CVE-2002-1102

The LAN-to-LAN IPSEC capability for Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.4, allows remote attackers to cause a denial of service via an incoming LAN-to-LAN connection with an existing security association with another device on the remote network, which causes the concentrator to...

CVE-2002-1115

Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the fid bug ID parameter to 1 bugupdateadvancedpage.php, 2 bugupdatepage.php, 3 viewbugadvancedpage.php, or 4 viewbugpage.php...

CVE-2002-1119

os.execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute arbitrary code via a symlink attack...

CVE-2002-1132

SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, which generates an error message when the file cannot be included in the script...

CVE-2002-0862

The 1 CertGetCertificateChain, 2 CertVerifyCertificateChainPolicy, and 3 WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints ...

CVE-2002-0879

showtemp.cfm for Gafware CFXImage 1.6.6 allows remote attackers to read arbitrary files via 1 a .. or 2 a C: style pathname in the FILE parameter...

CVE-2002-0880

Cisco IP Phone VoIP models 7910, 7940, and 7960 allow remote attackers to cause a denial of service crash via malformed packets as demonstrated by 1 "jolt", 2 "jolt2", 3 "raped", 4 "hping2", 5 "bloop", 6 "bubonic", 7 "mutant", 8 "trash", and 9 "trash2."...

CVE-2002-0887

scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files...

CVE-2002-0888

3Com OfficeConnect Remote 812 ADSL Router, firmware 1.1.9 and 1.1.7, allows remote attackers to bypass port access restrictions by connecting to an approved port and quickly connecting to the desired port, which is allowed by the router...

CVE-2002-0892

The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct request to com.newatlanta.servletexec.JSP10Servlet without a filename, which leaks the pathname in an error message...

CVE-2002-0893

Directory traversal vulnerability in NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to read arbitrary files via a URL-encoded request to com.newatlanta.servletexec.JSP10Servlet containing "..%5c" modified dot-dot sequences...

CVE-2002-0894

NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to cause a denial of service crash via 1 a request for a long .jsp file, or 2 a long URL sent directly to com.newatlanta.servletexec.JSP10Servlet...

CVE-2002-0899

Falcon web server 2.0.0.1021 and earlier allows remote attackers to bypass access restrictions for protected files via a URL whose directory portion ends in a . dot...

CVE-2002-0911

Caldera Volution Manager 1.1 stores the Directory Administrator password in cleartext in the slapd.conf file, which could allow local users to gain privileges...

CVE-2002-0926

Directory traversal vulnerability in Wolfram Research webMathematica 1.0.0 and 1.0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the MSPStoreID parameter...

CVE-2002-0930

Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 NWFTPD allows remote attackers to cause a denial of service ABEND via format strings in the USER command...

CVE-2002-0934

Directory traversal vulnerability in Jon Hedley AlienForm2 typically installed as af.cgi or alienform.cgi allows remote attackers to read or modify arbitrary files via an illegal character in the middle of a .. dot dot sequence in the parameters 1 browserout or 2 outfile...

CVE-2002-0935

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service resource exhaustion via a large number of requests to the server with null characters, which causes the working threads to hang...

CVE-2002-0937

The Java Server Pages JSP engine in JRun allows web page owners to cause a denial of service engine crash on the web server via a JSP page that calls WPrinterJob.pageSetupnull,null...

CVE-2002-0941

The ConsoleCallBack class for nCipher running under JRE 1.4.0 and 1.4.001, as used by the TrustedCodeTool and possibly other applications, may leak a passphrase when the user aborts an application that is prompting for the passphrase, which could allow attackers to gain privileges...