CVE-2002-2059

CVE-2002-2059 affects Intel motherboard models BIOS D845BG, D845HV, D845PT and D845WN. The BIOS passwords fail to properly restrict access to configuration information, enabling a local attacker to change the default boot device via the F8 key. The vulnerability stems from insufficient access con...

CVE-2002-2064

PhpWebGallery 1.0 is affected by CVE-2002-2064. isadmin.php allows remote attackers to gain administrative access by setting the photo_login cookie to the value “pseudo,” effectively bypassing authentication. Root cause is improper cookie-based authorization in isadmin.php. The vulnerability can ...

CVE-2002-2028

The CVE-2002-2028 entry concerns the Windows screensaver on Windows NT 4.0, 2000, XP, and 2002. The issue is that the screensaver does not verify whether a domain account has already been locked when a valid password is supplied, enabling easier brute-force attempts by users with physical access....

CVE-2002-2033

FAQManager’s FAQManager CGI (faqmanager.cgi) is affected by CVE-2002-2033. The vulnerability occurs in version 2.2.5 and earlier, where an attacker can read arbitrary files on the web server by supplying a filename in the toc parameter with a trailing null character (%00). This is a web-applicati...

CVE-2002-2023

The CVE-2002-2023 entry concerns the beep2 package (versions 1.0, 1.1, 1.2). The vulnerability arises when the program is installed with setuid root, allowing local users to read arbitrary files via unknown attack vectors. Evidence across multiple sources identifies the affected function (get_par...

CVE-2002-2026

CVE-2002-2026 affects the BrowseFTP 1.62 client. A buffer overflow in the handling of FTP reply text (a long in-band “220” message) can allow a remote attacker to execute arbitrary code on the affected system. The vulnerability is described but public details such as affected platforms, specific ...

CVE-2002-2077

The vulnerability CVE-2002-2077 affects the DCOM client on Windows 2000 prior to SP3. The issue arises because memory is not properly cleared before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session. Connected Red Hat/CVE ...

CVE-2002-1987

The CVE-2002-1987 entry concerns Resin 2.1.2 where a directory traversal flaw in view_source.jsp allows remote attackers to read arbitrary files via a .. sequence. Affected component is Resin 2.1.2; root cause is input path traversal in the JSP renderer. Impact is partial confidentiality (read ac...

CVE-2002-2079

mosix-protocol-stack in Multicomputer Operating System for UnIX MOSIX 1.5.7 allows remote attackers to cause a denial of service via malformed packets...

CVE-2002-2045

CVE-2002-2045 affects x-stat 2.3 and earlier, via x_stat_admin.php. The flaw allows remote attackers to (1) execute PHP commands (e.g., phpinfo) or (2) reveal the web server’s full path through an invalid action parameter that leaks the pathname in an error message. The NVD CVSS v2 score is 6.4 (...

CVE-2002-2056

CVE-2002-2056 describes a cross-site scripting (XSS) vulnerability in TeeKai Forum 1.2, exploitable via the valid_username_online cookie to inject arbitrary script/HTML. The NVD entry assigns a MEDIUM base CVSS v2 score (AV:N/AC:M/Au:N/C:N/I:P/A:N). No exploit details or specific remediation are ...

CVE-2002-2043

SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password...

CVE-2002-2086

CVE-2002-2086 confirms XSS vulnerabilities in the magicHTML component of SquirrelMail (versions before 1.2.6). Remote attackers could inject arbitrary web script or HTML through (1) an input field containing “<

CVE-2002-2011

The CVE-2002-2011 entry concerns Faq-O-Matic’s fom.cgi (versions 2.711 and 2.712). The issue is a cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web script or HTML via the file parameter, potentially enabling/script execution in the victim’s browser. Documented im...

CVE-2002-2080

Floositek FTGate PRO 1.05 is affected by a denial-of-service vulnerability where an attacker can trigger memory and CPU exhaustion by sending a large number of RCPT TO: messages during an SMTP session. The impact is partial availability as per CVSS 2.0 metrics. No remediation details are provided...

CVE-2002-2066

BestCrypt BCWipe versions 1.0.7 and 2.0 through 2.35.1 do not clear Windows alternate data streams (ADS) on NTFS-attached files, allowing recovery of securely deleted data. Connected sources confirm this vulnerability affects BCWipe on NTFS by failing to purge ADS, with implications of sensitive ...

CVE-2002-2027

The CVE-2002-2027 entry concerns DOOW (Database of Our Owlish Wisdom) versions 0.1 through 0.2.1, where insufficient verification of user permissions enables remote attackers to perform unauthorized activities. The available documents confirm the affected product and the underlying issue (permiss...

CVE-2002-2008

CVE-2002-2008 concerns Apache Tomcat 4.0.3 for Windows. The vulnerability allows a remote attacker to disclose the web root path by requesting a resource that does not exist (e.g., lpt9), causing the server to leak information in the error page. This is an information-disclosure in the error hand...

CVE-2002-2064

isadmin.php in PhpWebGallery 1.0 allows remote attackers to gain administrative access via by setting the photologin cookie to pseudo...

CVE-2002-2006

CVE-2002-2006 affects Apache Tomcat 4.0–4.1 and 3.0–3.3.1. The vulnerability is an information disclosure: the default Tomcat distribution exposes installation path and other sensitive info via the Sno o pServlet and TroubleShooter example servlets. The issue is explicitly described as informatio...