CVE-2002-0385

Vignette Story Server (versions 4.1 and 6.0) is affected. A flaw in the TCL interpreter when processing dynamic pages allows a remote attacker to cause the interpreter to crash and disclose stack data, effectively exposing sensitive information such as other users’ sessions and server-side code. ...

CVE-2002-1577

SAP R/3 2.0B to 4.6D installs several clients with default users and passwords, which allows remote attackers to gain privileges via the 1 SAP, 2 SAPCPIC, 3 DDIC, 4 EARLYWATCH, or 5 TMSADM accounts...

CVE-2004-0121

Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs...

Ultimate PHP Board add.php Direct Request Information Disclosure

The remote host is running Ultimate PHP Board UPB. There is a flaw in this version that could allow an attacker to view private message board information. %NASLMINLEVEL 70300 This script was written by Erik Stephens See the Nessus Scripts License for details Changes by Tenable: - Revised plugin...

No title provided for SECURITYVULNS:DOC:5999

продукт: WEB//NEWS Personal Newsmanagement - 2002-2004 производитель: Christian Scheb сайт: Stylemotion.de Возможность удаленного выполнения команд каталог modules. файл startup.php ........................... / MODULES LOAD / require$DIR."/modules/config.inc.php";...

CVE-2004-0284

Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service CPU consumption, if "Do not save encrypted pages to disk" is disabled, via a web site or HTML e-mail that contains two null characters %00 after the host name...

CVE-2002-1576

lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program...

CVE-2002-1577

SAP R/3 2.0B to 4.6D installs several clients with default users and passwords, which allows remote attackers to gain privileges via the 1 SAP, 2 SAPCPIC, 3 DDIC, 4 EARLYWATCH, or 5 TMSADM accounts...

CVE-2002-1576

Summary: SAP DB 7.3 and earlier versions contain a local privilege escalation in the lserver component. The lserver uses the current working directory to locate and execute the lserversrv program. If a directory contains a symlink to the lserver executable and a malicious lserversrv is placed the...

CVE-2002-1578

The CVE-2002-1578 detail: default SAP R/3 installation, when used with Oracle and SQLNet V2 3.x–6.10, allows remote attackers to obtain arbitrary SAP data by directly connecting to the Oracle database and executing queries, due to the database not being password-protected. The vulnerability affec...

CVE-2002-1577

CVE-2002-1577 concerns SAP R/3 versions 2.0B to 4.6D, where multiple clients are installed with default user accounts and passwords. The underlying issue is insecure default credentials that allow remote attackers to gain privileges via accounts such as SAP*, SAPCPIC, DDIC, EARLYWATCH, and TMSADM...

NAV bugs!

Subject: NAV bugs! Published: Friday, 05 March, 2004 Updated: 06-Mar-04 Discovered By: Bipin Gautam hUNT3R Product Version: Norton Antivirus 2002 ver: 8.00.58 Only tested On... Risk Impact: Low-Medium Details: During a 'manual scan' of a folder, if Norton Antivirus NAV encounters a file /folder...

CVE-2002-1575

cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline %0a characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message...

CVE-2002-1575

cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline %0a characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message...

CVE-2002-0712

Entrust Authority Security Manager EASM 6.0 does not properly require multiple master users to change the password of a master user, which could allow a master user to perform operations that require multiple authorizations...

CVE-2002-0034

The CVE-2002-0034 issue concerns Microsoft CONVERT.EXE on Windows 2000/XP when converting FAT32 to NTFS. The vulnerability arises because default NTFS permissions are not applied during conversion, potentially producing a filesystem with less secure permissions than expected. Public sources (NVD/...

CVE-2003-1251

The 1 menu.inc.php, 2 datasets.php and 3 massoperations.inc.php mistakenly referred to as massopeations.inc.php scripts in N/X 2002 allow remote attackers to execute arbitrary PHP code via a cpath that references a URL on a remote web server that contains the code...

Low: Red Hat Security Advisory: wget security update

Updated wget packages that correct a buffer overrun are now available. GNU Wget is a file-retrieval utility that uses the HTTP and FTP protocols. A buffer overflow in the urlfilename function for wget 1.8.1 allows attackers to cause a segmentation fault via a long URL. Red Hat does not believe th...

CVE-2002-1569

gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for 1 a PDF file or 2 a gzip file...

CVE-2002-1570

Heap-based buffer overflow in snmpnetstat for ucd-snmp 4.2.3 and earlier, and net-snmp, allows remote attackers to execute arbitrary code via multiple getnextrequest PDU messages with conflicting ifindex variables, which cause snmpnetstat to write variable data past the end of an array...