60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.267 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2002-0654 | MED 5.0 | apache http_server Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when | 58.7% | — |
| CVE-2002-0650 | MED 5.0 | microsoft sql_server The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a "ping" style packet to the Resolution Service (UDP port 1434) with a spoofed IP address of another SQL Server system, whic | 18.3% | — |
| CVE-2002-0648 | MED 5.0 | microsoft internet_explorer The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. | 48.4% | — |
| CVE-2002-0621 | MED 5.0 | microsoft commerce_server Buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000 allows remote attackers to cause the process to fail or run arbitrary code in the LocalSystem security context via certain input to the OWC package inst | 16.9% | — |
| CVE-2002-0620 | MED 5.0 | microsoft commerce_server Buffer overflow in the Profile Service of Microsoft Commerce Server 2000 allows remote attackers to cause the server to fail or run arbitrary code in the LocalSystem security context via an input field using an affected API. | 14.9% | — |
| CVE-2002-0597 | MED 5.0 | microsoft windows_2000 LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445. | 46.6% | — |
| CVE-2002-0545 | MED 5.0 | cisco aironet_ap340 Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts with invalid usernames and passwords. | 1.7% | — |
| CVE-2002-0510 | MED 5.0 | linux linux_kernel The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remote attackers to determine that a target system is running Linux. | 2.4% | — |
| CVE-2002-0505 | MED 5.0 | cisco call_manager Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote attackers to cause a denial of service (crash and reload) via a series of authentication failures, e.g. via incorrect pas | 1.8% | — |
| CVE-2002-0503 | MED 5.0 | citrix nfuse Directory traversal vulnerability in boilerplate.asp for Citrix NFuse 1.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the NFuse_Template parameter. | 2.5% | — |
| CVE-2002-0502 | MED 5.0 | citrix nfuse Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page. | 3.6% | — |
| CVE-2002-0500 | MED 5.0 | microsoft internet_explorer Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc property that references the target file, which sets certain elements of the image object such as file size. | 16.2% | — |
| CVE-2002-0472 | MED 5.0 | microsoft msn_messenger MSN Messenger Service 3.6, and possibly other versions, uses weak authentication when exchanging messages between clients, which allows remote attackers to spoof messages from other users. | 11.9% | — |
| CVE-2002-0461 | MED 5.0 | microsoft internet_explorer Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service (application crash) via Javascript in a web page that calls location.replace on itself, causing a loop. | 24.0% | — |
| CVE-2002-0421 | MED 5.0 | microsoft windows_nt IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr. | 20.0% | — |
| CVE-2002-0419 | MED 5.0 | microsoft internet_information_server Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which (2) in certain configurations, the server IP address is provided as the | 37.3% | — |
| CVE-2002-0409 | MED 5.0 | microsoft .net_framework orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter. | 28.1% | — |
| CVE-2002-0368 | MED 5.0 | microsoft exchange_server The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with a malformed RFC message attribute, aka "Malformed Mail Attribute can Cause Exchange 2000 to Exhaust CPU Resources." | 15.2% | — |
| CVE-2002-0339 | MED 5.0 | cisco ios Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC level packet when the MAC packet's length is less than the IP level packet length. | 1.8% | — |
| CVE-2002-0301 | MED 5.0 | citrix nfuse Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters. | 2.0% | — |
| CVE-2002-0283 | MED 5.0 | microsoft windows_xp Windows XP with port 445 open allows remote attackers to cause a denial of service (CPU consumption) via a flood of TCP SYN packets containing possibly malformed data. | 28.4% | — |
| CVE-2002-0249 | MED 5.0 | apache http_server PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message. | 7.2% | — |
| CVE-2002-0240 | MED 5.0 | apache http_server PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message. | 7.4% | — |
| CVE-2002-0228 | MED 5.0 | microsoft msn_messenger Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and web site navigation, and possibly more when the user is connected to certain Microsoft sites (or DNS-s | 19.9% | — |
| CVE-2002-0224 | MED 5.0 | microsoft internet_information_services The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to cause a denial of service (crash or hang) via malformed (random) input. | 26.7% | — |