CVE-2002-0425

The CVE affects mIRC DCC server protocol. The vulnerability allows remote attackers to access sensitive information, specifically alternate IRC nicknames, via a "100 testing" message in a DCC connection request that the user cannot ignore or cancel. This leads to disclosure of alternate nicknames...

CVE-2002-0638

CVE-2002-0638 concerns the util-linux package’s login utilities (notably setpwnam.c used by chfn/chsh). The advisory describes a race condition caused by inadequate locking of a temporary file used when modifying /etc/passwd, enabling a local attacker to escalate privileges. The issue affects Red...

CVE-2002-0795

CVE-2002-0795 affects the FreeBSD rc startup script (FreeBSD 4–4.5). The root cause is a symlink attack on X Window system lock files that allows local users to delete arbitrary files. Exploitation details are not provided in the available documents, so the exact steps and vulnerable files are no...

CVE-2002-0076

CVE-2002-0076 affects the Java Runtime Environment (JRE) Bytecode Verifier. The verifier flaw allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation. Affected are Microsoft VM builds up to 3802 (Internet Explorer 4.x/5.x) and Net...

CVE-2002-0818

CVE-2002-0818 affects World Wide Web Offline Explorer (WWWOFFLE) and its wwwoffled component. The remote denial of service and potential code execution stem from improper handling of negative Content-Length values, which can crash the processing child and, in some reports, allow arbitrary code ex...

CVE-2002-0423

The CVE-2002-0423 entry concerns efingerd 1.5 and earlier (potentially up to 1.61). The vulnerability is a buffer overflow in the finger service triggered by a finger request from an IP with a long hostname resolved via reverse DNS, allowing remote attackers to cause a denial of service and possi...

CVE-2002-0889

CVE-2002-0889 describes a buffer overflow in Qpopper (popper) 4.0.4 and earlier. The flaw allows local users to cause a denial of service and potentially execute arbitrary code via a long bulldir argument in the user’s .qpopper-options configuration file. Affected software is Qpopper up to versio...

CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...

CVE-2002-0170

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration...

CVE-2002-0687

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers...

CVE-2002-0074

Cross-site scripting vulnerability in Help File search facility for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session...

CVE-2002-0790

Technical details about CVE-2002-0790 are not publicly available in the provided documents. Monitor for updates.

CVE-2002-0424

CVE-2002-0424 affects efingerd 1.61 and earlier. When configured without the -u option, efingerd executes user-owned .efingerd files as the efingerd user (typically "nobody"), allowing a local user to gain privileges by modifying their own .efingerd file and invoking finger. The connected documen...

CVE-2002-0914

Technical details (affected product/version, root cause, impact, fixes) are not publicly provided in the supplied documents. Please monitor for updates.

CVE-2002-0463

ARSC (Really Simple Chat) version 1.0.1 and earlier is affected by an information disclosure vulnerability. An invalid arsc_language value allows remote attackers to cause an error message that reveals the full pathname of the web server, exposing partial confidentiality. The CVE entry notes this...

CVE-2002-0801

The CVE-2002-0801 issue affects Macromedia JRun 3.1 on Windows, where the ISAPI DLL filter for JRun is vulnerable to a buffer overflow via a long Host header in a request for a .jsp file. This allows a remote attacker to execute arbitrary code with SYSTEM privileges by sending a crafted request t...

CVE-2002-0968

AnaloxX SimpleServer:WWW (version 1.16 and earlier) is affected by a buffer overflow that can be triggered by a long HTTP request method name, allowing a remote attacker to crash the server and potentially execute arbitrary code. OpenVAS/Nessus/NVD entries confirm a remote DoS vector and, in some...

CVE-2002-0760

CVE-2002-0760 describes a race condition in bzip2 prior to 1.0.2 across FreeBSD 4.5 and earlier, and OpenLinux 3.1/3.1.1, where files are decompressed with world-readable permissions before being reset to the permissions specified in the archive, potentially allowing local users to read files dur...

CVE-2002-0823

The CVE-2002-0823 entry maps to a buffer overflow in Winhlp32.exe triggered by an HTML document calling the HTML Help ActiveX control HHCtrl.ocx with a long pathname in the Item parameter. Affected software is Microsoft Windows components involving WinHlp32.exe and HHCtrl.ocx. The root cause is a...

CVE-2002-0009

In Bugzilla versions before 2.14.1, a user with Bugs Access privileges could trigger information disclosure by submitting a bug and reading the resulting Product pulldown menu, revealing other products not accessible to them. The root cause is insufficient access controls around the Product pulld...