CVE-2002-2414

Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority CA certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service crash...

CVE-2002-2415

Allied Telesyn AT-8024 1.3.1 and Rapier 24 switches allow remote authenticated users to cause a denial of service in the management interface via a stream of zero null bytes sent via UDP to a running service...

CVE-2002-2416

Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. dot dot in a URL GET request...

CVE-2002-2419

Direct connect text client DCTC client 0.83.3 allows remote attackers to cause a denial of service crash via a string ending with a NULL byte character...

CVE-2002-2278

Cross-site scripting XSS vulnerability in modsearch/index.php in PortailPHP 0.99 allows remote attackers to inject arbitrary web script or HTML via the 1 $AppTheme, 2 $RubSearch, 3 $RubNews, 4 $RubFile, 5 $RubLiens, or 6 $RubFaq variables...

CVE-2002-2425

Sun AnswerBook2 1.2 through 1.4.2 allows remote attackers to execute administrative scripts such as 1 AdminViewError and 2 AdminAddadmin via a direct request...

CVE-2002-2288

Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request to index.php with a parameter that does not exist, which causes the path to be leaked in an error message...

CVE-2002-2289

soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive information including ODBC passwords...

CVE-2002-1571

The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on processors that do not clear all relevant SSE registers...

CVE-2002-1572

Signed integer overflow in the bttvread function in the bttv driver bttv-driver.c in Linux kernel before 2.4.20 has unknown impact and attack vectors...

CVE-2002-1626

Directory traversal vulnerability in Mike Spice My Calendar before 1.5 allows remote attackers to write arbitrary files via .. dot dot sequences in a URL...

CVE-2002-1627

Directory traversal vulnerability in quiz.cgi for Mike Spice Quiz Me! before 0.6 allows remote attackers to write arbitrary files via .. dot dot sequences in the quiz parameter...

CVE-2002-1629

Multi-Tech ProxyServer products MTPSR1-100, MTPSR1-120, MTPSR1-202ST, MTPSR2-201, and MTPSR3-200 ship with a null password, which allows remote attackers to gain administrative privileges via Telnet or HTTP...

CVE-2002-1630

The sendmail.jsp sample page in Oracle 9i Application Server 9iAS allows remote attackers to send arbitrary emails...

CVE-2002-1647

The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL...

CVE-2002-1657

PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...

CVE-2002-1663

The PostMethod function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service crash via a POST request with an invalid or missing Content-Length header value...

CVE-2002-1672

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...

CVE-2002-1674

procfs on FreeBSD before 4.5 allows local users to cause a denial of service kernel panic by removing a file that the fstatfs function refers to...

CVE-2002-1677

14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, which generates an error message that reveals the path...