CVE-2002-1412

Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERYBASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script...

CVE-2002-1520

The CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, does not properly close the SSH connection when a -N option is provided during authentication, which allows remote attackers to access CLI with administrator privileges...

CVE-2002-1104

CVE-2002-1104 concerns Cisco VPN Client software (versions 2.x.x and 3.x prior to 3.0.5). The vulnerability allows remote attackers to trigger a denial of service (crash) by sending TCP packets with both source and destination ports equal to 137 (NETBIOS). The available description states the imp...

CVE-2002-1373

Signed integer vulnerability in the COMTABLEDUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service crash or hang in mysqld by causing large negative integers to be provided to a memcpy call...

CVE-2002-1367

CVE-2002-1367 affects Common Unix Printing System (CUPS) 1.1.14–1.1.17, allowing remote attackers to add printers without authentication via a UDP packet, enabling unauthorized actions such as stealing the local root certificate for the administration server (as demonstrated by new-coke). The Deb...

CVE-2002-1367

Common Unix Printing System CUPS 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need...

CVE-2002-1200

Balabit Syslog-NG is affected by CVE-2002-1200. Affected lines are syslog-ng 1.4.x before 1.4.15 and 1.5.x before 1.5.20. The issue arises from improper buffer size tracking during macro expansion when constant characters are appended to template filenames or output, leading to out-of-bounds writ...

CVE-2002-1200

Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute...

CVE-2002-0840

CVE-2002-0840 is a cross-site scripting (XSS) vulnerability in the default error page of Apache. It affects Apache 2.0 before 2.0.43 and 1.3.x up to 1.3.26, when UseCanonicalName is set to off and wildcard DNS is supported. An attacker can inject script via the Host header to execute in other vis...

CVE-2002-1317

The CVE-2002-1317 flaw affects the Solaris X Window Font Server (XFS) daemon fs.auto, where the Dispatch() function handles XFS queries. This remotely exploitable buffer overflow can allow an attacker to crash the service or execute arbitrary code with the fs.auto/Font Server privileges (typicall...

CVE-2002-1437

Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to read arbitrary files via an HTTP request containing "..%5c" URL-encoded dot-dot backslash sequences...

CVE-2002-0357

CVE-2002-0357 relates to a vulnerability in SGI IRIX’s rpc.passwd binary (part of nfs.sw.nis) on IRIX 6.5.x and earlier. The issue arises in the remote RPC service yppasswdd (100009) and is described in multiple records as a buffer overflow that could allow a local or remote attacker to gain root...

CVE-2002-1221

CVE-2002-1221 affects BIND 8.x through 8.3.3; remote attacker can cause a denial of service (crash) by sending SIG RR elements with invalid expiry times. The invalid entries are removed from the internal BIND database and can later trigger a null dereference. Debian and related advisories (DSA-19...

CVE-2002-1244

Format string vulnerability in Pablo FTP Server 1.5, 1.3, and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format strings in the USER command...

CVE-2002-1211

Prometheus 6.0 and earlier is vulnerable to remote PHP code execution via a tainted PROMETHEUS_LIBRARY_BASE that can be set to a remote server and loaded by index.php, install.php, or test_*.php. The underlying flaw is the conditional inclusion of files (autoload.lib, prometheus-lib.path) based o...

CVE-2002-1364

CVE-2002-1364 describes a buffer overflow in traceroute-nanog’s get_origin() function triggered by long WHOIS responses. This leads to arbitrary code execution and potential privilege escalation on affected systems. Public advisories (Debian DSA-254-1) note the issue was fixed in traceroute-nanog...

CVE-2002-1267

CVE-2002-1267 : The provided documents describe a vulnerability in Mac OS X 10.2.2 where remote attackers can cause a denial of service by accessing the CUPS Printing Web Administration utility (CUPS Printing Web Administration is Remotely Accessible). The description does not specify the underly...

CVE-2002-1135

modsecurity.php 1.10 and earlier, in phpWebSite 0.8.2 and earlier, allows remote attackers to execute arbitrary PHP source code via an incprefix parameter that points to the malicious code...

CVE-2002-1375

CVE-2002-1375 affects MySQL 3.x before 3.23.54 and 4.x up to 4.0.6, where the COM_CHANGE_USER command can be exploited by remote attackers to execute arbitrary code via a long response. The underlying issue is triggered during authentication/response handling in the COM_CHANGE_USER flow, enabling...

CVE-2002-1373

CVE-2002-1373 is a signed-integer vulnerability in the COM_TABLE_DUMP package of MySQL 3.x to 3.23.53a, allowing remote attackers to cause a denial of service (crash/hang) by supplying large negative integers to a memcpy call. Public fixes upgrade to MySQL 3.23.54a (and related 3.23.54a/4.x fixes...