CVE-2002-0948

The CVE-2002-0948 entry concerns Scripts For Educators MakeBook 2.2 CGI, where the (1) Name and (2) Email parameters are not properly filtered. This allows remote attackers to execute arbitrary scripts as other visitors, or to trigger server-side includes (SSI) with the web server context. The NV...

CVE-2002-0926

The CVE-2002-0926 issue affects Wolfram Research webMathematica 1.0.0 and 1.0.0.1. A directory-traversal vulnerability allows remote attackers to read arbitrary files by manipulating the MSPStoreID parameter. The CERT/CC entry corroborates that reading arbitrary files is possible via absolute pat...

CVE-2002-0922

The CVE-2002-0922 issue affects the CGIScript.net csNews.cgi CGI script. It allows remote attackers to obtain database files (default.db and default.db.style) via direct URL-encoded requests, and also permits remote authenticated users to perform administrative actions when a database parameter i...

CVE-2002-0902

CVE-2002-0902 describes a cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2). An attacker can cause script execution in other phpBB users’ browsers by inserting a http:// and a double-quote (") into an IMG tag, bypassing phpBB’s security check, which terminates the src parameter of the IM...

CVE-2002-0930

Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 NWFTPD allows remote attackers to cause a denial of service ABEND via format strings in the USER command...

CVE-2002-0943

MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb...

CVE-2002-0939

The Install Wizard for nCipher MSCAPI CSP 5.50 does not use Operator Card Set protected keys when the user requests them but does not generate the Operator Card Set, which results in a lower protection level than specified by the user module protection only...

CVE-2002-0959

Cross-site scripting vulnerability in Splatt Forum 3.0 allows remote attackers to execute arbitrary script as other users via an img tag with a closing quote followed by the script...

CVE-2002-0992

Unknown vulnerability in IPV6 functionality for DCE daemons 1 dced or 2 rpcd on HP-UX 11.11 allows attackers to cause a denial of service crash via an attack that modifies internal data...

CVE-2002-1077

IPSwitch IMail Web Calendaring service iwebcal allows remote attackers to cause a denial of service crash via an HTTP POST request without a Content-Length field...

CVE-2002-0961

Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other users, e.g. by deleting clients via dltclnt.php, possibly in a SQL injection attack...

CVE-2002-0910

Buffer overflows in netstd 3.07-17 package allows remote DNS servers to execute arbitrary code via a long FQDN reply, as observed in the utilities 1 linux-ftpd, 2 pcnfsd, 3 tftp, 4 traceroute, or 5 from/to...

CVE-2002-1061

Multiple buffer overflows in Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, allow remote attackers to cause a denial of service and possibly execute arbitrary code via 1 an HTTP GET request with a long major version number, 2 an HTTP GET request to the HTTP proxy on port 3128...

CVE-2002-1067

Administrative web interface for IC9 Pocket Print Server Firmware 7.1.30 and 7.1.36f allows remote attackers to cause a denial of service reboot and reset via a long password, possibly due to a buffer overflow...

CVE-2002-1001

Buffer overflows in AnalogX Proxy before 4.12 allows remote attackers to cause a denial of service and possibly execute arbitrary code via 1 a long HTTP request to TCP port 6588 or 2 a SOCKS 4A request to TCP port 1080 with a long DNS hostname...

CVE-2002-0917

CGIScript.net csPassword.cgi stores .htpasswd files under the web document root, which could allow remote authenticated users to download the file and crack the passwords of other users...

CVE-2002-0954

The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, which make it easier for an attacker to decrypt the passwords using brute force techniques...

CVE-2002-1084

The VerifyLogin function in ezContents 1.41 and earlier does not properly halt program execution if a user fails to log in properly, which allows remote attackers to modify and view restricted information via HTTP POST requests...

CVE-2002-1608

Buffer overflow in traceroute in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to execute arbitrary code...

CVE-2002-1062

The CVE-2002-1062 issue is a signedness error in Thomas Hauck Jana Server versions 2.x (up to 2.2.1) and 1.4.6 and earlier. It allows remote attackers to execute arbitrary code by sending overly long values for (1) Username, (2) Password, or (3) Hostname. The available documents identify the affe...