CVE-2002-0862

The 1 CertGetCertificateChain, 2 CertVerifyCertificateChainPolicy, and 3 WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints ...

CVE-2002-0862

CVE-2002-0862 concerns the CryptoAPI in Microsoft products (Windows 98 through XP; Office for Mac; IE for Mac; Outlook Express for Mac). The issue: the CertGetCertificateChain, CertVerifyCertificateChainPolicy, and WinVerifyTrust APIs fail to properly verify the Basic Constraints of intermediate ...

CVE-2002-1103

Cisco VPN 3000 Concentrator 2.2.x, 3.6Rel, and 3.x before 3.5.5, allows remote attackers to cause a denial of service via 1 malformed or 2 large ISAKMP packets...

CVE-2002-1114

configinc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters 1 gbottomincludepage, 2 gtopincludepage, 3 gcssincludefile, 4 gmetaincludefile, or 5 a cookie...

CVE-2002-1101

Cisco VPN 3000 Concentrator versions 2.2.x, 3.6(Rel), and 3.x before 3.5.5 are affected by CVE-2002-1101. The vulnerability allows remote attackers to cause a denial of service by sending a long username, indicating an input handling flaw that can exhaust resources and affect availability. No exp...

CVE-2002-0837

CVE-2002-0837 affects wordtrans 1.1pre8 and earlier in the wordtrans-web package. Root cause: improper input validation in wordtrans.php allows remote code execution or cross-site scripting via certain parameters (potentially including dict). Impact: remote arbitrary code execution and XSS. Remed...

CVE-2002-1094

Cisco VPN 3000 Series Concentrator Information Disclosure (CVE-2002-1094) affects 2.x.x and 3.x.x firmware up to but not including 3.5.4. The vulnerability leaks potentially sensitive information via banners in SSH, FTP, or an incorrect HTTP request, allowing remote information disclosure without...

CVE-2002-1114

CVE-2002-1114 affects MantisBT prior to 0.17.4. The issue allows remote attackers to execute arbitrary code or read arbitrary files via config_inc2.php by supplying values for g_bottom_include_page, g_top_include_page, g_css_include_file, g_meta_include_file, or via a cookie. The vulnerability pa...

[SECURITY] [DSA 163-1] New mhonarc packages fix cross site scripting problems

-------------------------------------------------------------------------- Debian Security Advisory DSA 163-1 [email protected] http://www.debian.org/security/ Martin Schulze September 9th, 2002 http://www.debian.org/security/faq -...

CVE-2002-0720

A handler routine for the Network Connection Manager NCM in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code...

CVE-2002-0654

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via 1 a request for a .var file, which leaks the pathname in the resulting error message, or 2 via an error message that occurs when a script child process cannot be invoked...

CVE-2002-0871

xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe...

CVE-2002-0632

Vulnerability in SGI BDS Bulk Data Service BDSPro 2.4 and earlier allows clients to read arbitrary files on a BDS server...

CVE-2002-0725

NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file...

CVE-2002-0855

Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the 1 adminpw or 2 info parameters to the ml-name feature...

CVE-2002-0872

l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions...

CVE-2002-0854

Buffer overflows in ISDN Point to Point Protocol PPP daemon ipppd in the i4l package on SuSE 7.3, 8.0, and possibly other operating systems, may allow local users to gain privileges...

CVE-2002-0857

Format string vulnerabilities in Oracle Listener Control utility lsnrctl for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file...

CVE-2002-0859

Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code...

CVE-2002-0851

Format string vulnerability in ISDN Point to Point Protocol PPP daemon ipppd in the ISDN4Linux i4l package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog...