CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The POP3 proxy service (POPROXY.EXE) in Norton AntiVirus 2001 allows local users to cause a denial of service through a long username with multiple /localhost entries.
Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server.
SQL injection vulnerability in Gender MOD 1.1.3 allows remote attackers to gain administrative access via the user_level parameter in the User Profile page.
The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS versions 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.
CVE-2002-2219 concerns a vulnerability in the chetcpasswd.cgi script in versions before 2.1, allowing remote attackers to read the last line of the shadow file via a long user ID.
CRLF injection vulnerability in the setUserValue function in site.inc.php in the SIPS publishing system before version 20020209 may lead to unknown impact, potentially allowing privilege escalation or modification of critical configuration.
CVE-2002-2153 describes a format string vulnerability in the administrative pages of the PL/SQL module for Oracle Application Server 4.0.8 and 4.0.8 2, allowing remote attackers to execute arbitrary code.
Linksys EtherFast Cable/DSL BEFSR11, BEFSR41, and BEFSRU31 with firmware 1.42.7 opens TCP port 5678 for remote administration even when the 'Block WAN' and 'Remote Admin' options are disabled.
Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.
The default --checksig setting in RPM Package Manager 4.0.4 checks that a package's signature is valid without listing who signed it. This can allow remote attackers to make it appear that a malicious package comes from a trusted source.
FormMail version 1.9 and earlier allows remote attackers to bypass the HTTP_REFERER check, enabling unauthorized activities.
Bogopass in bogofilter 0.9.0.4 allows local users to overwrite arbitrary files via a symlink attack on the bogopass temporary file.
Buffer overflow in the netlog function in pen.c for Pen 0.9.1 and 0.9.2 allows remote attackers to execute arbitrary commands via malformed log messages.
The index.php in Py-Membres 3.1 has a vulnerability that allows remote attackers to log in as an administrator by setting the pymembs parameter to 'admin'.
Multiple buffer overflows in Sybase Adaptive Server 12.0 and 12.5 allow remote attackers to execute arbitrary code via (1) a long parameter to the xp_freedll extended stored procedure or (2) a long database name argument to the DBCC CHECKVERIFY function.
The default configuration of MySQL versions 3.20.32 through 3.23.52 on Windows sets the bind address to the loopback interface, allowing remote attackers to connect to the database.
CVE-2002-1885 is a remote file inclusion vulnerability in PowerPhlogger (PPhlogger) versions 2.0.9 through 2.2.2 in showhits.php3, allowing remote attackers to execute arbitrary PHP code via the rel_path parameter.
SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a base64-encoded user parameter.
mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, resulting in a read/write deadlock between httpd and the CGI script.