CVE-2002-2062

CVE-2002-2062 affects Internet Explorer 5.5/6.0 on Windows 2000 via the ftp.htt component when the user has “Enable folder view for FTP sites” and “Enable Web content in folders” enabled. The vulnerability is a cross-site scripting (XSS) issue where an attacker can inject arbitrary web script/HTM...

CVE-2002-2067

East-Tec Eraser 2002 on Windows NTFS fails to clear alternate data streams attached to files, allowing recovery of supposedly deleted sensitive information. Descriptions across NVD, Red Hat, and CVE records confirm the issue and its impact on confidentiality (partial in CVSS v2, high in CVSS v3.1...

CVE-2002-2076

CVE-2002-2076 pertains to the Lil’ HTTP server (versions 2.1 and 2.2). The connected sources confirm a directory traversal vulnerability that allows remote attackers to read arbitrary files by including a .. (dot dot) in an HTTP GET request. The root cause is input/path traversal handling in the ...

CVE-2002-2047

The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript EPS file...

CVE-2002-2062

Cross-site scripting XSS vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP...

CVE-2002-2061

Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG image with large width and height values and an 8-bit or 16-bit alpha channel...

CVE-2002-2028

The CVE-2002-2028 entry concerns the Windows screensaver on Windows NT 4.0, 2000, XP, and 2002. The issue is that the screensaver does not verify whether a domain account has already been locked when a valid password is supplied, enabling easier brute-force attempts by users with physical access....

CVE-2002-2000

ACMS 4.3 and 4.4 on OpenVMS Alpha 7.2 and 7.3 expose a privilege-handling flaw where the process privileges are not properly used, allowing an attacker to access data. The issue is local in scope (attackVector: LOCAL) with low base score (CVSS2: 2.1, LOW) and requires no authentication. The descr...

CVE-2002-2019

CVE-2002-2019 refers to a PHP remote file inclusion vulnerability in the include_once.php file of osCommerce (Exchange Project) 2.1. The issue allows a remote attacker to execute arbitrary PHP code by supplying a crafted value to the include_file parameter. The affected software is osCommerce 2.1...

CVE-2002-2039

In QNX RTOS versions 4.25 and 6.1.0, /bin/su allows local users to read sensitive information from core dump files by sending SIGSERV (invalid memory reference); impact is partial confidentiality. The description notes the local privilege/impact but does not provide exploitable details, affected ...

CVE-2002-1994

CVE-2002-1994 affects Advanced Web Server (AdvServer) Professional 1.030000 (AdvServer) via a DoS condition triggered by multiple HTTP requests containing a single CRLF sequence. The public details consistently describe the vulnerability as allowing remote attackers to cause a denial of service; ...

CVE-2002-2043

SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password...

CVE-2002-1991

The CVE-2002-1991 entry describes a PHP file inclusion vulnerability in osCommerce 2.1, exploitable via the include_file parameter to include_once.php to execute arbitrary commands. Affected component: include_once.php in osCommerce 2.1. Impact is indicated as partial confidentiality/integrity/av...

CVE-2002-2064

isadmin.php in PhpWebGallery 1.0 allows remote attackers to gain administrative access via by setting the photologin cookie to pseudo...

CVE-2002-2025

CVE-2002-2025 affects Lotus Domino server 5.0.9a and earlier. The vulnerability allows remote attackers to cause a denial of service by exhausting the server’s working threads via a high volume of HTTP requests for (1) an MS-DOS device name and (2) an MS-DOS device name with a long appended name....

CVE-2002-2078

A heap-based buffer overflow affects Floositek FTGate Pro 1.05 and FTGate Office 1.05. The flaw allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command. Exploitation details are not provided in the connected documents; no patches ...

CVE-2002-2004

CVE-2002-2004 affects the portmapper service in Compaq Tru64 operating system versions 4.0G and 5.0A. The root issue described in the connected records is a denial-of-service condition triggered by a flood of packets sent to the portmapper, exploitable remotely without authentication. This vulner...

CVE-2002-2048

PFinger 0.7.8 client is affected by a buffer overflow when processing long query values in the finger, -l, -d, or -t options. The issue permits remote code execution if the vulnerable binary is setuid/setgid; otherwise privilege boundaries may not be crossed. Affected component is PFinger 0.7.8 c...

CVE-2002-2082

CVE-2002-2082 affects FTGate and FTGate Pro 1.05. The issue allows a remote attacker to lock other users’ mailboxes before authentication succeeds, representing a denial of service on mailbox access. Reports in Red Hat and CVE records reiterate that a pre-authentication mailbox lock is possible, ...

CVE-2002-2065

WebCalendar 0.9.34 and earlier is affected by an insecure include-file access vulnerability. When the product is built with “browsing in includes directory” enabled, remote attackers can read arbitrary .inc files from the web root. Root cause: insecure include-path handling allows reading local i...