CVE-2002-1981

Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the 1 spMSSetServerProperties or 2 spMSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings...

CVE-2002-2077

The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session...

CVE-2002-1876

Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS...

CVE-2002-2062

Cross-site scripting XSS vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP...

CVE-2002-1749

Windows 2000 Terminal Services, when using the disconnect feature of the client, does not properly lock itself if it is left idle until the screen saver activates and the user disconnects, which could allow attackers to gain administrator privileges...

CVE-2002-1933

The terminal services screensaver for Microsoft Windows 2000 does not automatically lock the terminal window if the window is minimized, which could allow local users to gain access to the terminal server window...

CVE-2002-1984

Microsoft Internet Explorer 5.0.1 through 6.0 on Windows 2000 or Windows XP allows remote attackers to cause a denial of service crash via an OBJECT tag that contains a crafted CLASSID CLSID value of "CLSID:00022613-0000-0000-C000-000000000046"...

CVE-2002-2328

Active Directory in Windows 2000, when supporting Kerberos V authentication and GSSAPI, allows remote attackers to cause a denial of service hang via an LDAP client that sets the page length to zero during a large request...

CVE-2002-2401

NT Virtual DOS Machine NTVDM.EXE in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs...

CVE-2002-1873

Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call MSRPC, allows remote attackers to cause a denial of service crash or memory consumption via malformed MSRPC calls...

Multiple Windows 2000 driver signing problems

It's possible to spoof file with older one, problem in certificate chain validation...

PNG (Portable Network Graphics) Deflate Heap Corruption Vulnerability

PNG Portable Network Graphics Deflate Heap Corruption Vulnerability Release Date: December 11, 2002 Severity: High Code Execution Systems Affected: We have specifically tested the following software and verified the potential for exploitation: Microsoft Internet Explorer 5.01 Microsoft Internet...

Microsoft Security Bulletin MS02-070: Flaw in SMB Signing Could Enable Group Policy to be Modified (309376)

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Flaw in SMB Signing Could Enable Group Policy to be Modified 309376 Date: 11 December 2002 Software: Windows 2000, Windows XP Impact: Modify group policy Max Risk: Moderate Bulletin:...

The default NTFS permissions are not applied to a converted boot partition on Microsoft Windows 2000 and Windows XP systems when CONVERT.EXE is used

Overview Several commercial desktops and laptops from OEM distributors ship with insecure permissions set on files and directories. It has been confirmed that this is due to the use of Microsoft's CONVERT.EXE utility. Description Microsoft's CONVERT.EXE program is used to convert FAT32 file syste...

INwebMailServer.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 - -- INweb Mail Server v2.01 Denial of Service Vulnerability -- - -- Type Denial of Service - -- Release Date November 12, 2002 - -- Product / Vendor The INweb Mail Server is a standard Internet POP3 and SMTP mail server that runs flawlessly under...

CVE-2002-1184

The system root folder of Microsoft Windows 2000 has default permissions of Everyone group with Full access Everyone:F and is in the search path when locating programs during login or application launch from the desktop, which could allow attackers to gain privileges as other users via Trojan hor...

[SecurityOffice] INweb Mail Server v2.01 Denial of Service Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 - -- INweb Mail Server v2.01 Denial of Service Vulnerability -- - -- Type Denial of Service - -- Release Date November 12, 2002 - -- Product / Vendor The INweb Mail Server is a standard Internet POP3 and SMTP mail server that runs flawlessly under...

[SecurityOffice] Hyperion Ftp Server v2.8.1 Directory Traversal Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 - -- Hyperion Ftp Server v2.8.1 Directory Traversal Vulnerability -- - -- Type Directory Traversal - -- Release Date November 12, 2002 - -- Product / Vendor Hyperion FTP Server is a powerful, reliable FTP server for Windows 95/98/NT/2000, and supports...

Microsoft Security Bulletin MS02-064: Windows 2000 Default Permissions Could Allow Trojan Horse Program (Q327522)

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Windows 2000 Default Permissions Could Allow Trojan Horse Program Q327522 Date: 30 October 2002 Software: Windows 2000 Impact: Trojan Horse program execution Max Risk: Moderate...

Microsoft Security Bulletin MS02-063: Unchecked Buffer in PPTP Implementation Could Enable Denial of Service Attacks (Q329834)

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Unchecked Buffer in PPTP Implementation Could Enable Denial of Service Attacks Q329834 Date: 30 October 2002 Software: Windows 2000, Windows XP Impact: Denial of Service Max Risk:...