CVE-2002-0653

The CVE-2002-0653 issue is an off-by-one buffer overflow in mod_ssl (Apache) software, triggered by the ssl_compat_directive function via the rewrite_command hook in version 2.8.9 and earlier. This local vulnerability lets attackers with write access to .htaccess files execute arbitrary code as t...

CVE-2002-0984

The CVE affects Light’s EPIC-based IRC script (epic4-script-light) in Light 2.7.x before 2.7.30p5 and 2.8.x before 2.8pre10. A remote attacker can trigger arbitrary code execution if a user joins a channel whose topic contains EPIC4 code, via the IRC script. Remediation involves updating to the p...

CVE-2002-0873

The CVE-2002-0873 issue affects l2tpd versions around 0.67, where a long attribute/value could overflow and overwrite the vendor field, potentially via a buffer overflow. Additionally, the affected code paths may fail to initialize the random number generator, enabling some predictability in keys...

CVE-2002-0369

CVE-2002-0369 describes a buffer overflow in the ASP.NET Worker Process when StateServer mode is enabled, triggered by a routine that processes cookies. The issue can allow a remote attacker to cause a denial of service (restart) and potentially execute arbitrary code with the worker process priv...

CVE-2002-0488

The vulnerability CVE-2002-0488 affects Linux Directory Penguin traceroute.pl CGI script version 1.0. A flaw in the traceroute.pl CGI allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter, enabling remote code execution. This assessment is supported by P...

CVE-2002-0494

The CVE-2002-0494 entry describes a Cross-site scripting vulnerability in WebSight Directory System 0.1 that lets remote attackers execute arbitrary JavaScript and potentially gain access to the WebSight administrator via a link submission containing the script in a website name. Affected compone...

CVE-2002-0505

CVE-2002-0505 concerns Cisco CallManager CTI Framework authentication. A memory leak when authentication fails (e.g., incorrect CTI/CTIFW credentials) can cause the server to crash and reload, enabling a DoS. Affected products: Cisco CallManager 3.0 and 3.1. The documented fix is to upgrade to 3....

CVE-2002-0574

CVE-2002-0574 (FreeBSD 4.5 and earlier): A memory leak in the ip_output() path is triggered by ICMP echo traffic, where the routing table entry’s reference count is not decremented, preventing cleanup and potentially leading to memory exhaustion. This enables remote attackers to cause a denial of...

CVE-2002-0718

CVE-2002-0718 affects Microsoft Content Management Server (MCMS) 2001. The vulnerability lies in the Web authoring function, allowing an attacker to authenticate and upload executable content by modifying the upload location (Program Execution via MCMS Authoring Function). Related data in the con...

CVE-2002-0722

Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 are affected by CVE-2002-0722 due to a UI spoof flaw in the File Download dialogue that allows remote attackers to misrepresent a file’s origin and mislead users into trusting unsafe downloads. The vulnerability has a CVSS-based high impact ...

CVE-2002-0734

B2 2.0.6pre2 and earlier are affected by CVE-2002-0734 due to a flaw in how b2edit.showposts.php loads b2config.php in certain configurations. This can allow a remote attacker to execute arbitrary PHP code by crafting a URL that sets the $b2inc variable to point to a malicious program hosted remo...

CVE-2002-0054

CVE-2002-0054 affects the SMTP service in Windows 2000 and the Internet Mail Connector (IMC) in Exchange Server 5.5. The issue stems from improper handling of NTLM authentication responses, enabling remote attackers to relay mail via SMTP AUTH using a null session. Public references describe this...

CVE-2002-0186

CVE-2002-0186 describes a buffer overflow in the Microsoft SQLXML ISAPI extension for SQL Server 2000. The flaw arises from inadequate validation of the contenttype parameter in SQLXML HTTP requests, allowing a remote attacker to trigger a crash or execute arbitrary code (the extension runs with ...

CVE-2002-0299

The CVE-2002-0299 entry concerns CNet CatchUp prior to version 1.3.1. The vulnerability arises when a crafted .RVP file enables arbitrary code execution by creating a file with an arbitrary extension (for example, .BAT) that is executed during a scan. The provided documents identify the affected ...

CVE-2002-0816

Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument...

CVE-2002-0190

Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability...

CVE-2002-0536

This CVE affects PHPGroupware 0.9.12 and earlier. When magic_quotes_gpc is disabled, remote attackers can perform a SQL injection to compromise the database. The issue is caused by insufficient input handling in the affected PHPGroupware deployment, enabling unauthorized access to database data. ...

CVE-2002-1060

CVE-2002-1060 describes a cross-site scripting (XSS) vulnerability in Blue Coat Systems (CacheFlow) CacheOS affecting Client Accelerator 4.1.06, Security Gateway 2.1.02, and Server Accelerator 4.1.06. The issue allows remote attackers to inject arbitrary web script or HTML by crafting a URL to a ...

CVE-2002-0710

CVE-2002-0710 describes a directory traversal in Rod Clark’s sendform.cgi, affecting versions 1.44 and earlier. An attacker can specify files via the BlurbFilePath parameter to read arbitrary server files (e.g., /etc/passwd) with the web server’s privileges over the network. The vulnerability is ...

CVE-2002-0382

Summary: CVE-2002-0382 affects the XChat IRC client. The issue arises when handling a /dns query, where the DNS reverse lookup can contain shell metacharacters, allowing arbitrary commands to be executed with the user’s privileges. This is caused by XChat passing the resolver/hostname to a shell ...