CVE-2002-1852

CVE-2002-1852 describes a cross-site scripting (XSS) vulnerability in Monkey 0.5.0. The issue allows remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) a parameter to test2.pl. Connected documents confirm the affected product and the general impact, but do not provide ...

CVE-2002-1850

The CVE-2002-1850 issue affects Apache’s mod_cgi in versions 2.0.39 and 2.0.40. A CGI script that writes a large amount of data to stderr can trigger a read/write deadlock between httpd and the CGI script, allowing local users and possibly remote attackers to cause a denial of service (hang and m...

CVE-2002-1880

LokwaBB 1.2.2 contains a vulnerability where remote attackers can read arbitrary messages by modifying the pmid parameter in pm.php. The affected component is the web application logic handling pmid values; concrete root cause is improper handling/validation of the pmid input that leads to unauth...

CVE-2002-1788

CVE-2002-1788 affects nn (NN) versions 6.6.0–6.6.3, where the nn_exitmsg function is vulnerable to a format-string issue that can let remote NNTP servers cause arbitrary code execution via crafted server responses. The available documents confirm the vulnerability but do not provide exploit code,...

CVE-2002-1815

CVE-2002-1815 affects Aquonics File Manager 1.5, with a directory traversal flaw in source.php and source.cgi that enables reading arbitrary files via a .. path segment in the URL. Impact details and exploit specifics are not further described in the provided documents beyond this vulnerability d...

CVE-2002-1802

XSS vulnerability CVE-2002-1802 affects XOOPS 1.0 RC3. The flaw allows remote attackers to inject arbitrary script/HTML via Javascript in an IMG tag when submitting news, due to insufficient input sanitization in the news submission workflow. Impact is Cross‑Site Scripting; no exploit vectors or ...

CVE-2002-1866

The CVE-2002-1866 issue affects Simple Web Server (SWS) versions 0.0.4 through 0.1.0. The underlying root cause is that the server does not close file descriptors for 404 error responses, which can lead to resource exhaustion (denial of service) when an attacker issues numerous requests for non-e...

CVE-2002-1920

CVE-2002-1920 affects FtpXQ 2.5, where a buffer overflow in the MKD command with a long directory name can cause a denial of service (crash). The connected Red Hat entry and CVE records confirm the same description; exploitation details, affected versions beyond 2.5, and available mitigations are...

CVE-2002-1805

CVE-2002-1805 is a cross-site scripting (XSS) vulnerability in DaCode 1.2.0 . The flaw allows remote attackers to inject arbitrary JavaScript or HTML by supplying specially crafted content in an IMG tag . Affected product: DaCode 1.2.0. Root cause: improper handling of image tag content enabling ...

CVE-2002-1962

Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL with an IP address instead of a hostname...

CVE-2002-1881

Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service web browser crash via malformed content in a Flash Shockwave .SWF file, as demonstrated by by ROT13 encoding the body of the file but not the headers...

CVE-2002-1900

Cross-site scripting XSS vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists...

CVE-2002-1820

register.php in Ultimate PHP Board UPB 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a."...

CVE-2002-1784

CVE-2002-1784 affects HP Tru64 UNIX: inetd in versions 4.0f through 5.1a is reported to allow remote denial of service via unknown attack vectors. The Red Hat entry and other records confirm the same vulnerability description, but no concrete root cause, exploit details, or official patch/version...

CVE-2002-1905

CVE-2002-1905 describes a buffer overflow in the Polycom ViaVideo web server (versions 2.2 and 3.0) that can be triggered by a long HTTP GET request, leading to remote denial of service (crash). Affected software: Polycom ViaVideo web server (2.2, 3.0). Root cause: improper handling of long HTTP ...

CVE-2002-1984

Microsoft Internet Explorer 5.0.1–6.0 on Windows 2000/XP is vulnerable to a denial of service via a crafted OBJECT tag with CLSID:00022613-0000-0000-C000-000000000046. The issue, described across multiple sources (NVD, Red Hat, CVE records), places the root cause in how the CLSID is processed wit...

CVE-2002-1935

Pingtel Xpressa versions 1.2.5 through 2.0.1 are affected by CVE-2002-1935 due to predictable Call-ID, CSeq, and To/From SIP URL values in SIP requests, which can let remote attackers avoid registering with the SIP registrar. The root cause is the lack of randomness in SIP identifiers, enabling a...

CVE-2002-1807

The CVE-2002-1807 entry describes a Cross-site Scripting (XSS) vulnerability in phpWebSite version 0.8.3 that allows remote attackers to inject arbitrary web script or HTML through Javascript in an IMG tag. The affected software is phpWebSite 0.8.3; the underlying cause is an XSS flaw in handling...

CVE-2002-1958

CVE-2002-1958 describes a Cross-site scripting vulnerability in kmMail 1.0, 1.0a, and 1.0b. The issue allows remote attackers to inject arbitrary web script or HTML through (a) javascript in onmouseover or other attributes in broadly “safe” HTML tags (e.g., the b tag), and (b) the Subject field. ...

CVE-2002-1809

CVE-2002-1809 affects Windows binaries of MySQL 3.23.2–3.23.52 where the root password is NULL/blank by default. Public sources in the connected documents describe that the default configuration can permit remote attackers to gain unauthorized root access to the MySQL database (e.g., with default...