CVE-2002-0546

CVE-2002-0546: In the Winamp mini-browser (versions 2.78 and 2.79), the HTML/JS execution vulnerability is triggered by crafted ID3v1/ID3v2 tags in MP3 files, allowing remote script execution. The root cause is cross-site scripting within the mini-browser component when processing MP3 metadata. E...

CVE-2002-1323

Safe.pm 2.0.7 and earlier, when used in Perl 5.8.0 and earlier, may allow attackers to break out of safe compartments in 1 Safe::reval or 2 Safe::rdo using a redefined @ variable, which is not reset between successive calls...

CVE-2002-1311

Courier sqwebmail before 0.40.0 does not quickly drop privileges after startup in certain cases, which could allow local users to read arbitrary files...

CVE-2002-1311

CVE-2002-1311 affects Courier sqwebmail prior to 0.40.0, where the process does not promptly drop privileges after startup in certain scenarios, potentially enabling local users to read arbitrary files. Public sources (NVD, Debian DSA-197, OSV, OpenVAS) corroborate a local-privilege-usage vector ...

CVE-2002-1313

Summary: CVE-2002-1313 affects nullmailer 1.00RC5 and earlier. When an email is delivered to a local user that does not exist, nullmailer encounters a local error and stops delivering mail for all users, causing a denial of service. This is a local-privilege-relevant impact vector (local access r...

CVE-2002-1478

CVE-2002-1478 affects Cacti prior to 0.6.8. The issue allows an attacker to execute arbitrary commands via the Data Input option in console mode, due to the underlying handling of input. The vulnerability is documented with a high impact (CVSS v2 base score 10.0; confidentiality, integrity, and a...

CVE-2002-1325

CVE-2002-1325 affects Microsoft Virtual Machine (VM) versions up to build 5.0.3805. A Java applet that accesses the user.dir system property can disclose the local user’s username to a remote attacker, via a crafted page or email. CERT notes the vulnerability could leak the user’s system path and...

CVE-2002-1244

Pablo FTP Server (versions 1.3 and 1.5, and possibly others) is affected by a format string vulnerability in the USER command due to incorrect handling of format string markers in user input. This can allow a remote attacker to cause a denial of service and, potentially, execute arbitrary code. T...

CVE-2002-1278

The mailconf module in Linuxconf 1.24, and other versions before 1.28, on Conectiva Linux 6.0 through 8, and possibly other distributions, generates the Sendmail configuration file sendmail.cf in a way that configures Sendmail to run as an open mail relay, which allows remote attackers to send Sp...

CVE-2002-1272

Alcatel OmniSwitch 7700/7800 with AOS 5.1.1 contains a backdoor Telnet server on TCP 6778 that was left in code from development, allowing remote privileged access. Affected devices can be compromised to gain full admin control. Remediation per CERT/vendor guidance: upgrade to AOS 5.1.1.R02 or 5....

CVE-2002-1493

Cross-site scripting XSS vulnerability in Lycos HTMLGear guestbook allows remote attackers to inject arbitrary script via 1 STYLE attributes or 2 SRC attributes in an IMG tag...

CVE-2002-1189

The CVE-2002-1189 issue affects Cisco Unity 2.x and 3.x where default configuration fails to block international operator calls in predefined restriction tables, enabling authenticated users to place international calls via call forwarding. The root cause is the misconfiguration of restrictions r...

CVE-2002-0729

Microsoft SQL Server 2000 allows remote attackers to cause a denial of service via a malformed 0x08 packet that is missing a colon separator...

CVE-2002-1267

Mac OS X 10.2.2 allows remote attackers to cause a denial of service by accessing the CUPS Printing Web Administration utility, aka "CUPS Printing Web Administration is Remotely Accessible."...

CVE-2002-1223

Buffer overflow in DSC 3.0 parser from GSview, as used in KGhostView in KDE 1.1 and KDE 3.0.3a, may allow attackers to cause a denial of service or execute arbitrary code via a modified .ps PostScript input file...

CVE-2002-1435

CVE-2002-1435 affects Achievo 0.7.0 through 0.9.1, excluding 0.8.2. The issue allows remote PHP code execution when allow_url_fopen is enabled and a URL in the config_atkroot parameter points to attacker-controlled code. This is a remote file inclusion vulnerability; affected component is a PHP s...

CVE-2002-1443

The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler...

CVE-2002-0974

Help and Support Center for Windows XP allows remote attackers to delete arbitrary files via a link to the hcp: protocol that accesses uplddrvinfo.htm...

CVE-2002-1574

Buffer overflow in the ixj telephony card driver in Linux before 2.4.20 has unknown impact and attack vectors...

CVE-2002-1117

Veritas Backup Exec 8.5 and earlier requires that the "RestrictAnonymous" registry key for Microsoft Exchange 2000 must be set to 0, which enables anonymous listing of the SAM database and shares...