CVE-2002-0148

CVE-2002-0148 is a cross-site scripting vulnerability in Microsoft Internet Information Services (IIS) 4.0, 5.0 and 5.1 that allows remote attackers to execute arbitrary script as the affected user via an HTTP error page. Connected sources confirm this CSS/XSS issue is part of a broader set of II...

CVE-2002-0575

OpenSSH CVE-2002-0575 describes a buffer overflow in OpenSSH up to 2.9.8 and in the 3.x line up to 3.2.0 (with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled). This allows remote and local authenticated users to gain privileges. Root cause: insecure handling of memory lead...

CVE-2002-0845

CVE-2002-0845 affects Sun ONE / iPlanet Web Server 4.1 and 6.0. The vulnerability is a buffer overflow in the Chunked Encoding processing, allowing a remote attacker to execute arbitrary code via an HTTP request that uses chunked transfer encoding. Affected components are the web server’s HTTP pr...

CVE-2002-0382

Summary: CVE-2002-0382 affects the XChat IRC client. The issue arises when handling a /dns query, where the DNS reverse lookup can contain shell metacharacters, allowing arbitrary commands to be executed with the user’s privileges. This is caused by XChat passing the resolver/hostname to a shell ...

CVE-2002-0490

Technical details (affected component, vulnerable version, exploit specifics and remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2002-0006

Vulnerability summary (CVE-2002-0006) : XChat versions 1.8.7 and earlier (including default configurations of 1.4.2 and 1.4.3) are vulnerable. A remote attacker can execute arbitrary IRC commands as another client by sending specially encoded characters in a PRIVMSG that calls CTCP PING, which ca...

CVE-2002-1030

Technical details (affected components, root cause, impact, remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2002-0671

CVE-2002-0671 affects Pingtel xpressa SIP-based VoIP phones, versions 1.2.5–1.2.7.4. The issue arises when the device downloads applications from a web site without verifying their integrity, enabling remote attackers to install Trojan horse applications via DNS spoofing. The vulnerability is doc...

CVE-2002-1088

The CVE-2002-1088 entry is about a buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 that allows remote attackers to execute arbitrary code through a long RCPT TO command. Affected component: the GroupWise 6.0.1 SP1 environment; root cause described as a buffer overflow in handling RCPT TO...

CVE-2002-0914

Technical details (affected product/version, root cause, impact, fixes) are not publicly provided in the supplied documents. Please monitor for updates.

CVE-2002-0872

l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions...

CVE-2002-0647

CVE-2002-0647 is a buffer overflow in a legacy ActiveX control used to display specially formatted text in Microsoft Internet Explorer 5.01, 5.5, and 6.0, allowing remote code execution. The root cause is a vulnerability in the ActiveX control; affected products are IE versions listed. Impact is ...

CVE-2002-0178

The CVE-2002-0178 issue affects the uudecode utility in the GNU Sharutils package prior to version 4.2.1, which does not validate the destination filename against pipes or symbolic links. This can allow a local attacker to overwrite files or escalate privileges by decoding into sensitive or open ...

CVE-2002-0146

CVE-2002-0146 affects fetchmail prior to 5.9.10. The flaw arises when fetching mail over IMAP: fetchmail allocates an array for message sizes based on the server-reported message count but does not validate that count, allowing a remote IMAP server to cause memory overrun/out-of-bounds writes. Ma...

CVE-2002-1060

CVE-2002-1060 describes a cross-site scripting (XSS) vulnerability in Blue Coat Systems (CacheFlow) CacheOS affecting Client Accelerator 4.1.06, Security Gateway 2.1.02, and Server Accelerator 4.1.06. The issue allows remote attackers to inject arbitrary web script or HTML by crafting a URL to a ...

CVE-2002-0789

In mnogosearch, the vulnerable component is search.cgi and the q query parameter. CVE-2002-0789 describes a buffer overflow in mnoGoSearch 3.1.19 and earlier that allows remote code execution with the webserver’s privileges. A fix is available in the 3.1.21 release referenced by the Conectiva adv...

CVE-2002-0945

CVE-2002-0945 describes a buffer overflow in SeaNox Devwex that can be triggered by a long HTTP GET request, allowing remote attackers to cause a denial of service and potentially execute arbitrary code. The available connected sources corroborate the basic impact (DoS and potential code executio...

CVE-2002-0650

CVE-2002-0650 affects Microsoft SQL Server 2000’s Resolution Service on UDP port 1434. A forged ping from one server to another (both using 1434) can trigger the Resolution Service to exchange referrals/pings in an infinite loop, causing a denial of service (bandwidth/resource exhaustion) between...

CVE-2002-0493

CVE-2002-0493 affects Apache Tomcat where the web.xml parsing could proceed with errors and allow Tomcat to start with improper security settings, bypassing intended access restrictions. Affected component: Tomcat startup/security settings during web.xml read. Root cause described across sources ...

CVE-2002-0698

The CVE-2002-0698 entry describes a buffer overflow in Internet Mail Connector (IMC) of Microsoft Exchange Server 5.5 triggered by an EHLO response to a long hostname. OpenVAS/Nessus entries confirm an unchecked buffer in IMC’s EHLO handling that could allow code execution in the IMC service cont...