CVE-2002-1390

The daemon for GeneWeb before 4.09 does not properly handle requested paths, which allows remote attackers to read arbitrary files via a crafted URL...

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2002-1403

dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script...

CVE-2002-1392

faxspool in mgetty before 1.1.29 uses a world-writable spool directory for outgoing faxes, which allows local users to modify fax transmission privileges...

CVE-2002-1395

Internet Message IM 141-18 and earlier uses predictable file and directory names, which allows local users to 1 obtain unauthorized directory permissions via a temporary directory used by impwagent, and 2 overwrite and create arbitrary files via immknmz...

CVE-2002-1398

Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input."...

CVE-2002-1400

Heap-based buffer overflow in the repeat function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat to generate a large string...

CVE-2002-1403

dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script...

CVE-2002-1395

Internet Message IM 141-18 and earlier uses predictable file and directory names, which allows local users to 1 obtain unauthorized directory permissions via a temporary directory used by impwagent, and 2 overwrite and create arbitrary files via immknmz...

XSS (Cross Site Scripting) on FormMail.CGI

Topic: XSS Cross Site Scripting on FormMail.CGI Version: 1.92 Released: April 21, 2002 Manufacturer: http://www.scriptarchive.com/formmail.html By XyborG - [email protected] - http://www.rzweb.com.ar/ Formmai.cgi, it is a utility that serves to send forms by email, among other uses. The operatio...

CVE-2002-1395

CVE-2002-1395 affects Internet Message (IM) and its components impwagent and immknmz. The Debian advisory notes insecure handling of temporary files: impwagent creates a temporary directory in /tmp with predictable names, allowing local users to obtain unauthorized directory permissions, and immk...

CVE-2002-1398

Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input."...

CVE-2002-1401

CVE-2002-1401 concerns PostgreSQL 7.2.3 and earlier, where buffer overflows in circle_poly, path_encode, and path_add (also misnamed path_addr) allow denial of service and possibly arbitrary code execution, likely from an integer overflow. Public advisories indicate fixes in newer PostgreSQL rele...

CVE-2002-1400

PostgreSQL 7.2.x is affected by a heap-based buffer overflow in repeat() (CVE-2002-1400) that can allow remote or local code execution depending on the context. Affected versions before 7.2.2 are implicated; various advisories note fixes in updated 7.2.2 (and backported fixes to 7.2.1/7.2.3 in so...

CVE-2002-1395

Internet Message IM 141-18 and earlier uses predictable file and directory names, which allows local users to 1 obtain unauthorized directory permissions via a temporary directory used by impwagent, and 2 overwrite and create arbitrary files via immknmz...

CVE-2002-1397

CVE-2002-1397 refers to a buffer overflow in the cash_words() function of PostgreSQL 7.2 and earlier. The vulnerability allows local users to cause a denial of service and potentially execute arbitrary code via a malformed argument (notably a large negative value), linked to integer signedness/bu...

CVE-2002-1402

CVE-2002-1402 refers to buffer overflows in the TZ and SET TIME ZONE environment variables for PostgreSQL 7.2.1 and earlier, enabling local users to cause a denial of service and possibly execute arbitrary code. Connected documents confirm this issue across multiple distributions with multiple re...

CVE-2002-1398

CVE-2002-1398 describes a buffer overflow in the PostgreSQL date parser before 7.2.2. The issue allows denial of service and potentially arbitrary code execution when processing a long date string, i.e., a vulnerability in handling long datetime input. Multiple connected advisories (Red Hat RHSA-...

CVE-2002-1393

CVE-2002-1393 concerns multiple vulnerabilities in KDE 2 and KDE 3.x up to 3.0.5 where certain parameters inserted into a shell command are not quoted. This could allow remote attackers to execute arbitrary commands through (1) URLs, (2) filenames, or (3) e-mail addresses. The description specifi...

CVE-2002-1395

Internet Message IM 141-18 and earlier uses predictable file and directory names, which allows local users to 1 obtain unauthorized directory permissions via a temporary directory used by impwagent, and 2 overwrite and create arbitrary files via immknmz...