ascend Pipeline Router 6.0.2 and earlier and Lucent DSLTerminator allows remote attackers to obtain sensitive information such as hostname, MAC, and IP address of the Ethernet interface via a discard (UDP port 9) packet, which causes the device to leak the information in the response.
21 CVE-2002-2137 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
GlobalSunTech Wireless Access Points (1) WISECOM GL2422AP-0T, and possibly OEM products such as (2) D-Link DWL-900AP+ B1 2.1 and 2.2, (3) ALLOY GL-2422AP-S, (4) EUSSO GL2422-AP, and (5) LINKSYS WAP11-V2.2, allow remote attackers to obtain sensitive information like WEP keys, the administrator password, and the MAC filter via a "getsearch" request to UDP port 27155.
22 CVE-2002-2077 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
23 CVE-2002-2039 +Info 2002-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
/bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.
24 CVE-2002-2024 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.
25 CVE-2002-2008 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
26 CVE-2002-2007 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
27 CVE-2002-2006 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
28 CVE-2002-1934 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 2.0.1 leaks sensitive information during boot-up, which allows attackers to obtain the MD5 hash of the Admin password, MD5 hash of the physical password, and other registration information.
29 CVE-2002-1903 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information.
30 CVE-2002-1892 +Info 2002-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information.
31 CVE-2002-1822 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page (JSP).
32 CVE-2002-1801 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
ImageFolio 2.23 through 2.27 allows remote attackers to obtain sensitive information via a nonexistent image category, which leaks the web root in the resulting error message.
33 CVE-2002-1786 +Info 2002-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
SGI IRIX 6.5 through 6.5.14 applies a umask of 022 to root core dumps, which allows local users to read the core dumps and possibly obtain sensitive information.
34 CVE-2002-1762 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Microsoft Baseline Security Analyzer (MBSA) 1.0 stores security scans in a known location C:\Documents and Settings\username\SecurityScans in plaintext, which could allow remote attackers to obtain sensitive information about the system via malicious active content such as ActiveX controls or Java.
35 CVE-2002-1725 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
phpimageview.php in PHPImageView 1.0 allows remote attackers to obtain sensitive information via the pw=show option, which invokes the phpinfo function.
36 CVE-2002-1709 Sql +Info 2002-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable.
37 CVE-2002-1664 +Info 2002-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensitive information.
38 CVE-2002-1639 +Info 2002-04-01 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter set to "version" or "host".
39 CVE-2002-1634 +Info 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Novell NetWare 5.1 installs sample applications that allow remote attackers to obtain sensitive information via (1) ndsobj.nlm, (2) allfield.jse, (3) websinfo.bas, (4) ndslogin.pl, (5) volscgi.pl, (6) lancgi.pl, (7) test.jse, or (8) env.pl.
40 CVE-2002-1632 +Info 2002-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.
41 CVE-2002-1592 +Info 2002-05-06 2008-09-05
5.0
 None Remote Low Not required Partial None None
The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
42 CVE-2002-1571 +Info 2002-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on processors that do not clear all relevant SSE registers.
43 CVE-2002-1188 +Info 2002-12-11 2008-09-10
6.4
 None Remote Low Not required Partial Partial None
Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading."
44 CVE-2002-1159 DoS +Info 2002-12-18 2008-09-10
6.4
 None Remote Low Not required Partial None Partial
Canna 3.6 and earlier does not properly validate requests, which allows remote attackers to cause a denial of service or information leak.
45 CVE-2002-1149 +Info 2002-10-11 2008-09-10
5.0
 None Remote Low Not required Partial None None
The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings.
46 CVE-2002-1099 +Info 2002-10-04 2008-09-05
5.0
 None Remote Low Not required Partial None None
Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, allows remote attackers to obtain potentially sensitive information without authentication by directly accessing certain HTML pages.
47 CVE-2002-1094 +Info 2002-10-04 2008-09-05
5.0
 None Remote Low Not required Partial None None
Information leaks in Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.5.4 allow remote attackers to obtain potentially sensitive information via the (1) SSH banner, (2) FTP banner, or (3) an incorrect HTTP request.
48 CVE-2002-1069 Bypass +Info 2002-10-04 2008-09-05
5.0
 None Remote Low Not required Partial None None
The remote administration capability for the D-Link DI-804 router 4.68 allows remote attackers to bypass authentication and release DHCP addresses or obtain sensitive information via a direct web request to the pages (1) release.htm, (2) Device Status, or (3) Device Information.
49 CVE-2002-0963 Sql +Info 2002-10-04 2008-09-05
5.0
 None Remote Low Not required Partial None None
SQL injection vulnerability in comment.php for GeekLog 1.3.5 and earlier allows remote attackers to obtain sensitive user information via the pid parameter.
50 CVE-2002-0943 +Info 2002-10-04 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb.
Total number of vulnerabilities : 74   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.