58.507 CVE tracked
793 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.507 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2002-1092 | HIGH 7.5 | cisco vpn_3000_concentrator_series_software Cisco VPN 3000 Concentrator 3.6(Rel) and earlier, and 2.x.x, when configured to use internal authentication with group accounts and without any user accounts, allows remote VPN clients to log in using PPTP or IPSEC user authentication. | 1.4% | — |
| CVE-2002-1056 | HIGH 7.5 | microsoft outlook Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via | 18.5% | — |
| CVE-2002-0982 | HIGH 7.5 | microsoft sql_server Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure. | 7.8% | — |
| CVE-2002-0980 | HIGH 7.5 | microsoft internet_explorer The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message | 26.7% | — |
| CVE-2002-0979 | HIGH 7.5 | microsoft virtual_machine The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a known pathname, which can be used to execute arbitrary code. | 6.5% | — |
| CVE-2002-0977 | HIGH 7.5 | microsoft file_transfer_manager Buffer overflow in Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to execute arbitrary code via a long TS value. | 10.9% | — |
| CVE-2002-0975 | HIGH 7.5 | microsoft directx_files_viewer_control Buffer overflow in Microsoft DirectX Files Viewer ActiveX control (xweb.ocx) 2.0.6.15 and earlier allows remote attackers to execute arbitrary via a long File parameter. | 12.8% | — |
| CVE-2002-0954 | HIGH 7.5 | cisco pix_firewall The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, which make it easier for an attacker to decrypt the passwords using brute force techniques. | 0.7% | — |
| CVE-2002-0938 | HIGH 7.5 | cisco secure_access_control_server Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to setup.exe. | 3.1% | — |
| CVE-2002-0870 | HIGH 7.5 | cisco content_services_switch_11000 The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of | 1.5% | — |
| CVE-2002-0869 | HIGH 7.5 | microsoft internet_information_server Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of P | 23.6% | — |
| CVE-2002-0866 | HIGH 7.5 | microsoft virtual_machine Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with th | 41.4% | — |
| CVE-2002-0865 | HIGH 7.5 | microsoft virtual_machine A certain class that supports XML (Extensible Markup Language) in Microsoft Virtual Machine (VM) 5.0.3805 and earlier, probably com.ms.osp.ospmrshl, exposes certain unsafe methods, which allows remote attackers to execute unsafe code via a Java applet, aka "In | 19.8% | — |
| CVE-2002-0861 | HIGH 7.5 | microsoft office_web_components Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object. | 15.8% | — |
| CVE-2002-0859 | HIGH 7.5 | microsoft jet Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code. | 26.2% | — |
| CVE-2002-0843 | HIGH 7.5 | apache http_server Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response. | 21.4% | — |
| CVE-2002-0832 | HIGH 7.5 | microsoft internet_explorer Internet Explorer 5, 5.6, and 6 allows remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData (storeuserData) feature. | 9.9% | — |
| CVE-2002-0823 | HIGH 7.5 | microsoft windows_2000 Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter. | 26.2% | — |
| CVE-2002-0815 | HIGH 7.5 | microsoft internet_explorer The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP and SOAP/XML content from restricted sites by mapping the malicious server's parent DNS domain name to | 3.7% | — |
| CVE-2002-0814 | HIGH 7.5 | vmware gsx_server Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument. | 13.7% | — |
| CVE-2002-0778 | HIGH 7.5 | cisco cache_engine_505 The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connections to allowed IP addresses while hiding the actual source IP. | 1.6% | — |
| CVE-2002-0727 | HIGH 7.5 | microsoft office_web_components The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via the setTimeout method. | 18.8% | — |
| CVE-2002-0726 | HIGH 7.5 | microsoft tsac_activex_control Buffer overflow in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to execute arbitrary code via a long server name field. | 17.4% | — |
| CVE-2002-0724 | HIGH 7.5 | microsoft windows_2000 Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or | 25.7% | — |
| CVE-2002-0723 | HIGH 7.5 | microsoft internet_explorer Microsoft Internet Explorer 5.5 and 6.0 does not properly verify the domain of a frame within a browser window, which allows remote attackers to read client files or invoke executable objects via the Object tag, aka "Cross Domain Verification in Object Tag." | 15.0% | — |