CVE-2002-1119

CVE-2002-1119 affects Python (os._execvpe in os.py) in Python 2.2.1 and earlier, where temporary files are created with predictable names, enabling local users to execute arbitrary code via a symlink attack. Connected sources (Debian DSAs and Red Hat/Mandrake/Nessus entries) confirm the insecure ...

CVE-2002-1157

CVE-2002-1157 describes a Cross-site scripting vulnerability in the Apache mod_ssl module (versions 2.8.9 and earlier). The issue occurs when UseCanonicalName is Off and wildcard DNS is enabled, allowing a remote attacker to cause the server name in an HTTPS response to be used in a self-referenc...

CVE-2002-1363

CVE-2002-1363 affects libpng 1.2.5 and earlier, where incorrect offset calculations in the PNG library can cause a remote crash and potentially arbitrary code execution via a buffer overflow in row buffers. The vulnerability is evidenced in multiple advisories (Red Hat RHSA, Debian DSA) and is re...

CVE-2002-1112

CVE-2002-1112 : Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie used on the View Bugs page. Supported details indicate the issue affects Mantis versions up to 0.17.4; Debian advisories note fixes in 0.17.4a-2. No exploitation specif...

CVE-2002-1405

The CVE-2002-1405 issue affects Lynx 2.8.4 and earlier and describes a CRLF injection flaw that lets an attacker add extra HTTP headers via a URL containing encoded CR/LF characters on the command line. Public advisories (Debian DSA-210, RHSA-2003:030, RHSA-2003:030) indicate that updated Lynx pa...

CVE-2002-1390

CVE-2002-1390 concerns the GeneWeb daemon (before version 4.09), where improper handling of requested paths enables a remote attacker to read arbitrary files via a crafted URL. The issue is documented in the Debian DSA-223 advisory (and mirrored OpenVAS/NVD records). Mitigation per connected sour...

CVE-2002-0384

CVE-2002-0384 stems from a buffer overflow in the Jabber plug-in of the Gaim client, affecting versions prior to 0.58. The issue enables remote code execution by an attacker via the Jabber plug-in. Public advisories (e.g., RHSA-2002:122) advise updating to 0.59 (or later), which is no longer vuln...

CVE-2002-1367

CVE-2002-1367 affects Common Unix Printing System (CUPS) 1.1.14–1.1.17, allowing remote attackers to add printers without authentication via a UDP packet, enabling unauthorized actions such as stealing the local root certificate for the administration server (as demonstrated by new-coke). The Deb...

CVE-2002-1095

The vulnerability CVE-2002-1095 affects Cisco VPN 3000 Concentrator firmware prior to 2.5.2(F). When encryption is enabled, a remote attacker using a Windows PPTP client with the No Encryption option can trigger a denial of service (reload). The description does not provide additional root-cause ...

CVE-2002-1271

CVE-2002-1271 affects the Mail::Mailer component of the perl-MailTools package (versions

CVE-2002-1543

CVE-2002-1543 describes a buffer overflow in the trek component on NetBSD 1.5–1.5.3 that allows local users to gain privileges via long keyboard input. The underlying issue is a buffer overflow in trek’s handling of user input, enabling privilege escalation. Documented impact is local privilege e...

CVE-2002-1111

CVE-2002-1111 affects Mantis (print_all_bug_page.php) in versions 0.17.3 and earlier where limit_reporters is not enforced, allowing remote attackers to view bug summaries for bugs they should not see. The Debian advisory for DSA-153-1 states the issue, including the specific vulnerability in the...

CVE-2002-0615

CVE-2002-0615 affects Windows Media Player 7.1 (and related Media Player versions) where the Windows Media Active Playlist stores data in a well-known local file path, enabling HTML script execution in the Local Computer zone. Connected documentation also references MS02-032 (patch 320920) that f...

CVE-2002-1244

Pablo FTP Server (versions 1.3 and 1.5, and possibly others) is affected by a format string vulnerability in the USER command due to incorrect handling of format string markers in user input. This can allow a remote attacker to cause a denial of service and, potentially, execute arbitrary code. T...

CVE-2002-1188

CVE-2002-1188 affects Microsoft Internet Explorer 5.01–6.0. The vulnerability arises from uses of the OBJECT tag that are not subjected to proper security checks, enabling remote attackers to disclose information by identifying the path to the Temporary Internet Files folder and accessing user da...

CVE-2002-1392

The CVE-2002-1392 issue affects mgetty before 1.1.29, where the faxspool directory is world-writable, allowing local users to modify fax transmission privileges. Public advisories (e.g., RHSA-2003:008 and RHSA-2003:036) document a fixed upgrade path to mgetty 1.1.30 to resolve both the buffer-ove...

CVE-2002-1560

CVE-2002-1560 affects gBook 1.4, where an issue in index.php allows remote attackers to bypass authentication and gain administrative privileges by setting the login parameter to true. The available documents describe the flaw as an authentication bypass with full admin access, but they do not pr...

CVE-2002-1104

CVE-2002-1104 concerns Cisco VPN Client software (versions 2.x.x and 3.x prior to 3.0.5). The vulnerability allows remote attackers to trigger a denial of service (crash) by sending TCP packets with both source and destination ports equal to 137 (NETBIOS). The available description states the imp...

CVE-2002-1097

Cisco VPN 3000 Concentrator is affected (versions 2.2.x and 3.x before 3.5.2). The issue is that certificate passwords are stored in plaintext in the HTML source of Certificate Management pages, allowing restricted administrators to access them. The documented fix is upgrading to 3.5.2 or later. ...

CVE-2002-1141

The CVE-2002-1141 issue is a vulnerability in the Sun Microsystems RPC library Services for Unix 3.0 Interix SD, executed on Windows NT4/2000/XP. It stems from an input validation error that can be exploited by malformed fragmented RPC client packets, enabling a remote denial of service. The docu...