CVE-2002-0213

CVE-2002-0213 affects SGI Xinet K-AShare (IRIX) 0.011.01. The vulnerability arises from a symlink attack on the VOLICON file, which is copied to the world-writable .HSicon directory in a shared path. This enables local users to read arbitrary files. The SGI advisory notes the issue as fixed in th...

CVE-2002-0846

CVE-2002-0846 : The vulnerability concerns the decoder for Macromedia Shockwave Flash. A malformed SWF header containing more data than the specified length can enable remote code execution. The issue is described across multiple records (CVE/DV and NVD entries) as impacting the Shockwave Flash/S...

CVE-2002-0676

Summary: CVE-2002-0676 refers to SoftwareUpdate for MacOS 10.1.x, which reportedly downloads updates without authentication. This could allow an attacker to impersonate the Apple update server via DNS spoofing or cache poisoning and deliver Trojan Horse updates, enabling arbitrary code execution ...

CVE-2002-0619

The CVE-2002-0619 entry concerns Microsoft Word 2002 for Windows, where the Mail Merge Tool—when Microsoft Access is installed—allows remote attackers to run VBA scripts embedded in an HTML mail-merge document. This is identified as a variant of MS00-071 (CVE-2000-0788). Affected component: Word’...

CVE-2002-0860

The CVE-2002-0860 vulnerability affects Microsoft Office Web Components (OWC) 2000 and 2002, where the LoadText method in the spreadsheet component allows a remote attacker using an Internet Explorer URL redirect to read arbitrary local files. Underlying issue: inadequate URL handling in the OWC ...

CVE-2002-0619

The Mail Merge Tool in Microsoft Word 2002 for Windows, when Microsoft Access is present on a system, allows remote attackers to execute Visual Basic VBA scripts within a mail merge document that is saved in HTML format, aka a "Variant of MS00-071, Word Mail Merge Vulnerability" CVE-2000-0788...

CVE-2002-0650

CVE-2002-0650 affects Microsoft SQL Server 2000’s Resolution Service on UDP port 1434. A forged ping from one server to another (both using 1434) can trigger the Resolution Service to exchange referrals/pings in an infinite loop, causing a denial of service (bandwidth/resource exhaustion) between...

CVE-2002-0650

The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service bandwidth consumption via a "ping" style packet to the Resolution Service UDP port 1434 with a spoofed IP address of another SQL Server system, which causes the two servers to exchange...

CVE-2002-0287

The vulnerability affects Powie PHP Forum versions prior to 1.15. The root cause is that PHP magic_quotes is not explicitly enabled by default, enabling an attacker to bypass authentication and gain administrator privileges via an SQL injection when the PHP server is not configured to use magic q...

CVE-2002-0011

The CVE refers to Bugzilla, where the doeditvotes.cgi component in versions prior to 2.14.1 has an information leak that could allow remote attackers to more easily conduct attacks on the login. This is a partial confidentiality impact vulnerability (NVD metrics show MEDIUM severity, CVSS v2.0: A...

CVE-2002-0965

Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICENAME parameter, which is not properly handled when writing an error message to a log file...

CVE-2002-0616

The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by attaching an inline macro to an object within an Excel workbook, aka the "Excel Inline Macros Vulnerability."...

CVE-2002-0033

Heap-based buffer overflow in cfsdcalloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name...

CVE-2002-1057

Buffer overflow in SmartMax MailMax POP3 daemon popmax 4.8 allows remote attackers to execute arbitrary code via a long USER command...

CVE-2002-0599

Blahz-DNS 0.2 and earlier allows remote attackers to bypass authentication and modify configuration by directly requesting CGI programs such as dostuff.php instead of going through the login screen...

CVE-2002-0945

CVE-2002-0945 describes a buffer overflow in SeaNox Devwex that can be triggered by a long HTTP GET request, allowing remote attackers to cause a denial of service and potentially execute arbitrary code. The available connected sources corroborate the basic impact (DoS and potential code executio...

CVE-2002-0804

Bugzilla 2.14 (before 2.14.2) and 2.16 (before 2.16rc2) are vulnerable when configured to perform reverse DNS lookups. Remote attackers can bypass IP-based access restrictions by connecting from a host with a spoofed reverse DNS hostname. The provided materials do not specify a patch or workaround.

CVE-2002-0573

Format string vulnerability in RPC wall daemon rpc.rwalld for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed...

CVE-2002-0754

Affected software : Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier. Vulnerability : k5su relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them. Impact : potential privilege e...

CVE-2002-0754

Kerberos 5 su k5su in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them...