CVE-2002-0974 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	26.56%	–	–
2022-04-03	–	–	26.56%	–	–
2023-03-12	–	–	–	3.65%	–
2023-08-13	–	–	–	2.37%	–
2023-09-17	–	–	–	2.37%	–
2024-02-25	–	–	–	2.37%	–
2024-06-02	–	–	–	2.37%	–
2024-12-22	–	–	–	2.92%	–
2025-02-16	–	–	–	2.41%	–
2025-01-19	–	–	–	2.92%	–
2025-02-16	–	–	–	2.41%	–
2025-03-18	–	–	–	–	49.13%
2025-03-30	–	–	–	–	52.73%
2025-03-30	–	–	–	–	52.73,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	96%
2022-04-03	97%
2023-03-12	9%
2023-08-13	88%
2023-09-17	89%
2024-02-25	9%
2024-06-02	9%
2024-12-22	91%
2025-02-16	9%
2025-01-19	91%
2025-02-16	9%
2025-03-18	98%
2025-03-30	98%
2025-03-30	98%

source: https://www.securityfocus.com/bid/5478/info Microsoft Internet Explorer on Windows XP comes equipped with a protocol handler for the 'Help and Support Center' application. The protocol handler may be specified in links, and when such a link is submitted by the browser, the Help and Control Center will load an appropriate page. However, it has been demonstrated that this behavior may be abused. The browser runs requests to the HCP URI handler with relaxed Security Zone restrictions. One of the Help and Support Center application files (uplddrvinfo.htm) contains an ActiveX control which may be used to delete local files. Since the ActiveX control accepts filenames from the HCP URIs, it is possible for an attacker to abuse this situation via a malicious link. Because the browser runs the HCP request with relaxed restrictions, the user is not prompted when the ActiveX control is executed. However, it has been reported that a window with a "Get Help With Your Hardware Device" dialog is displayed when uplddrvinfo.htm is invoked, and that the utility will follow through with the commands if the user closes this window. A number of other files are included in the Help and Support Center application which may also be used by a remote attacker to perform various actions on the client system via a maliciously constructed HCP URI. By using the 'hcp:' protocol, it's possible to launch this from a link. The filename can also include wild cards. Thus, the following link will delete all files in the 'C:\windows\' directory when the launched window is closed. (normal file permissions still apply as usual). Sub-directories are not deleted. hcp://system/DFS/uplddrvinfo.htm?file://c:\windows\*