CVE-2002-0032

Yahoo! Messenger 5.0.0.1064 and earlier is vulnerable to remote arbitrary-script execution via the addview parameter of the ymsgr URI. The issue stems from Yahoo! Messenger URI handling, allowing an attacker to run code with the victim’s privileges. The advisory/references indicate remediation by...

CVE-2002-0414

Affected software: KAME-derived IPsec implementations on NetBSD 1.5.2, FreeBSD 4.5, and other OSes. Vulnerability: the implementation does not properly consult the Security Policy Database (SPD), which can allow a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to for...

CVE-2002-0155

Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX...

CVE-2002-0435

CVE-2002-0435 describes a race condition in GNU fileutils (fileutils) 4.1 and earlier involving recursive directory deletion and directory moves. The issue allows local users to delete directories as the user running fileutils by moving a low-level directory to a higher level while deletion occur...

CVE-2002-0356

CVE-2002-0356 concerns SGI IRIX affected by the fsr_xfs (XFS filesystem reorganizer) vulnerability. The issue allows a local user to gain root privileges by overwriting critical system files in IRIX 6.5.10 and earlier. SGI’s advisory notes this can lead to a root exploit, with a workaround and a ...

CVE-2002-0789

In mnogosearch, the vulnerable component is search.cgi and the q query parameter. CVE-2002-0789 describes a buffer overflow in mnoGoSearch 3.1.19 and earlier that allows remote code execution with the webserver’s privileges. A fix is available in the 3.1.21 release referenced by the Conectiva adv...

CVE-2002-1006

The CVE-2002-1006 entry concerns a Cross-site scripting (XSS) vulnerability in BBC Education Text to Speech Internet Enhancer (Betsie) versions up to 1.5.11, where an attacker could trigger script execution via parserl.pl. Affected software is Betsie 1.5.11 and earlier. The provided connected sou...

CVE-2002-0364

CVE-2002-0364 describes a heap-based buffer overflow in IIS 4.0/5.0 when processing chunked-encoded HTR requests via the HTR ISAPI extension, allowing an attacker to execute arbitrary code with the privileges of the ISAPI process. The vulnerability stems from chunked encoding handling; impact inc...

CVE-2002-0074

CVE-2002-0074 describes a cross-site scripting vulnerability in the IIS Help Files search facility affecting Microsoft IIS 4.0, 5.0 and 5.1. The issue allows remote attackers to embed scripts into another user’s session through crafted input, as detailed in CERT/CC and various vulnerability advis...

CVE-2002-0981

The CVE-2002-0981 issue affects UnixWare 7.1.1 and Open UNIX 8.0.0, where the ndcfg binary (/usr/lib/netcfg/bin/ndcfg) has a command‑line buffer overflow in its processing. The advisory notes that ndcfg gains privileges via the security subsystem (not setuid), enabling a local user to run code wi...

CVE-2002-0631

Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges...

CVE-2002-0267

CVE-2002-0267 affects Simple Internet Publishing System (SIPS) prior to 0.3.1. A line break in the theme field followed by the Status::admin command allows remote attackers to gain administrative privileges by causing the Status line to be written into the password file. The connected sources con...

CVE-2002-0095

CVE-2002-0095 affects BSCW (Basic Support for Cooperative Work) in its default configuration (3.x and possibly 4) where user self-registration is enabled. This could allow remote attackers to upload files and potentially join a user community that was intended to be closed. The CVSS metrics indic...

CVE-2002-0553

The CVE-2002-0553 entry describes a Cross-site scripting (XSS) vulnerability in SunShop 2.5 and earlier. According to the sources, remote attackers can inject script into fields during new customer registration to gain administrative privileges in SunShop. The NVD metrics list a CVSSv2 base score...

CVE-2002-0512

The CVE-2002-0512 entry describes a local privilege escalation in KDE’s startkde (Caldera OpenLinux 2.3–3.1.1). The root cause is that LD_LIBRARY_PATH is set to include the current working directory, allowing a local attacker to influence loaded libraries (Trojan horse libraries) and potentially ...

CVE-2002-0945

Buffer overflow in SeaNox Devwex allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long HTTP GET request...

CVE-2002-0178

The CVE-2002-0178 issue affects the uudecode utility in the GNU Sharutils package prior to version 4.2.1, which does not validate the destination filename against pipes or symbolic links. This can allow a local attacker to overwrite files or escalate privileges by decoding into sensitive or open ...

CVE-2002-0068

CVE-2002-0068 affects Squid 2.4 STABLE3 and earlier, due to a buffer overflow in FTP URL parsing when the URL contains many special characters. This can cause a core dump (DoS) and, in some reports, may allow remote code execution. Mitigation: upgrade to Squid 2.4.STABLE4 or newer (and apply vend...

CVE-2002-0987

The CVE-2002-0987 entry refers to X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 that fail to drop privileges before invoking programs (e.g., xkbcomp) via popen. This behavior could allow local users to gain privileges. The described vulnerability is a local privilege escalation due to inad...

CVE-2002-0987

X server Xsco in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which could allow local users to gain privileges...