CVE-2002-1669

FreeBSD pkg_add (versions 4.2–4.4) creates a temporary directory with world-writable permissions, enabling local users to modify world-writable package components during installation. Root cause: insecure temporary directory permissions. Exploitation details are not provided in the documents, and...

CVE-2002-1684

The CVE-2002-1684 entry concerns a directory traversal vulnerability in Deerfield D2Gfx 1.0.2 and BadBlue Enterprise Edition 1.5.x plus BadBlue Personal Edition 1.5.6. The vulnerability allows remote attackers to read arbitrary files via a ../ traversal in the script used to read Microsoft Office...

CVE-2002-1688

This CVE concerns Microsoft Internet Explorer versions 5.5–6.0, where the browser history feature can be abused to execute arbitrary JavaScript in the context of a user session. An attacker can inject JavaScript into the URL, which is executed when the user clicks Back, allowing remote script exe...

CVE-2002-1757

PHProjekt 2.0–3.1 uses the $PHP_SELF variable for authentication, allowing remote attackers to bypass authentication for scripts via a PATH_INFO path (example: mail_send.php/sms). Affected: PHProjekt 2.0–3.1; Root cause: improper reliance on PATH_INFO in $PHP_SELF for auth. Impact: unauthorized a...

CVE-2002-1730

CVE-2002-1730 affects ASPjar Guestbook 1.00, where remote attackers can delete arbitrary messages by accessing the delete.asp administrative script with certain cookie values set to "true". The vulnerability is documented in the CVE entry and is referenced by NVD entries and CVE lists. The core i...

CVE-2002-1729

CVE-2002-1729 describes a cross-site scripting (XSS) vulnerability in ASPjar Guestbook 1.00. The flaw occurs in the guestbook message handling when the user-supplied parameter (the "web site" field) is not properly sanitized, allowing remote attackers to execute arbitrary script as other users. D...

CVE-2002-1679

CVE-2002-1679 is a cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 2.2.0 that allows remote attackers to execute arbitrary script as other users by injecting script into a bulletin board message. The provided connected documents confirm the affected product and version and describe ...

CVE-2002-1761

CVE-2002-1761 affects PHProjekt versions 2.0 through 3.1 and is a directory traversal vulnerability that allows remote attackers to read arbitrary files via .. sequences. The connected sources confirm the affected software and vulnerability class but do not provide exploitation details or explici...

CVE-2002-1744

The connected CVE records confirm a directory traversal in CodeBrws.asp for Microsoft IIS 5.0. The vulnerable component is CodeBrws.asp (IIS 5.0), with the underlying issue caused by a hex-encoded "+%c0%ae%c0%ae+" sequence representing ".." that allows remote attackers to view source code and det...

CVE-2002-1710

BasiliX Webmail 1.1.0 (or lower) contains an Arbitrary File Disclosure vulnerability in the attachment handling of Compose Mail. The PHP-based script accepts a list of attachment names from the client but does not verify that those attachments were actually uploaded, allowing an attacker to retri...

CVE-2002-1769

Microsoft Site Server 3.0 before SP4 has a default LDAP_Anonymous user with password LdapPassword_1, enabling remote attackers to log on locally with the Log on locally privilege. The vulnerability arises from setting a default account/password that grants local access, as documented in CVE-2002-...

CVE-2002-1734

NewsPro 1.01 is vulnerable: remote attackers can gain unauthorized administrator access by setting the authentication cookie to "logged,true". The described root cause is a cookie-based authentication bypass. The available documents do not provide deeper technical details such as affected compone...

CVE-2002-1667

CVE-2002-1667 concerns the FreeBSD virtual memory subsystem. Affected: FreeBSD 4.5-RELEASE and earlier. Description: during page invalidation, the VM subsystem does not properly verify the existence of a VM object, allowing local users to trigger a crash (DoS) by calling msync on an unaccessed me...

CVE-2002-1713

The CVE-2002-1713 issue affects Mandrake Linux 8.2, where the Standard security setting for the Mandrake-Security package (msec) installs home directories with world-readable permissions. This local-file-permission flaw could allow a local user to view other users’ files. The connected PT-2002-24...

CVE-2002-1715

Technical details about CVE-2002-1715 are not publicly available in the provided connected documents. The initial description notes local privilege escalation via a world-writable directory, but no vendor/version/patch specifics are present here; monitor for updates.

CVE-2002-1782

The CVE-2002-1782 entry concerns the University of Washington IMAP daemon (wu-imapd). In default configurations on systems that deny shell access, an authenticated IMAP user can read arbitrary files as that user. This is supported by multiple connected sources (OpenVAS/Nessus entries) describing ...

CVE-2002-1746

Affected software: Vtun 2.5b1. The CVE describes that remote attackers can inject data into user sessions by sniffing and replaying packets, enabling data injection into sessions. The provided documents do not specify a fix or patch version. No explicit exploitation details beyond the sniffing/re...

CVE-2002-1692

The CVE-2002-1692 entry describes a buffer overflow in the Windows 95 backup utility. A long filename extension placed in a folder to be backed up can allow an attacker to execute arbitrary code. The vulnerability affects the backup component of Windows 95; the root cause is improper handling of ...

CVE-2002-1753

csNewsPro.cgi in CGIScript.net csNews Professional (csNewsPro) is affected by CVE-2002-1753, allowing remote attackers to execute arbitrary Perl code through the setup parameter, which is processed by Perl eval. The vulnerability affects csNewsPro.cgi and is triggered via the setup parameter, ena...

CVE-2002-1768

Cisco IOS versions 11.1–12.2 are affected when HSRP support is not enabled. The issue allows an attacker to cause a denial of service (CPU consumption) by sending randomly sized UDP packets to the HSRP port 1985. The Nessus plugin CISCO-20020606-HSRP.NASL confirms this condition and notes that th...