CVE-2002-0545

Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service reboot via a series of login attempts with invalid usernames and passwords...

CVE-2002-0184

Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p prompt argument, which are not properly expanded...

CVE-2002-0984

The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code...

CVE-2002-0531

Directory traversal vulnerability in emumail.cgi in EMU Webmail 4.5.x and 5.1.0 allows remote attackers to read arbitrary files or list arbitrary directories via a .. dot dot in the type parameter...

CVE-2002-0147

Buffer overflow in the ASP data transfer mechanism in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."...

CVE-2002-0073

The FTP service in Internet Information Server IIS 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters...

CVE-2002-0366

Buffer overflow in Remote Access Service RAS phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server RRAS allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry...

CVE-2002-0178

uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands...

CVE-2002-0425

mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message in a DCC connection request that cannot be ignored or canceled by the user, which may leak the alternate nickname in a response message...

CVE-2002-0597

LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service CPU/memory exhaustion via a stream of malformed data to microsoft-ds port 445...

CVE-2002-0287

The vulnerability affects Powie PHP Forum versions prior to 1.15. The root cause is that PHP magic_quotes is not explicitly enabled by default, enabling an attacker to bypass authentication and gain administrator privileges via an SQL injection when the PHP server is not configured to use magic q...

CVE-2002-0598

Foundstone FScan 1.12 with banner grabbing enabled is affected by a format string vulnerability in the server banner that can allow remote code execution. The issue is documented with a CVE listing and a CVSS v2 base score of 7.5 (HIGH); impact is partial on confidentiality, integrity, and availa...

CVE-2002-0762

CVE-2002-0762 : The shadow package in SuSE 8.0 lets local users destroy /etc/passwd and /etc/shadow or grant extra group privileges by lowering the filesize limits before programs modify those files, indicating a local-privilege-impact scenario due to improper enforcement of file-size constraints...

CVE-2002-0464

CVE-2002-0464 affects Hosting Controller 1.4.1 and earlier. A directory-traversal vulnerability allows remote attackers to read and modify arbitrary files and directories by supplying a ".." in arguments to the vulnerable endpoints: file_editor.asp, folderactions.asp, or editoractions.asp. The in...

CVE-2002-0441

CVE-2002-0441 describes a directory traversal vulnerability in the Php Imglist component (imlist.php) where a crafted cwd parameter containing two dots (.. ) can cause reading of arbitrary files. The available sources indicate a potential exposure of code or sensitive files but do not provide con...

CVE-2002-0720

Windows 2000 Network Connection Manager (NCM) contains a handler routine that, if configured insecurely, can run under LocalSystem and execute attacker-supplied code. A local user can leverage this to gain full system privileges, per multiple sources (e.g., OpenVAS/Nessus descriptions). Affected ...

CVE-2002-0805

Bugzilla 2.14 before 2.14.2 and 2.16 before 2.16rc2 contain two issues: (1) creation of new directories with world-writable permissions, and (2) creation of the params file with world-writable permissions. These flaws allow local users to modify the files and execute code. The provided sources co...

CVE-2002-0372

Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's IE security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path...

CVE-2002-1046

The CVE-2002-1046 entry describes a Denial of Service against Watchguard Firebox firmware 5.x.x via the Dynamic VPN Configuration Protocol (DVCP). A remote attacker can crash the device by sending a malformed packet containing tab characters to TCP port 4110. No root cause, affected versions beyo...

CVE-2002-0631

The SGI nveventd vulnerability (CVE-2002-0631) affects the NetVisualyzer component on IRIX 6.5.x (6.5.16 and earlier). A misconfiguration of /usr/NetVis/etc/nveventd allows a local unprivileged user to write arbitrary files and potentially gain root privileges. The advisory states SGI will not pr...