CVE-2002-1337

CVE-2002-1337 affects Sendmail 5.79 through 8.12.7, with a buffer overflow in header processing (crackaddr in headers.c) that enables remote code execution, reported as a high-severity issue. Public advisories and patches exist across multiple vendors: HP-UX patches PHNE_35483/35484 (and related ...

CVE-2002-1371

CVE-2002-1371 affects Common Unix Printing System (CUPS) versions 1.1.14 to 1.1.17. The vulnerability stems from improper handling of zero-length GIF images in filters/image-gif.c, allowing a remote attacker to execute arbitrary code via modified chunk headers (e.g., nogif). Public advisories (De...

CVE-2002-1388

CVE-2002-1388 is a cross-site scripting vulnerability in MHonArc prior to 2.5.14 that lets remote attackers inject arbitrary HTML into web archive pages via HTML mail messages. The issue arises in the mhonarc HTML filter when processing HTML mail, enabling foreign scripting content in archives. D...

CVE-2002-1438

CVE-2002-1438 affects Novell NetWare 5.1/6 with Perl 5.003; the web handler discloses the Perl version via -v, causing information disclosure. The OpenVAS/Nessus entries describe broader NetWare Perl-related issues (code execution via HTTP POST) for 5.x/6.x, but the CVE itself is limited to versi...

CVE-2002-1147

HP Procurve 4000M Switch firmware prior to C.09.16 is affected by CVE-2002-1147. The HTTP management interface does not authenticate reset requests to the device_reset CGI, enabling a remote denial-of-service via a direct request. The issue is network-exposed and stems from unauthenticated reset ...

CVE-2002-1412

Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERYBASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script...

CVE-2002-1520

The CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, does not properly close the SSH connection when a -N option is provided during authentication, which allows remote attackers to access CLI with administrator privileges...

CVE-2002-1104

CVE-2002-1104 concerns Cisco VPN Client software (versions 2.x.x and 3.x prior to 3.0.5). The vulnerability allows remote attackers to trigger a denial of service (crash) by sending TCP packets with both source and destination ports equal to 137 (NETBIOS). The available description states the imp...

CVE-2002-1373

Signed integer vulnerability in the COMTABLEDUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service crash or hang in mysqld by causing large negative integers to be provided to a memcpy call...

CVE-2002-1367

CVE-2002-1367 affects Common Unix Printing System (CUPS) 1.1.14–1.1.17, allowing remote attackers to add printers without authentication via a UDP packet, enabling unauthorized actions such as stealing the local root certificate for the administration server (as demonstrated by new-coke). The Deb...

CVE-2002-1367

Common Unix Printing System CUPS 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need...

CVE-2002-1200

Balabit Syslog-NG is affected by CVE-2002-1200. Affected lines are syslog-ng 1.4.x before 1.4.15 and 1.5.x before 1.5.20. The issue arises from improper buffer size tracking during macro expansion when constant characters are appended to template filenames or output, leading to out-of-bounds writ...

CVE-2002-1200

Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute...

CVE-2002-0840

CVE-2002-0840 is a cross-site scripting (XSS) vulnerability in the default error page of Apache. It affects Apache 2.0 before 2.0.43 and 1.3.x up to 1.3.26, when UseCanonicalName is set to off and wildcard DNS is supported. An attacker can inject script via the Host header to execute in other vis...

CVE-2002-1317

The CVE-2002-1317 flaw affects the Solaris X Window Font Server (XFS) daemon fs.auto, where the Dispatch() function handles XFS queries. This remotely exploitable buffer overflow can allow an attacker to crash the service or execute arbitrary code with the fs.auto/Font Server privileges (typicall...

CVE-2002-1437

Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to read arbitrary files via an HTTP request containing "..%5c" URL-encoded dot-dot backslash sequences...

CVE-2002-0357

CVE-2002-0357 relates to a vulnerability in SGI IRIX’s rpc.passwd binary (part of nfs.sw.nis) on IRIX 6.5.x and earlier. The issue arises in the remote RPC service yppasswdd (100009) and is described in multiple records as a buffer overflow that could allow a local or remote attacker to gain root...

CVE-2002-1221

CVE-2002-1221 affects BIND 8.x through 8.3.3; remote attacker can cause a denial of service (crash) by sending SIG RR elements with invalid expiry times. The invalid entries are removed from the internal BIND database and can later trigger a null dereference. Debian and related advisories (DSA-19...

CVE-2002-1244

Format string vulnerability in Pablo FTP Server 1.5, 1.3, and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format strings in the USER command...

CVE-2002-1211

Prometheus 6.0 and earlier is vulnerable to remote PHP code execution via a tainted PROMETHEUS_LIBRARY_BASE that can be set to a remote server and loaded by index.php, install.php, or test_*.php. The underlying flaw is the conditional inclusion of files (autoload.lib, prometheus-lib.path) based o...