dump, rmt security update

CentOS Errata and Security Advisory CESA-2005:583-01 Updated dump packages that address two security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having low security impact by the Red Hat Security Response Team. Dump examines files in a file system,...

CVE-2002-1989

Resin 2.1.1 is affected by CVE-2002-1989. The vulnerability allows remote attackers to cause a denial of service by issuing multiple URL requests that include the DOS name “CON” and a registered file extension such as .jsp or .xtp, leading to thread and connection consumption. The available docum...

CVE-2002-1993

The CVE-2002-1993 entry affects WebBBS 4 and 5.0, where webbbs_post.pl fails to sanitize shell metacharacters in the followup parameter, enabling remote command execution. The underlying issue is improper handling of shell commands, allowing an attacker to run arbitrary commands on the affected s...

CVE-2002-1995

CVE-2002-1995: A cross-site scripting (XSS) vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter. Affected component is phptonuke.php within PHP-Nuke; the underlying issue is input that is not properly sanitized, enab...

CVE-2002-2001

The CVE relates to jmcce 1.3.8 on Mandrake 8.1. It creates log files in /tmp with predictable names, enabling a local user to perform a symlink attack to overwrite arbitrary files. Root-level risk is implied by Mandrake advisory context (jmcce runs with elevated privileges and writes logs to a wo...

CVE-2002-2002

CVE-2002-2002 : The vulnerability is a buffer overflow in libc of Compaq Tru64 releases 4.0F, 5.0, 5.1 and 5.1A triggered by unusually long environment variables (LANG, LOCPATH). This can allow an attacker to execute arbitrary code. The issue is rooted in the Tru64 libc handling of environment va...

CVE-2002-2016

CVE-2002-2016 affects User-mode Linux (UML) 2.4.17-8, where the kernel address space is not restricted, enabling local users to execute arbitrary code. The connected documents confirm a local privilege escalation potential but do not provide any vendor-specific remediation or patch version. Explo...

CVE-2002-2021

CVE-2002-2021 affects WoltLab Burning Board (wbboard) 1.1.1 with a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the message parameter. Multiple connected sources (Red Hat, CVE records, NVD/NIST, CVE List) corroborate the issue. T...

CVE-2002-2030

The CVE-2002-2030 entry affects SQLData Enterprise Server 3.0 and is a stack-based buffer overflow. The vulnerability allows a remote attacker to send a long HTTP request to trigger the overflow, with the impact of executing arbitrary code and causing a denial of service. The available connected ...

CVE-2002-2039

In QNX RTOS versions 4.25 and 6.1.0, /bin/su allows local users to read sensitive information from core dump files by sending SIGSERV (invalid memory reference); impact is partial confidentiality. The description notes the local privilege/impact but does not provide exploitable details, affected ...

CVE-2002-2043

CVE-2002-2043 affects Cyrus SASL patches for LDAP and MySQL authentication (versions 1.5.24 and 1.5.27). The vulnerability is a SQL injection in the authentication patch that enables remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password. Exploi...

CVE-2002-2044

CVE-2002-2044 describes a cross-site scripting (XSS) vulnerability in x-stat (version 2.3 and earlier) affecting the file x_stat_admin.php . The issue arises when a parameter to the phpinfo action is not properly sanitized, allowing remote attackers to inject arbitrary web script or HTML. Affecte...

CVE-2002-2046

CVE-2002-2046 affects X-News (x_news) 1.1 and earlier. The flaw allows remote attackers to gain administrative privileges by stealing and replaying the md5_password cookie. The NVD entry lists a CVSSv2 base score of 7.5 (HIGH) with network attack vector, low attack complexity, and no authenticati...

CVE-2002-2047

The CVE-2002-2047 entry describes a vulnerability in the file preview feature of Sketch (version 0.6.12 and earlier). The issue is that remote attackers can execute arbitrary commands by supplying shell metacharacters in the filename of an encapsulated Postscript (EPS) file, exploiting the previe...

CVE-2002-2048

PFinger 0.7.8 client is affected by a buffer overflow when processing long query values in the finger, -l, -d, or -t options. The issue permits remote code execution if the vulnerable binary is setuid/setgid; otherwise privilege boundaries may not be crossed. Affected component is PFinger 0.7.8 c...

CVE-2002-2050

CVE-2002-2050 affects the ModLogAn processor_web plugin (versions 0.5.0 through 0.7.11) where the splitby option enables a directory traversal via a .. in the hostname of a log entry. This can allow local users to overwrite arbitrary files. The available references do not provide exploit details,...

CVE-2002-2053

CVE-2002-2053 describes a vulnerability in Cisco IOS 12.1 where the Hot Standby Routing Protocol (HSRP) implementation, in conjunction with IRPAS, can be triggered when a router uses the same IP address as the HSRP interface. An attacker remotely induces a DoS by causing CPU consumption and a rou...

CVE-2002-2074

CVE-2002-2074 is an SQL injection vulnerability in Mailidx prior to 20020105. According to NVD, it allows remote attackers to execute arbitrary SQL commands via the search web page, with a base CVSS v2 score of 7.5 (HIGH) and network vector. Affected product/version detail is Mailidx before 20020...

CVE-2002-2076

CVE-2002-2076 pertains to the Lil’ HTTP server (versions 2.1 and 2.2). The connected sources confirm a directory traversal vulnerability that allows remote attackers to read arbitrary files by including a .. (dot dot) in an HTTP GET request. The root cause is input/path traversal handling in the ...

CVE-2002-2083

CVE-2002-2083 : The vulnerability affects the Novell Netware client running on Windows 95. Local users can bypass login and open arbitrary files via the "What is this?" help feature accessible from the Netware login screen. The connected documents do not provide details on affected versions beyon...