5356 matches found
CVE-2002-0512
The CVE-2002-0512 entry describes a local privilege escalation in KDE’s startkde (Caldera OpenLinux 2.3–3.1.1). The root cause is that LD_LIBRARY_PATH is set to include the current working directory, allowing a local attacker to influence loaded libraries (Trojan horse libraries) and potentially ...
CVE-2002-0402
CVE-2002-0402 is a vulnerability in Ethereal’s X11 dissector. The issue is a buffer overflow that can occur while Ethereal 0.9.3 and earlier parse keysyms, potentially leading to a denial of service and possibly arbitrary code execution. Public records across multiple sources identify the affecte...
CVE-2002-0935
The CVE-2002-0935 issue affects Apache Tomcat 4.0.3 and possibly earlier 4.1.3 beta; it enables remote denial of service through a flood of requests containing null characters, causing server threads to hang due to resource exhaustion. The vulnerability targets the HTTP request handling path, lea...
CVE-2002-0373
CVE-2002-0373 affects Windows Media Player 7.1 on Windows 2000, where the Windows Media Device Manager (WMDM) Service lets a local user elevate to LocalSystem by invoking the WMDM service to connect to an invalid local storage device. The vulnerability is local and impacts the WMDM component; aff...
CVE-2002-0748
Summary: CVE-2002-0748 affects LabVIEW Web Server 5.1.1–6.1. An HTTP GET request that ends with two newline characters (instead of the expected CR LF CR LF) can cause the web server to crash, yielding a denial of service. The public documents consistently describe this DoS condition as a crash tr...
CVE-2002-0302
The CVE-2002-0302 issue affects the Notify daemon in Symantec Enterprise Firewall (SEF) 6.5.x. When SNMP is used as the transport, the daemon drops large alerts, which could prevent some alerts from being sent during an attack. This reduces visibility of events that would otherwise trigger notifi...
CVE-2002-0367
CVE-2002-0367 affects Windows NT/2000 and involves the smss.exe debugging subsystem not properly authenticating connections to privileged processes. This allows a local attacker to gain Administrator or SYSTEM privileges by duplicating a handle to a privileged process. The vulnerability is charac...
CVE-2002-0032
Yahoo! Messenger 5.0.0.1064 and earlier is vulnerable to remote arbitrary-script execution via the addview parameter of the ymsgr URI. The issue stems from Yahoo! Messenger URI handling, allowing an attacker to run code with the victim’s privileges. The advisory/references indicate remediation by...
CVE-2002-0687
Zope Server DoS via header injection (CVE-2002-0687) affects Zope versions 2.0 through 2.5.1 beta 1, where the "through the web code" capability allows untrusted users to crash the server by injecting malicious headers into a response. The connected advisories (GHSA-vwrc-g9q6-f675 and OSV) descri...
CVE-2002-0363
CVE-2002-0363 affects GNU Ghostscript prior to 6.53. A vulnerability in PostScript interpretation allows an attacker to cause Ghostscript to execute arbitrary commands by tricking the renderer into resetting the current pagedevice using .locksafe or .setsafe. The issue is due to insufficient vali...
CVE-2002-0017
Summary of CVE-2002-0017 (IRIX SNMPD): A buffer overflow in SGI IRIX SNMP daemon (snmpd) on IRIX 6.5 through 6.5.15m allows remote execution of arbitrary code via crafted SNMP requests. Affected: IRIX 6.5.x with the eoe.sw.netman SNMP components; exploitation requires remote access to SNMP servic...
CVE-2002-0621
CVE-2002-0621 involves a buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000. The underlying cause is a vulnerable installer routine that can be triggered by specific input to the OWC package installer, allowing a remote attacker to cause th...
CVE-2002-0848
CVE-2002-0848 affects Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier. When using RADIUS with a PAP or Challenge, the system sends the user password in cleartext in a validation retry request, enabling potential password capture by remote attackers...
CVE-2002-0642
CVE-2002-0642 corresponds to an elevation-of-privilege issue in Microsoft SQL Server 2000 and MSDE 2000 caused by insecure permissions on the registry key that stores the SQL Server service account. The OpenVAS/SECURITYVULNS entries corroborate a privilege-escalation risk tied to the SQL Server s...
CVE-2002-1035
Omnicron OmniHTTPd 2.09 is affected. A remote attacker can trigger a denial-of-service (crash) by sending an HTTP request with a long, malformed HTTP 1version number. No exploitation details or patches are provided in the supplied documents. The impact is limited to availability (partial), with n...
CVE-2002-0802
The CVE-2002-0802 entry documents a vulnerability in PostgreSQL 6.5.x when using the SQL_ASCII encoding: multibyte support can consume an extra character while processing a character that cannot be converted, potentially removing an escape character from the query and making the application susce...
CVE-2002-0718
CVE-2002-0718 affects Microsoft Content Management Server (MCMS) 2001. The vulnerability lies in the Web authoring function, allowing an attacker to authenticate and upload executable content by modifying the upload location (Program Execution via MCMS Authoring Function). Related data in the con...
CVE-2002-0801
Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to the filter with a long HTTP host header field in a URL for a .jsp file...
CVE-2002-0671
Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing...