CVE-2002-0567

Oracle 8i/9i with PL/SQL EXTPROC vulnerable: remote attackers can bypass authentication and connect via the TNS Listener to the extproc process to execute arbitrary functions. Impact is remote code execution with the Oracle user’s privileges; no explicit exploit code/status is provided in the doc...

CVE-2002-0123

The affected product is MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier (and possibly 3.5.3). The vulnerability arises from handling of an excessively long HTTP request, which can be leveraged by a remote attacker to cause a denial of service and potentially execute arbitrary c...

CVE-2002-0123

MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier, and possibly 3.5.3, allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request...

CVE-2002-0806

Bugzilla 2.14 prior to 2.14.2 and 2.16 prior to 2.16rc2 is vulnerable: authenticated users with editing privileges can delete other users by calling editusers.cgi with the "del" option. Affected versions include Bugzilla 2.14.x before 2.14.2 and 2.16.x before 2.16rc2. The issue, as described in t...

CVE-2002-0402

CVE-2002-0402 is a vulnerability in Ethereal’s X11 dissector. The issue is a buffer overflow that can occur while Ethereal 0.9.3 and earlier parse keysyms, potentially leading to a denial of service and possibly arbitrary code execution. Public records across multiple sources identify the affecte...

CVE-2002-0738

MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by 1 splitting the SCRIPT tag into smaller pieces, 2 including the script in a SRC argument to an IMG tag, or 3 using "&=script" syntax...

CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...

CVE-2002-1486

Multiple buffer overflows in the IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service and possibly execute arbitrary code via 1 a large response from the server, 2 a JOIN with a long channel name, 3 a long "raw 221" message, 4 a PRIVMSG with a...

CVE-2002-1489

Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via 1 an HTTP GET request with a long URL or 2 a request with a long method name...

CVE-2002-1493

Cross-site scripting XSS vulnerability in Lycos HTMLGear guestbook allows remote attackers to inject arbitrary script via 1 STYLE attributes or 2 SRC attributes in an IMG tag...

CVE-2002-1496

Heap-based buffer overflow in Null HTTP Server 0.5.0 and earlier allows remote attackers to execute arbitrary code via a negative value in the Content-Length HTTP header...

CVE-2002-1501

The MPS functionality in Enterasys SSR8000 Smart Switch Router before firmware 8.3.0.10 allows remote attackers to cause a denial of service crash via multiple port scans to ports 15077 and 15078...

CVE-2002-1502

Symbolic link vulnerability in xbreaky before 0.5.5 allows local users to overwrite arbitrary files via a symlink from the user's .breakyhighscores file to the target file...

CVE-2002-1504

Directory traversal vulnerability in WebServer 4 Everyone 1.22 allows remote attackers to read arbitrary files via ".." dot-dot backslash sequences in a URL...

CVE-2002-1526

Cross-site scripting XSS vulnerability in emumail.cgi for EMU Webmail 5.0 allows remote attackers to inject arbitrary HTML or script via the email address field...

CVE-2002-1490

NetBSD 1.4 through 1.6 beta allows local users to cause a denial of service kernel panic via a series of calls to the TIOCSCTTY ioctl, which causes an integer overflow in a structure counter and sets the counter to zero, which frees memory that is still in use by other processes...

CVE-2002-1492

Buffer overflows in the Cisco VPN 5000 Client before 5.2.7 for Linux, and VPN 5000 Client before 5.2.8 for Solaris, allow local users to gain root privileges via 1 closetunnel and 2 opentunnel...

CVE-2002-1494

Cross-site scripting XSS vulnerabilities in Aestiva HTML/OS allows remote attackers to insert arbitrary HTML or script by inserting the script after a trailing / character, which inserts the script into the resulting error message...

CVE-2002-1498

Directory traversal vulnerability in SWServer 2.2 and earlier allows remote attackers to read arbitrary files via a URL containing .. sequences with "/" or "" characters...

CVE-2002-1500

Buffer overflow in 1 mrinfo, 2 mtrace, and 3 pppd in NetBSD 1.4.x through 1.6 allows local users to gain privileges by executing the programs after filling the file descriptor tables, which produces file descriptors larger than FDSETSIZE, which are not checked by FDSET...