CVE-2002-1213

RadioBird Software WebServer 4 Everyone versions 1.23 and 1.27 (and earlier than 1.30) contain a directory-traversal vulnerability that lets remote attackers read arbitrary files via HTTP requests containing dot-dot sequences with URL-encoded forward slashes (%2F). Root cause: improper validation...

CVE-2002-1217

The CVE-2002-1217 entry describes a Cross-Frame scripting vulnerability in the WebBrowser control as used by Internet Explorer 5.5 and 6.0. The issue arises when script accesses the Document property, bypassing / domain restrictions, enabling remote attackers to execute arbitrary code, read arbit...

CVE-2002-1145

The xprunwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine MSDE 1.0, and Microsoft Desktop Engine MSDE 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owne...

CVE-2002-1212

Buffer overflow in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to cause a denial of service crash via a long HTTP GET request...

CVE-2002-1216

CVE-2002-1216 is a variant of a tar vulnerability where GNU tar versions around 1.13.x and later (including 1.16 and 1.15.1) are affected by a symlink-based attack that can overwrite arbitrary files. The root cause is improper handling of GNUTYPE_NAMES records with symbolic links in the extract_a...

[SECURITY] [DSA 179-1] New gnome-gv packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 179-1 [email protected] http://www.debian.org/security/ Martin Schulze October 18th, 2002 http://www.debian.org/security/faq -...

CVE-2002-1194

CVE-2002-1194 describes a buffer overflow in talkd on NetBSD 1.6 and earlier (and possibly other OSes), which could allow remote attackers to execute arbitrary code via a long inbound message. The available connected documents confirm the vulnerability exists in the talk daemon and the potential ...

CVE-2002-1190

CVE-2002-1190 : Cisco Unity 2.x and 3.x are affected by use of well-known default user accounts, which could allow remote attackers to gain access and place arbitrary calls. The available sources state this description without detailing exact affected versions beyond the 2.x/3.x range or any spec...

CVE-2002-1203

IBM SecureWay Firewall before 4.2.2 performs extra processing before determining that a packet is invalid and dropping it, which allows remote attackers to cause a denial of service resource exhaustion via a flood of malformed TCP packets without any flags set...

CVE-2002-1192

Multiple buffer overflows in rogue on NetBSD 1.6 and earlier, FreeBSD 4.6, and possibly other operating systems, allows local users to gain "games" group privileges via malformed entries in a game save file...

CVE-2002-1202

Unknown vulnerability in routed for HP Tru64 UNIX V4.0F through V5.1A allows local and remote attackers to read arbitrary files...

CVE-2002-1202

CVE-2002-1202 affects the routed component on HP Tru64 UNIX, from versions 4.0F through 5.1A. The vulnerability is described as an unknown issue that allows local and remote attackers to read arbitrary files. The connected documents do not provide concrete details beyond the affected product/vers...

CVE-2002-1192

CVE-2002-1192 describes multiple buffer overflows in the rogue game affecting NetBSD (1.6 and earlier) and FreeBSD 4.6 (and possibly other OSes). Local users can gain privileges in the 'games' group via malformed entries in a game save file. The root cause is not explicitly broken out beyond memo...

CVE-2002-0646

CVE-2002-0646 is a reservation duplicate of CVE-2002-0371. Connected documents provide concrete details for CVE-2002-0371: a buffer overflow in gopher client handling for Microsoft Internet Explorer 5.1–6.0, Proxy Server 2.0, or ISA Server 2000 that allows remote code execution via a crafted goph...

CVE-2002-1166

Buffer overflow in John Franks WN Server 1.18.2 through 2.0.0 allows remote attackers to execute arbitrary code via a long GET request...

CVE-2002-0839

The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service process kill or possibly other behaviors that would not normally be allowed, by modifying the...

CVE-2002-0969

Buffer overflow in MySQL daemon mysqld before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group...

CVE-2002-1146

The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary "read buffer...

CVE-2002-0865

A certain class that supports XML Extensible Markup Language in Microsoft Virtual Machine VM 5.0.3805 and earlier, probably com.ms.osp.ospmrshl, exposes certain unsafe methods, which allows remote attackers to execute unsafe code via a Java applet, aka "Inappropriate Methods Exposed in XML Suppor...

CVE-2002-0840

Cross-site scripting XSS vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different...