CVE-2002-0691

Microsoft Internet Explorer 5.01 and 5.5 allows remote attackers to execute scripts in the Local Computer zone via a URL that references a local HTML resource file, a variant of "Cross-Site Scripting in Local HTML Resource" as identified by CAN-2002-0189...

CVE-2002-0658

OSSP mm library libmm before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack...

CVE-2002-0250

Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authentication via a direct HTTP request to the webaccess.html file, which allows the user to change the switch's configuration and modify the...

CVE-2002-0442

Buffer overflow in dlvraudit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges...

CVE-2002-0631

Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges...

CVE-2002-0424

efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user typically "nobody", which allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger...

CVE-2002-0946

Directory traversal vulnerability in SeaNox Devwex before 1.2002.0601 allows remote attackers to read arbitrary files via ..\ dot dot sequences in an HTTP request...

CVE-2002-0573

Format string vulnerability in RPC wall daemon rpc.rwalld for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed...

CVE-2002-0701

ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges...

CVE-2002-0412

NTOP is affected by CVE-2002-0412 due to a format string vulnerability in the TraceEvent function prior to version 2.1. The issue allows remote attackers to execute arbitrary code by injecting format strings into syslog calls. Attack vectors include an HTTP GET request, or credentials supplied in...

CVE-2002-0846

CVE-2002-0846 : The vulnerability concerns the decoder for Macromedia Shockwave Flash. A malformed SWF header containing more data than the specified length can enable remote code execution. The issue is described across multiple records (CVE/DV and NVD entries) as impacting the Shockwave Flash/S...

CVE-2002-0806

Bugzilla 2.14 prior to 2.14.2 and 2.16 prior to 2.16rc2 is vulnerable: authenticated users with editing privileges can delete other users by calling editusers.cgi with the "del" option. Affected versions include Bugzilla 2.14.x before 2.14.2 and 2.16.x before 2.16rc2. The issue, as described in t...

CVE-2002-1024

Technical details for CVE-2002-1024 are not publicly available in the provided connected documents. Monitor for updates in the Vulners feed for affected products, versions, impact, and fixes.

CVE-2002-0170

CVE-2002-0170 affects Zope 2.2.0 through 2.5.1. The underlying issue is improper verification of access for objects with proxy roles, which could allow some users to access documents contrary to the intended configuration. Several sources (GHSA/OSV, CVE records, and related advisories) corroborat...

CVE-2002-1002

CVE-2002-1002 describes a buffer overflow in Novell iManager (eMFrame 1.2.1) that enables remote attackers to cause a denial of service (crash) by supplying a long user name. Affected software: Novell iManager with component eMFrame 1.2.1. Root cause: improper handling of long user name input lea...

CVE-2002-0149

CVE-2002-0149 concerns a buffer overflow in the IIS ASP Server-Side Include (SSI) processing when handling long file names. The issue affects Microsoft IIS 4.0, 5.0 and 5.1, and can allow a remote attacker to crash the server or potentially execute arbitrary code via crafted SSI inputs. Multiple ...

CVE-2002-0157

Nautilus 1.0.4 and earlier are affected by CVE-2002-0157 due to a symlink-attack in the creation of the .nautilus-metafile.xml metadata file. A local attacker can cause overwrites of arbitrary files in a target directory by exploiting an unchecked symlink when Nautilus copies files between direct...

CVE-2002-0123

The affected product is MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier (and possibly 3.5.3). The vulnerability arises from handling of an excessively long HTTP request, which can be leveraged by a remote attacker to cause a denial of service and potentially execute arbitrary c...

CVE-2002-0423

The CVE-2002-0423 entry concerns efingerd 1.5 and earlier (potentially up to 1.61). The vulnerability is a buffer overflow in the finger service triggered by a finger request from an IP with a long hostname resolved via reverse DNS, allowing remote attackers to cause a denial of service and possi...

CVE-2002-0710

CVE-2002-0710 describes a directory traversal in Rod Clark’s sendform.cgi, affecting versions 1.44 and earlier. An attacker can specify files via the BlurbFilePath parameter to read arbitrary server files (e.g., /etc/passwd) with the web server’s privileges over the network. The vulnerability is ...