CVE-2002-1361

overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP Security Hardening Patch installed allows remote attackers to execute arbitrary code via a POST request with shell metacharacters in the email parameter...

CVE-2002-1534

Macromedia Flash Player contains a vulnerability where a remote attacker can read arbitrary files by manipulating XML script inside a .swf hosted on a remote SMB share. The issue arises from how the SWF processes XML data from an SMB-based source, enabling file read access without local interacti...

CVE-2002-1407

Summary of CVE-2002-1407 : TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA–signed certificate, which enables a remote attacker to perform a man-in-the-middle attack to spoof certificates of trusted sites. The provided documents describe the affected software,...

CVE-2002-1349

Summary: CVE-2002-1349 describes a local buffer overflow in Trend Micro PC-cillin’s pop3trap.exe, affecting PC-cillin 2000, 2002, and 2003. The vulnerability arises from a long input string to TCP port 110 (POP3) in the local POP3 proxy, allowing a local attacker to execute arbitrary code with th...

CVE-2002-0990

Technical details about CVE-2002-0990 are not publicly available in the provided documents. The description notes a DoS via DNS timeouts in Symantec gateway/firewall products, but no affected versions, exploit status, or mitigations are disclosed here. Monitor for updates.

CVE-2002-1105

Cisco Virtual Private Network VPN Client software 2.x.x, and 3.x before 3.5.1C, allows local users to use a utility program to obtain the group password...

CVE-2002-1443

CVE-2002-1443 affects Google Toolbar 1.1.58 and earlier. The vulnerability arises from an onkeydown event handler that allows remote websites to monitor a user’s input in the toolbar. The provided documents identify the affected product and the root cause (the event handler) and state the impact ...

CVE-2002-0990

The web proxy component in Symantec Enterprise Firewall SEF 6.5.2 through 7.0, Raptor Firewall 6.5 and 6.5.3, VelociRaptor, and Symantec Gateway Security allow remote attackers to cause a denial of service connection resource exhaustion via multiple connection requests to domains whose DNS server...

CVE-2002-1472

CVE-2002-1472 describes an untrusted search path vulnerability in XFree86’s libX11.so used by setuid/setgid programs. A local attacker can leverage a modified LD_PRELOAD to point to a malicious module and gain root privileges; impact is local privilege escalation. The vulnerability is associated ...

CVE-2002-1224

Directory traversal vulnerability in kpf for KDE 3.0.1 through KDE 3.0.3a allows remote attackers to read arbitrary files as the kpf user via a URL with a modified icon parameter...

CVE-2002-1550

dumpsmutil.sh in IBM AIX allows local users to overwrite arbitrary files via a symlink attack on temporary files...

CVE-2002-1112

CVE-2002-1112 : Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie used on the View Bugs page. Supported details indicate the issue affects Mantis versions up to 0.17.4; Debian advisories note fixes in 0.17.4a-2. No exploitation specif...

CVE-2002-0985

CVE-2002-0985 : Argument injection vulnerability in PHP 4.x mail() up to 4.2.2 may bypass safe_mode and alter the MTA command-line arguments (e.g., the 5th argument), potentially changing MTA behavior and enabling command execution. OpenVAS and Debian advisories confirm the issue affects PHP4.x a...

CVE-2002-1227

PAM 0.76 treats a disabled password as if it were an empty null password, which allows local and remote attackers to gain privileges as disabled users...

CVE-2002-0696

CVE-2002-0696 affects Microsoft Visual FoxPro 6.0. The issue arises because Visual FoxPro 6.0 does not register its associated files with Internet Explorer, enabling remote attackers to execute Visual FoxPro applications via HTML that references specially crafted filenames. This can allow code ex...

CVE-2002-0969

CVE-2002-0969 : A buffer overflow in the MySQL daemon (mysqld) on Win32 allows local code execution via a long datadir parameter in my.ini, when ACLs grant Full Control to Everyone. Affected: MySQL 3.23.x before 3.23.50 and 4.0 beta before 4.0.2. Root cause: overflow in handling the datadir value...

CVE-2002-1138

CVE-2002-1138 affects Microsoft SQL Server 7.0 and 2000, including MSDE 1.0 and MSDE 2000. The flaw is in Output File Handling for Scheduled Jobs: these components write output files for scheduled jobs under the SQL Server service account rather than the launching entity. This privilege mismatch ...

CVE-2002-1188

CVE-2002-1188 affects Microsoft Internet Explorer 5.01–6.0. The vulnerability arises from uses of the OBJECT tag that are not subjected to proper security checks, enabling remote attackers to disclose information by identifying the path to the Temporary Internet Files folder and accessing user da...

CVE-2002-1250

CVE-2002-1250 describes a buffer overflow in Abuse 2.00 and earlier that allows local users to gain root privileges via a long -net command line argument. The entry identifies the affected software/versions and the root cause (buffer overflow due to an argument length). The provided documents do ...

CVE-2002-1447

The CVE-2002-1447 issue affects the UNIX VPN Client’s vpnclient executable. A buffer overflow is triggered by a long profile name in the connect argument, allowing local users to obtain administrative privileges. Affected product/version is VPN Client prior to 3.5.2. Remediation: upgrade to versi...