CVE-2002-1544

Directory traversal vulnerability in CooolSoft Personal FTP Server 2.24 allows remote attackers to read or modify arbitrary files via .. dot dot sequences in the commands 1 LIST ls, 2 mkdir, 3 put, or 4 get...

CVE-2002-1552

Novell eDirectory eDir 8.6.2 and Netware 5.1 eDir 85.x allows users with expired passwords to gain inappropriate permissions when logging in from Remote Manager...

CVE-2002-1557

Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service reset to TCC, TCC+, TCCi or XTC via a malformed HTTP request that does not contain a leading / slash character...

CVE-2002-1531

The administrative web interface STEMWADM for SurfControl SuperScout Email Filter allows remote attackers to cause a denial of service crash via an HTTP request without a Content-Length parameter...

CVE-2002-1545

CooolSoft Personal FTP Server 2.24 allows remote attackers to obtain the absolute pathname of the FTP root via a PWD command, which includes the full path in the response...

CVE-2002-1549

Buffer overflow in Light HTTPd lhttpd 0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request...

CVE-2002-1560

index.php in gBook 1.4 allows remote attackers to bypass authentication and gain administrative privileges by setting the login parameter to true...

CVE-2002-1561

The CVE-2002-1561 issue affects the Windows RPC service stack (RPC Endpoint Mapper) on Windows 2000, NT 4.0, and XP. A malformed packet to TCP 135 can trigger a NULL pointer dereference in the RPC Endpoint Mapper, causing the RPC service to terminate and resulting in a denial of service for RPC-b...

CVE-2002-1561

The RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service disabled RPC service via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference...

CVE-2002-0030

CVE-2002-0030 is a vulnerability in Adobe Acrobat/Reader plug-ins where the digital signature check only validates the plug-in’s PE header, allowing a malicious unsigned plug-in to be loaded as if signed. This enables local attackers to cause arbitrary code execution when Acrobat/Reader loads a c...

PHP Mail Function Header Spoofing

The remote host is running a version of PHP prior or equal to 4.2.2. The mail function does not properly sanitize user input. This allows users to forge email to make it look like it is coming from a different source other than the server. Users can exploit this even if SAFEMODE is enabled...

CVE-2002-1557

Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service reset to TCC, TCC+, TCCi or XTC via a malformed HTTP request that does not contain a leading / slash character...

CVE-2002-1466

CafeLog b2 Weblog Tool 2.06pre4, with allowfopenurl enabled, allows remote attackers to execute arbitrary PHP code via the b2inc variable...

CVE-2002-1525

Directory traversal vulnerability in ASTAware SearchDisk engine for Sun ONE Starter Kit 2.0 allows remote attackers to read arbitrary files via a .. dot dot attack on port 1 6015 or 2 6016, or 3 an absolute pathname to port 6017...

CVE-2002-1454

MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does not exist, which leaks the pathname in an error message...

CVE-2002-1432

MidiCart stores the midicart.mdb database file under the Web document root, which allows remote attackers to steal sensitive information by directly requesting the database...

CVE-2002-1408

CVE-2002-1408 concerns HP OpenView EMANATE 14.2 snmpModules where the SNMP read-write community name can be exposed, related to (1) 'read-only' community access, and/or (2) an easily guessable community name. This exposure could enable unauthorized SNMP read/write access to affected data and conf...

CVE-2002-1536

The CVE-2002-1536 entry concerns Molly IRC bot 0.5. Affected components are multiple Perl scripts: nslookup.pl (host variable), pop.pl (to, from, message), sms.pl (words, text), and hpled.pl (server, printer). The root cause is shell metacharacter handling in these variables, enabling a remote at...

CVE-2002-1546

The CVE-2002-1546 issue affects BRS WebWeaver Web Server 1.01 and allows remote attackers to bypass password protections for files and directories by sending an HTTP request that includes a "/./" sequence. This is a path traversal-like bypass vulnerability. According to the source data, the vulne...

CVE-2002-1470

SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes the password to be logged in the world-readable scserv.log file...