CVE-2002-1116

The CVE-2002-1116 issue affects Mantis: the View Bugs page (view_all_bug_page.php) in Mantis 0.17.4a and earlier exposes summaries of private bugs to users with no project access, potentially leaking private project information. Technical detail from connected sources confirms vulnerable software...

CVE-2002-0836

dvips converter for Postscript files in the tetex package calls the system function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts...

CVE-2002-1157

CVE-2002-1157 describes a Cross-site scripting vulnerability in the Apache mod_ssl module (versions 2.8.9 and earlier). The issue occurs when UseCanonicalName is Off and wildcard DNS is enabled, allowing a remote attacker to cause the server name in an HTTPS response to be used in a self-referenc...

CVE-2002-1111

CVE-2002-1111 affects Mantis (print_all_bug_page.php) in versions 0.17.3 and earlier where limit_reporters is not enforced, allowing remote attackers to view bug summaries for bugs they should not see. The Debian advisory for DSA-153-1 states the issue, including the specific vulnerability in the...

CVE-2002-0662

CVE-2002-0662 affects ScrollKeeper 0.3 to 0.3.11. The vulnerability is due to insecure temporary file creation in /tmp by the scrollkeeper-get-cl program, enabling a local attacker to create or overwrite files via a symlink-like attack on scrollkeeper-tempfile.x. Debian advisories note the issue ...

CVE-2002-1151

CVE-2002-1151 affects Konqueror in KDE 2.2.2 and 3.0–3.0.3, where Konqueror’s cross-site scripting protection fails to correctly initialize domains on sub-frames/sub-iframes. This can allow remote attackers to run script and steal cookies from subframes that are in other domains. The issue is tie...

CVE-2002-1245

Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, which allows local users to modify /dev/mem and gain privileges via a modified PATH environment variable that points to a Trojan horse gzip program...

CVE-2002-1362

mICQ 0.4.9 and earlier allows remote attackers to cause a denial of service crash via malformed ICQ message types without a 0xFE separator character...

CVE-2002-1403

CVE-2002-1403 affects the dhcpcd DHCP client daemon up to version 1.3.22. The vulnerability arises from how quotes in the DHCP server’s options are processed, allowing a local user to cause an arbitrary command to execute via shell metacharacters fed from a dhcpd .info script into a .exe script. ...

CVE-2002-1097

Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.2, allows restricted administrators to obtain certificate passwords that are stored in plaintext in the HTML source code for Certificate Management pages...

CVE-2002-1468

CVE-2002-1468 describes a buffer overflow in errpt on AIX 4.3.3 that allows local users to execute arbitrary code as root. Affected product: AIX 4.3.3. Impact: local privilege escalation to root. The connected documents provide the vulnerability description but do not include exploit details or a...

CVE-2002-1389

CVE-2002-1389 describes a buffer overflow in typespeed versions 0.4.2 and earlier that lets a local user gain privileges via long input. The Debian advisory DSA-217-1 notes a fix; OpenVAS/NVD entries corroborate a local-privilege escalation issue caused by overflowing a buffer. The available conn...

CVE-2002-1284

Technical details, affected versions, and exact impact are not publicly provided in the available documents. Monitor for updates from official advisories to obtain concrete information.

CVE-2002-1236

The CVE-2002-1236 issue affects Linksys BEFSR41 EtherFast Cable/DSL Router. Affected component: the remote web management CGI script Gozila.cgi. Root cause: when Gozila.cgi is accessed with no arguments, the router crashes, causing a denial of service. Impact: partial availability loss of the dev...

CVE-2002-1132

CVE-2002-1132 affects SquirrelMail 1.2.7 and earlier. A malformed optpage argument can cause an error message that reveals the absolute pathname of options.php, exposing information about the script. The issue is documented under CAN-2002-1131 and CAN-2002-1132; Debian advisories DSA-191-1/191-2 ...

CVE-2002-1111

printallbugpage.php in Mantis 0.17.3 and earlier does not verify the limitreporters option, which allows remote attackers to view bug summaries for bugs that would otherwise be restricted...

CVE-2002-1244

Pablo FTP Server (versions 1.3 and 1.5, and possibly others) is affected by a format string vulnerability in the USER command due to incorrect handling of format string markers in user input. This can allow a remote attacker to cause a denial of service and, potentially, execute arbitrary code. T...

CVE-2002-0668

The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to modify the Call Forwarding settings and hijack calls...

CVE-2002-0842

CVE-2002-0842 is a format-string vulnerability in Oracle’s mod_dav extension (used for logging gateway errors) that could enable remote code execution via a crafted destination URI triggering a 502 Bad Gateway. The vulnerability affects Oracle9i Application Server 9.0.2 (and related mod_dav code ...

CVE-2002-1385

Open WebMail vulnerability CVE-2002-1385 affects Open WebMail ≤ 1.81. Local users can trigger arbitrary code execution by supplying dot-dot sequences in a login name (e.g., in the sessionid parameter for openwebmail-abook.pl), which is used to locate a configuration file that can specify addition...