CVE-2002-0539

Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the skey cookie...

CVE-2002-0695

CVE-2002-0695 describes a buffer overflow in the Transact-SQL (T-SQL) OpenRowSet component of Microsoft Data Access Components (MDAC) 2.5–2.7, affecting SQL Server 7.0 or 2000. The underlying issue is a buffer overflow in the OpenRowSet path that could allow a remote attacker to execute arbitrary...

CVE-2002-0506

Buffer overflow in newt.c of newt windowing library libnewt 0.50.33 and earlier may allow attackers to cause a denial of service or execute arbitrary code in setuid programs that use libnewt...

CVE-2002-0172

/dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions 644, which could allow a local user to cause a denial of service traffic disruption...

CVE-2002-0330

Cross-site scripting vulnerability in codeparse.php of Open Bulletin Board OpenBB 1.0.0 allows remote attackers to execute arbitrary script and steal cookies via Javascript in the IMG tag...

CVE-2002-0830

Affected software: FreeBSD <= 4.6.1 RELEASE-p7 and NetBSD

CVE-2002-0597

The CVE-2002-0597 entry concerns Microsoft Windows 2000 where the LANMAN service, enabled by default, processes malformed data sent to port 445 (microsoft-ds). The root cause is that malformed packets exhaust kernel memory/resources, leading to denial of service and degraded or failing system beh...

CVE-2002-0054

SMTP service in 1 Microsoft Windows 2000 and 2 Internet Mail Connector IMC in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials...

CVE-2002-0174

nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file...

CVE-2002-1015

RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary script in the Local computer zone by inserting the script into the skin.ini file of an RJS archive, then referencing skin.ini from a web page after it has been extracted, which ...

CVE-2002-0403

CVE-2002-0403 affects Ethereal's DNS dissector. Vulnerable: Ethereal versions prior to 0.9.3. Exploitation causes a denial of service through CPU consumption by a malformed DNS packet that makes Ethereal enter an infinite loop. Remediation is to upgrade Ethereal to a fixed version (e.g., 0.9.3 or...

CVE-2002-0761

CVE-2002-0761 affects bzip2 before 1.0.2 on FreeBSD (4.5 and earlier) and OpenLinux (3.1 and 3.1.1). The issue arises when creating an archive: bzip2 honors the permissions of the symbolic link rather than those of the target file, which could cause files to be extracted with less restrictive per...

CVE-2002-0856

The CVE-2002-0856 entry concerns the SQL*NET listener in Oracle Net for Oracle9i (versions 9.0.x and 9.2). The vulnerability is a denial-of-service caused by handling of certain debug requests in the debugging feature, which are not processed correctly, allowing remote attackers to crash the serv...

CVE-2002-0567

Oracle 8i/9i with PL/SQL EXTPROC vulnerable: remote attackers can bypass authentication and connect via the TNS Listener to the extproc process to execute arbitrary functions. Impact is remote code execution with the Oracle user’s privileges; no explicit exploit code/status is provided in the doc...

CVE-2002-0123

The affected product is MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier (and possibly 3.5.3). The vulnerability arises from handling of an excessively long HTTP request, which can be leveraged by a remote attacker to cause a denial of service and potentially execute arbitrary c...

CVE-2002-0123

MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier, and possibly 3.5.3, allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request...

CVE-2002-0806

Bugzilla 2.14 prior to 2.14.2 and 2.16 prior to 2.16rc2 is vulnerable: authenticated users with editing privileges can delete other users by calling editusers.cgi with the "del" option. Affected versions include Bugzilla 2.14.x before 2.14.2 and 2.16.x before 2.16rc2. The issue, as described in t...

CVE-2002-0402

CVE-2002-0402 is a vulnerability in Ethereal’s X11 dissector. The issue is a buffer overflow that can occur while Ethereal 0.9.3 and earlier parse keysyms, potentially leading to a denial of service and possibly arbitrary code execution. Public records across multiple sources identify the affecte...

CVE-2002-0738

MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by 1 splitting the SCRIPT tag into smaller pieces, 2 including the script in a SRC argument to an IMG tag, or 3 using "&=script" syntax...

CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...