CVE-2002-1868

CVE-2002-1868 affects Dispair versions 0.1 and 0.2. The vulnerability allows remote attackers to execute arbitrary shell commands via certain form fields. The NVD entry lists a base score of 10.0 (HIGH) with network attack vector and low complexity, but the connected Red Hat and CVE records do no...

CVE-2002-1895

The vulnerability CVE-2002-1895 affects the Tomcat servlet engine in versions 3.3 and 4.0.4 when used with IIS and the ajp1.3 connector. Affected component: servlet engine; issue: remote attackers can trigger a denial of service (crash) by issuing a large sequence of HTTP GET requests for MS-DOS ...

CVE-2002-1875

CVE-2002-1875 affects Entercept Agent 2.5 for Windows. The vulnerability description states that local administrative users can obtain the Entercept agent password, enabling them to log on as the entercept_agent account and conceal their identity. Connected sources consistently describe the same ...

CVE-2002-1892

NETGEAR FVS318 running firmware 1.1 stores the username and password in a readable format when a backup of the configuration file is made, which allows local users to obtain sensitive information...

CVE-2002-1814

Bonobo’s efstools contains a local buffer overflow when installed setuid, allowing a local user to trigger arbitrary code execution through excessively long command line arguments. Affected component: efstools within Bonobo. Root cause: unchecked/buffered input handling leading to overflow when h...

CVE-2002-1860

CVE-2002-1860 affects Pramati Server 3.0 running on Windows, where a remote attacker can disclose files under the WEB-INF directory by requesting the directory with a trailing dot ("WEB-INF."). The connected sources confirm this information disclosure vector targets the WEB-INF path and may expos...

CVE-2002-1856

CVE-2002-1856 affects HP Application Server 8.0 on Windows, where a remote attacker can retrieve files under the WEB-INF directory by requesting WEB-INF. with a trailing dot. The CVSS v2 base score is 5.0 (MEDIUM) with network access and low complexity, no authentication required, partial confide...

CVE-2002-1858

CVE-2002-1858 affects Oracle9i Application Server (versions 1.0.2.2 and 9.0.2 through 9.0.2.0.1) when running on Windows. It allows remote attackers to disclose contents of the WEB-INF directory (Java class files and config) by requesting the directory with a trailing dot (WEB-INF.). The connecte...

CVE-2002-1944

The vulnerability CVE-2002-1944 affects the Motorola Surfboard 4200 cable modem, where remote attackers can trigger a denial-of-service (crash) by sending a SYN scan with a tool like nmap. The available documents describe the affected device and the attack vector (network-based SYN scan) and resu...

CVE-2002-1879

CVE-2002-1879 describes an SQL injection in LokwaBB 1.2.2 that lets remote attackers execute arbitrary SQL via the (1) member parameter to member.php or (2) loser parameter to misc.php. The NVD entry lists a base score of 7.5 (HIGH) with NETWORK attack vector and partial impacts on confidentialit...

CVE-2002-1902

CVE-2002-1902 affects CGIForum 1.0–1.05. The vulnerability allows remote attackers to cause a denial of service via infinite recursion by creating a forum post that is a child of an outdated parent. Affected software is CGIForum’s web-based message board component; root cause appears to be unboun...

CVE-2002-1897

MyWebServer LLC MyWebServer 1.0.2 is affected by CVE-2002-1897. A long HTTP request may crash the server (possible buffer overflow) when processed by the vulnerable component. The available sources describe denial of service as the impact; no explicit exploitation details, affected file/module, o...

CVE-2002-1857

CVE-2002-1857 affects jo! jo Webserver 1.0 on Windows, allowing remote retrieval of files under the WEB-INF directory by requesting WEB-INF. with a trailing dot. OpenVAS/Nessus entries describe the issue as an information-disclosure vulnerability affecting Win32 J2EE containers/app servers, with ...

CVE-2002-1973

The CVE-2002-1973 entry describes a buffer overflow in CHttpServer::OnParseError of the ISAPI extension (Isapi.cpp) when built with MFC static libraries in Visual C++ 5.0 and 6.0 before SP3. This flaw, present in multiple products (including BadBlue), can be triggered by a long query string that ...

CVE-2002-1796

ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, which allows local users to load unauthorized Chai services...

CVE-2002-1855

Macromedia JRun 3.0 through 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot "WEB-INF."...

CVE-2002-1948

Technical details (affected product/version, root cause, impact, and fixes) are not provided in the initial or connected documents. Monitor for updates.

CVE-2002-1916

CVE-2002-1916 affects Pirch and RusPirch when auto-log is enabled. A remote attacker can cause a denial of service (crash) by supplying a nickname containing an MS-DOS device name (e.g., AUX) that is inserted into a filename for saving queries. The description notes a partial availability impact....

CVE-2002-1952

phpRank 1.8 does not properly check the return codes for MySQL operations when authenticating users, which could allow remote attackers to authenticate using a NULL password when database errors occur or if the database is unavailable...

CVE-2002-1954

CVE-2002-1954 is an XSS in the PHP 4.2.3 phpinfo function. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the query string argument, demonstrated using soinfo.php. Affected software: PHP 4.2.3; vulnerable component: phpinfo output handling. Root cause: unsani...