CVE-2002-1464

CVE-2002-1464 describes a cross-site scripting (XSS) vulnerability in the CafeLog b2 Weblog Tool. The affected component is the CafeLog b2 Weblog Tool, and the root cause is improper handling of user-supplied data in the GPC variable, enabling remote attackers to inject arbitrary HTML or script. ...

CVE-2002-1453

Vulnerability: CVE-2002-1453 affects MyWebServer 1.0.2. Issue: Cross-site scripting (XSS) where a long request allows remote attackers to inject script/HTML, which is echoed back to the user in an error message. Impact (as described): Script execution in the context of the user’s browser via the ...

CVE-2002-1453

Cross-site scripting XSS vulnerability in MyWebServer 1.0.2 allows remote attackers to insert script and HTML via a long request followed by the malicious script, which is echoed back to the user in an error message...

CVE-2002-1525

CVE-2002-1525 concerns a directory traversal vulnerability in the ASTAware SearchDisk engine of Sun ONE Starter Kit 2.0. The flaw allows remote attackers to read arbitrary files via a .. (dot dot) path traversal on ports 6015 or 6016, or through an absolute pathname to port 6017. The available re...

CVE-2002-1484

DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems port scan via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error...

CVE-2002-1462

CVE-2002-1462 affects OrganicPHP PHP-affiliate 1.0 (and possibly later), where details2.php allows remote attackers to modify information of other users by tampering with hidden form fields. The underlying issue is insufficient validation/authentication for user data in the affected script, enabl...

CVE-2002-1462

details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by modifying certain hidden form fields...

CVE-2002-1411

CVE-2002-1411 concerns a directory traversal vulnerability in the Duma Photo Gallery System (DPGS) 0.99.4, reported as affecting the update.dpgs endpoint. The vulnerability arises from insufficient validation of the id parameter, allowing remote attackers to read arbitrary files via .. (dot dot) ...

CVE-2002-1483

db4webc and db4webc.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument is a filename of the form 1 C: drive letter, 2 //absolute/path double-slash, or 3 .. dot-dot...

CVE-2002-1421

CVE-2002-1421 affects FUDforum prior to 2.2.0. The vulnerability is a SQL injection in three scripts—report.php, selmsg.php, and showposts.php—allowing remote attackers to perform unauthorized database operations. This is described in the CVE entry and NVD records. Affected version range is befor...

CVE-2002-1506

Linuxconf before 1.28r4 is vulnerable to a local buffer overflow triggered by a long LINUXCONF_LANG environment variable, allowing local users to execute arbitrary code. This matches the CVE-2002-1506 description and is corroborated by the NVD entry and related records (e.g., CVE list and EUVD-20...

CVE-2002-1503

CVE-2002-1503 affects Automatic File Distributor (AFD) 1.2.14 and earlier. A buffer overflow is triggered by a long MON_WORK_DIR environment variable or -w (workdir) argument passed to any of: afd, afdcmd, afd_ctrl, init_afd, mafd, mon_ctrl, show_olog, or udc. The vulnerability allows local users...

CVE-2002-1427

The printhtmltofile function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users...

CVE-2002-1449

eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by reading password.txt...

CVE-2002-1488

The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service crash via a PART message with 1 a missing channel or 2 a channel that the Trillian user is not in...

CVE-2002-1557

CVE-2002-1557 affects Cisco ONS platforms: ONS15454 and ONS15327 running ONS before 3.4. The vulnerability is triggered by a malformed HTTP request that does not start with a leading ‘/’, allowing an attacker to cause a denial of service by resetting to TCC, TCC+, TCCi or XTC. The provided docume...

CVE-2002-1485

The AIM component of Trillian 0.73 and 0.74 allows remote attackers to cause a denial of service crash via certain strings such as "P O C"...

CVE-2002-1422

admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters...

CVE-2002-1525

Directory traversal vulnerability in ASTAware SearchDisk engine for Sun ONE Starter Kit 2.0 allows remote attackers to read arbitrary files via a .. dot dot attack on port 1 6015 or 2 6016, or 3 an absolute pathname to port 6017...

CVE-2002-1470

SHOUTcast 1.8.9 and earlier is affected. A local attacker can obtain the cleartext administrative password by issuing a GET request to port 8001, which causes the password to be written to the world-readable sc_serv.log file. This exposes credentials via local access and file exposure. No remedia...