CVE-2002-1791

CVE-2002-1791 affects SGI IRIX 6.5–6.5.17. The vulnerability stems from creating temporary desktop files with world-writable permissions, enabling local users to overwrite or corrupt those files. Exploitation details, affected files, and patch information are not provided in the documents. Public...

CVE-2002-1788

Format string vulnerability in the nnexitmsg function in nn 6.6.0 through 6.6.3 allows remote NNTP servers to execute arbitrary code via format strings in server responses...

CVE-2002-1904

CVE-2002-1904 describes a buffer overflow in the Log function of GazTek ghttpd 1.4–1.4.3 (util.c) that can be triggered by a long HTTP GET request, enabling remote code execution. The vulnerability is risk-labeled as high (CVSS base score 7.5) with network access, no authentication, and the poten...

CVE-2002-1814

Bonobo’s efstools contains a local buffer overflow when installed setuid, allowing a local user to trigger arbitrary code execution through excessively long command line arguments. Affected component: efstools within Bonobo. Root cause: unchecked/buffered input handling leading to overflow when h...

CVE-2002-1785

Zeus Web Server (Zeus Administration Server) versions 4.0–4.1r2 are affected by an XSS vulnerability in which remote authenticated users can inject arbitrary script or HTML via the section parameter to index.fcgi. The description confirms the vulnerability is an XSS issue without providing detail...

CVE-2002-1823

CVE-2002-1823 describes a buffer overflow in the HttpGetRequest function of Zeroo HTTP server 1.5. The flaw allows remote attackers to execute arbitrary code by sending a long HTTP request. The available connected documents confirm the issue and the affected component (Zeroo HTTP server 1.5) and ...

CVE-2002-1898

CVE-2002-1898 affects Terminal 1.3 on Apple Mac OS X 10.2. The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link that is opened and executed by Terminal.app. Root cause is improper handling of telnet:// URLs by Terminal.app, enabling command ...

CVE-2002-1838

CVE-2002-1838 affects Charities.cron 1.0.2 through 1.6.0. A local user can write to arbitrary files via a symlink attack on temporary files, due to improper handling of temporary file names. The issue is described consistently across Red Hat and CVE records, but the provided documents do not incl...

CVE-2002-1919

CVE-2002-1919 affects VP-ASP 4.0, exposing VP-ASP's shopadmin.asp to SQL injection via the username or password fields that can allow remote SQL execution and bypass authentication. Documents indicate a remote impact and administrator-level access possibility, but do not provide a confirmed patch...

CVE-2002-1858

CVE-2002-1858 affects Oracle9i Application Server (versions 1.0.2.2 and 9.0.2 through 9.0.2.0.1) when running on Windows. It allows remote attackers to disclose contents of the WEB-INF directory (Java class files and config) by requesting the directory with a trailing dot (WEB-INF.). The connecte...

CVE-2002-1824

CVE-2002-1824 affects Microsoft Internet Explorer 6.0. During an SSL/TLS handshake, when encountering an expired CA-CERT in a webserver’s certificate chain, IE6 does not prompt the user before automatically searching for a newer certificate, which could enable a man-in-the-middle attack. The avai...

CVE-2002-1984

Microsoft Internet Explorer 5.0.1–6.0 on Windows 2000/XP is vulnerable to a denial of service via a crafted OBJECT tag with CLSID:00022613-0000-0000-C000-000000000046. The issue, described across multiple sources (NVD, Red Hat, CVE records), places the root cause in how the CLSID is processed wit...

CVE-2002-1916

CVE-2002-1916 affects Pirch and RusPirch when auto-log is enabled. A remote attacker can cause a denial of service (crash) by supplying a nickname containing an MS-DOS device name (e.g., AUX) that is inserted into a filename for saving queries. The description notes a partial availability impact....

Microsoft Log Sink Class ActiveX control incorrectly marked "safe for scripting"

Overview The Microsoft Log Sink Class ActiveX control is incorrectly marked safe for scripting. This may allow a remote attacker to create or append to arbitrary files on a vulnerable system. Description ActiveXActiveX is a technology that allows programmers to create reusable software components...

CVE-2002-1695

CVE-2002-1695 affects Norton Internet Security 2001. The issue stems from the product opening log files with FILE_SHARE_READ and FILE_SHARE_WRITE, which could allow remote attackers to modify log contents while Norton Internet Security is running. The provided documents do not include a remediati...

CVE-2002-1781

CVE-2002-1781 concerns multiple buffer overflows in DeleGate v7.7.0–7.8.1 that allow remote code execution via a crafted long USER command sent to the POP proxy. Affected component: DeleGate’s POP proxy handling; root cause: buffer overflow in the USER command processing. Documented impact: remot...

CVE-2002-1689

The CVE-2002-1689 entry concerns the AIX login program prior to 4.0. The issue arises when remote users can supply 100 or more environment variables during login, which surpasses a string length and may trigger a buffer overflow. The available connected documents confirm the affected component (A...

CVE-2002-1697

VTun ECB vulnerability (CVE-2002-1697) : The ECB mode used in VTun 2.0–2.5 produces identical ciphertext for identical plaintext blocks, enabling a remote attacker to potentially gain sensitive information. Affected products: VTun versions 2.0 through 2.5. Root cause: use of ECB encryption mode. ...

CVE-2002-1669

FreeBSD pkg_add (versions 4.2–4.4) creates a temporary directory with world-writable permissions, enabling local users to modify world-writable package components during installation. Root cause: insecure temporary directory permissions. Exploitation details are not provided in the documents, and...

CVE-2002-1684

The CVE-2002-1684 entry concerns a directory traversal vulnerability in Deerfield D2Gfx 1.0.2 and BadBlue Enterprise Edition 1.5.x plus BadBlue Personal Edition 1.5.6. The vulnerability allows remote attackers to read arbitrary files via a ../ traversal in the script used to read Microsoft Office...