CVE-2002-1295

The CVE-2002-1295 entry concerns the Microsoft Java VM used by Internet Explorer. The vulnerability arises when HTML applet tags bypass Java class restriction checks by supplying the class name in the code parameter, allowing remote attackers to cause a crash (denial of service) and potentially p...

CVE-2002-1281

CVE-2002-1281 is a KDE KIO rlogin/telnet protocol vulnerability. The KDE 2.x releases (2.1 and later) and KDE 3.x up to 3.0.4 allow a crafted URL in an HTML page, email, or other KIO-enabled app to execute arbitrary commands with the victim’s account, enabling local or remote code execution. Publ...

CVE-2002-1293

The Microsoft Java implementation, as used in Internet Explorer, provides a public load0 method for the CabCracker class com.ms.vm.loader.CabCracker, which allows remote attackers to bypass the security checks that are performed by the load method...

CVE-2002-1291

The vulnerability CVE-2002-1291 affects the Microsoft Java implementation used in Internet Explorer. An applet tag with a codebase set to a "file://%00" URL can allow remote attackers to read arbitrary local files and network shares. The provided documents identify the affected component and the ...

CVE-2002-1279

CVE-2002-1279 is a local privilege escalation in Masqmail. Multiple buffer overflows in Masqmail’s conf.c affect Masqmail 0.1.x (before 0.1.17) and 0.2.x (before 0.2.15). Exploitation via specific entries in the configuration file (-C) can grant elevated rights to local users. Debian advisories c...

CVE-2002-1282

CVE-2002-1282 concerns KDE’s KIO telnet protocol (telnet.protocol) in KDE 2.x; a crafted URL can cause arbitrary commands to execute with the victim’s privileges. The related KDE rlogin/telnet KIO vulnerabilities allow local/remote exploitation via HTML pages or KIO-enabled apps. Remediation per ...

CVE-2002-1276

CVE-2002-1276 concerns SquirrelMail XSS due to an incomplete fix in version 1.2.8 where strip_tags is applied to PHP_SELF but not saved back, leaving room for injection. OpenVAS notes the read_body.php path (SquirrelMail 1.2.9/1.2.10) as vulnerable to multiple parameter XSS. Debian security advis...

CVE-2002-1247

Buffer overflow in LISa/LISa-derived resLISa (KDE LAN browsing) allows local users to exploit through an overly long LOGNAME environment variable, enabling control of the resLISa process or related access. The vulnerability is triggered during parsing of LOGNAME, and exposed both in LISa and its ...

CVE-2002-1286

The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context via a URL that contains a colon in the domain portion, which is not properly parsed and loads an applet from a malicious site within the...

CVE-2002-1294

CVE-2002-1294 affects the Microsoft Java implementation used by Internet Explorer. The vulnerability arises when HTML object references to applets are exposed via JavaScript, allowing a remote attacker to cause a denial-of-service crash (illegal memory accesses) and potentially perform other unau...

CVE-2002-1245

Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, which allows local users to modify /dev/mem and gain privileges via a modified PATH environment variable that points to a Trojan horse gzip program...

CVE-2002-1180

A typographical error in the script source access permissions for Internet Information Server IIS 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."...

CVE-2002-1181

Multiple cross-site scripting XSS vulnerabilities in the administrative web pages for Microsoft Internet Information Server IIS 4.0 through 5.1 allow remote attackers to execute HTML script as other users through 1 a certain ASP file in the IISHELP virtual directory, or 2 possibly other unknown...

CVE-2002-1211

Prometheus 6.0 and earlier allows remote attackers to execute arbitrary PHP code via a modified PROMETHEUSLIBRARYBASE that points to code stored on a remote server, which is then used in 1 index.php, 2 install.php, or 3 various test.php scripts...

CVE-2002-1239

QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to find and execute the cp program while operating at raised privileges, which allows local users to gain privileges by modifying the PATH to point to a malicious cp program...

CVE-2002-1244

Format string vulnerability in Pablo FTP Server 1.5, 1.3, and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format strings in the USER command...

CVE-2002-1264

Buffer overflow in Oracle iSQLPlus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL...

CVE-2002-1271

The Mail::Mailer Perl module in the perl-MailTools package 1.47 and earlier uses mailx as the default mailer, which allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx...

CVE-2002-1278

The mailconf module in Linuxconf 1.24, and other versions before 1.28, on Conectiva Linux 6.0 through 8, and possibly other distributions, generates the Sendmail configuration file sendmail.cf in a way that configures Sendmail to run as an open mail relay, which allows remote attackers to send Sp...

ISC BIND named SIG Resource Server Response RR Overflow

The remote BIND server, according to its version number, is affected by the 'SIG cached RR overflow' vulnerability. An attacker may use this flaw to gain a shell on this system. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid11152; scriptversion"1.30";...