CVE-2002-0300

CVE-2002-0300 affects gnujsp 1.0.0 and 1.0.1. The vulnerability allows remote attackers to list directories, read the source code of certain scripts, and bypass access restrictions by directly requesting a target file from the gnujsp servlet; the issue stems from a limitation of JServ and the ser...

CVE-2002-0068

CVE-2002-0068 affects Squid 2.4 STABLE3 and earlier, due to a buffer overflow in FTP URL parsing when the URL contains many special characters. This can cause a core dump (DoS) and, in some reports, may allow remote code execution. Mitigation: upgrade to Squid 2.4.STABLE4 or newer (and apply vend...

CVE-2002-1031

CVE-2002-1031 affects KeyFocus (KF) web server 1.0.2. The vulnerability permits remote attackers to list directories and read restricted files through an HTTP request containing a null byte (%00). The NVD analysis indicates network access with low attack complexity and no authentication, resultin...

CVE-2002-1006

The CVE-2002-1006 entry concerns a Cross-site scripting (XSS) vulnerability in BBC Education Text to Speech Internet Enhancer (Betsie) versions up to 1.5.11, where an attacker could trigger script execution via parserl.pl. Affected software is Betsie 1.5.11 and earlier. The provided connected sou...

CVE-2002-0995

PHPAuction's login.php is vulnerable: a direct call with action=insert allows remote attackers to add a username to the adminUsers table, effectively gaining privileges. The CVE entry documents this privilege escalation and labels it high severity (CVSS v2 base score 7.5). The provided sources co...

CVE-2002-0968

AnaloxX SimpleServer:WWW (version 1.16 and earlier) is affected by a buffer overflow that can be triggered by a long HTTP request method name, allowing a remote attacker to crash the server and potentially execute arbitrary code. OpenVAS/Nessus/NVD entries confirm a remote DoS vector and, in some...

CVE-2002-0953

The CVE-2002-0953 entry concerns the PHP Address product, prior to version 0.2f, where enabling allow_url_fopen and register_globals creates a remote code execution risk. The vulnerability allows an attacker to supply a URL containing code in the LangCookie parameter, which is then executed by th...

CVE-2002-0875

The CVE-2002-0875 issue affects FAM (File Alteration Monitor) versions around 2.6.6 and 2.6.8, where an unprivileged user could learn the names of files restricted to the root group, constituting an information-disclosure flaw. Public advisories (e.g., Debian DSA-154, Red Hat RHSA-2005:005) descr...

CVE-2002-0859

CVE-2002-0859 describes a buffer overflow in the OpenDataSource function of the Jet engine used by Microsoft SQL Server 2000. The vulnerability permits remote attackers to execute arbitrary code, affecting the system via the Jet engine component. The available records indicate the issue arises fr...

CVE-2002-0851

The CVE-2002-0851 issue affects the ISDN4Linux (i4l) package, specifically the PPP daemon ipppd. A format string vulnerability in the device name command line argument is not properly sanitized in a syslog call, allowing a local user to exploit the flaw and gain root privileges. The connected doc...

CVE-2002-0817

CVE-2002-0817 describes a format-string vulnerability in the Debian/Linux package named “super.” The flaw allows a local user to gain root privileges by supplying a long command-line argument, due to insecure format-string handling in the affected component. Public references in the connected doc...

CVE-2002-0814

CVE-2002-0814 concerns VMware GSX Server 2.0.0 build-2050, where a buffer overflow in the VMware Authorization Service allows remote authenticated users to execute arbitrary code through a long GLOBAL argument. Affected component: VMware Authorization Service within GSX Server 2.0.0. Root cause: ...

CVE-2002-0653

The CVE-2002-0653 issue is an off-by-one buffer overflow in mod_ssl (Apache) software, triggered by the ssl_compat_directive function via the rewrite_command hook in version 2.8.9 and earlier. This local vulnerability lets attackers with write access to .htaccess files execute arbitrary code as t...

CVE-2002-0597

The CVE-2002-0597 entry concerns Microsoft Windows 2000 where the LANMAN service, enabled by default, processes malformed data sent to port 445 (microsoft-ds). The root cause is that malformed packets exhaust kernel memory/resources, leading to denial of service and degraded or failing system beh...

CVE-2002-0539

Demarc PureSecure 1.05 is affected by a SQL injection vulnerability in the session ID stored in the s_key cookie, enabling remote attackers to gain administrative privileges. The available sources describe the flaw as a remote authentication bypass via SQL injection affecting the session identifi...

CVE-2002-0536

This CVE affects PHPGroupware 0.9.12 and earlier. When magic_quotes_gpc is disabled, remote attackers can perform a SQL injection to compromise the database. The issue is caused by insufficient input handling in the affected PHPGroupware deployment, enabling unauthorized access to database data. ...

CVE-2002-0516

CVE-2002-0516 affects SquirrelMail 1.2.5 and earlier. Affected component: THEME cookie handling. Root cause: authenticated users can modify the THEME cookie to execute arbitrary commands. Impact is high (complete confidentiality, integrity, and availability) as per the cited report. No remediatio...

CVE-2002-0495

csSearch.cgi in csSearch 2.3 and earlier contains a remote command‑execution flaw. An attacker can trigger arbitrary Perl code by using the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file loaded by csSearch.cgi. This yields remote, user‑independent com...

CVE-2002-0484

The CVE-2002-0484 entry describes a PHP vulnerability in move_uploaded_file where the function does not check the base directory (open_basedir). This can allow remote attackers to upload files to locations outside the intended directory. The primary affected component is PHP’s file-upload handlin...

CVE-2002-0454

Qpopper (aka in.qpopper or popper) versions 4.0.3 and earlier are affected by a remote DoS vulnerability: processing a very large string can trigger an infinite loop, consuming CPU. The affected component is the POP3 server (qpopper); root cause is an input-induced infinite loop. A fix is referen...