CVE-2002-1846

YaBB vulnerable: YaBB 1.40/1.41 allows changing a user’s password without providing the correct password, by leveraging a stolen cookie and submitting a profile2 action to index.php. This lets remote attackers modify the password and adjust the expiretime setting. Root cause is insufficient authe...

CVE-2002-1962

Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL with an IP address instead of a hostname...

CVE-2002-1790

CVE-2002-1790 affects the SMTP service in Microsoft IIS 4.0/5.0, where the root cause is bypassing anti-relaying rules by using encapsulated SMTP addresses, enabling remote attackers to send spam or spoofed messages. This CVE is linked to the prior CVE-1999-0682 remediation lineage. The connected...

CVE-2002-1821

Affected software: Ultimate PHP Board (UPB) 1.0 and 1.0b. Vulnerability: Remote authenticated users can gain privileges and perform unauthorized actions by making direct requests to specific admin pages: admin_members.php, admin_config.php, admin_cat.php, and admin_forum.php. Root cause/impact: T...

CVE-2002-1841

CVE-2002-1841 affects NOLA 1.1.1 and 1.1.2 where the document management module does not restrict uploaded file types, enabling remote attackers to upload and execute arbitrary PHP files (e.g., with .php4 extensions). The root cause is lack of validation on uploaded content within the document ma...

CVE-2002-1895

The vulnerability CVE-2002-1895 affects the Tomcat servlet engine in versions 3.3 and 4.0.4 when used with IIS and the ajp1.3 connector. Affected component: servlet engine; issue: remote attackers can trigger a denial of service (crash) by issuing a large sequence of HTTP GET requests for MS-DOS ...

CVE-2002-1812

CVE-2002-1812: Buffer overflow in gdam123 versions 0.933 and 0.942 allows local users to execute arbitrary code via a long filename parameter. Root cause: unsafe handling of filename input leading to overflow. Impact: arbitrary code execution with local privileges; no exploitation details provide...

CVE-2002-1896

CVE-2002-1896 describes a buffer overflow in Alsaplayer 0.99.71 when installed with setuid root , allowing local users to execute arbitrary code via a long command line argument in either the -f or -o option. The connected documents confirm the affected component, root-cause class (buffer overflo...

CVE-2002-1959

CVE-2002-1959 affects Nagios 1.0b1 through 1.0b3. The vulnerability allows remote attackers to execute arbitrary commands by injecting shell metacharacters into plugin output. Affected component is the collection/output handling of plugins; the underlying cause is unsanitized command execution th...

CVE-2002-1783

CVE-2002-1783 describes a CRLF injection vulnerability in PHP 4.2.1–4.2.3 when allow_url_fopen is enabled. An attacker could cause CRLF sequences to be injected into arguments passed to fopen or file functions, enabling modification of HTTP headers for outgoing requests. This is a remote, header-...

CVE-2002-1947

Webmin 0.21–1.0 uses the same built-in SSL key across installations, allowing remote attackers to eavesdrop on or hijack SSL sessions. The root cause is the shared SSL key across deployments. No remediation or patch details are provided in the connected documents.

CVE-2002-1943

The vulnerability CVE-2002-1943 affects SafeTP 1.46. When NAT is used, the internal FTP server IP address is leaked in responses to PASV (passive mode) FTP transfers. Root cause: NAT-related information disclosure in SafeTP’s PASV handling. Impact is partial confidentiality leakage; no integrity ...

CVE-2002-1922

CVE-2002-1922 describes a Cross-site Scripting (XSS) vulnerability in Jelsoft vBulletin, affecting versions 2.0.0 through 2.2.8. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) $scriptpath or (2) $url variables in global.php. The connected documents confirm th...

CVE-2002-1907

TelCondex SimpleWebServer 2.06.20817 is reported affected. A remote attacker can cause a denial-of-service (crash) by sending a long HTTP GET request, per CVE-2002-1907. The CVSS data indicates network access, low attack complexity, no authentication, and a partial availability impact (base score...

CVE-2002-1897

MyWebServer LLC MyWebServer 1.0.2 is affected by CVE-2002-1897. A long HTTP request may crash the server (possible buffer overflow) when processed by the vulnerable component. The available sources describe denial of service as the impact; no explicit exploitation details, affected file/module, o...

CVE-2002-1845

CVE-2002-1845 is an XSS vulnerability in Yet Another Bulletin Board (YaBB) versions 1.40 and 1.41, where the password parameter (passwrd) can be exploited by remote attackers to inject arbitrary web script/HTML via index.php. The connected sources confirm the affected product/version and the vuln...

CVE-2002-1852

CVE-2002-1852 describes a cross-site scripting (XSS) vulnerability in Monkey 0.5.0. The issue allows remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) a parameter to test2.pl. Connected documents confirm the affected product and the general impact, but do not provide ...

CVE-2002-1929

Technical details about CVE-2002-1929 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2002-1831

MSN Messenger Service 1.0–4.6 is affected by a remote DoS vulnerability: an invite request containing hex-encoded spaces (%20) in the Invitation-Cookie field can crash the service. The available documents do not provide a root-cause analysis, affected versions beyond 1.0–4.6, exploit specifics, o...

CVE-2002-1954

CVE-2002-1954 is an XSS in the PHP 4.2.3 phpinfo function. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the query string argument, demonstrated using soinfo.php. Affected software: PHP 4.2.3; vulnerable component: phpinfo output handling. Root cause: unsani...