CVE-2002-0908

Directory traversal vulnerability in the web server for Cisco IDS Device Manager before 3.1.2 allows remote attackers to read arbitrary files via a .. dot dot in the HTTPS request...

CVE-2002-0885

Multiple buffer overflows in in.rarpd ARP server on Solaris, and possibly other operating systems including Caldera UnixWare and Open UNIX, allow remote attackers to execute arbitrary code, possibly via the functions 1 syserr and 2 error...

CVE-2002-0925

Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via 1 the USER command to mmpop3d for mmmail 0.0.13 and earlier, 2 the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or 3 the USER command to mmftpd 0.0.7 and earlier...

CVE-2002-1034

CVE-2002-1034 affects SunPS iRunbook 2.5.2. The vulnerability is triggered through none.php by supplying an absolute pathname as an argument, enabling remote attackers to read arbitrary files and potentially compromise confidentiality (and integrity per CVSS). The available connected documents pr...

CVE-2002-0918

CGIScript.net csPassword.cgi leaks sensitive information such as the pathname of the server in debug messages that are presented when the script fails, which allows remote attackers to obtain the information via a "remove" option in the command parameter, which generates an error...

CVE-2002-1044

CVE-2002-1044 describes a buffer overflow in Ultrafunk Popcorn 1.20. The vulnerability allows remote attackers to crash the application and potentially execute arbitrary code via a long Subject field. The available sources confirm a network-exploitable flaw with Partial confidentiality, integrity...

CVE-2002-0933

CVE-2002-0933 affects Datalex PLC BookIt! Consumer prior to version 2.2. The issue stems from usernames/passwords being stored in plaintext in a cookie, enabling remote attackers to gain privileges through cross-site scripting or sniffing. The NVD metrics indicate partial impact to confidentialit...

CVE-2002-1064

CVE-2002-1064 affects Jana Server 2.x (up to 2.2.1) and 1.4.6 and earlier. The vulnerability arises because the server generates different responses for valid versus invalid usernames, enabling remote attackers to enumerate valid user accounts. The available documents state the existence and impa...

CVE-2002-1052

Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to 1 cause a denial of service using the "con" device, or 2 obtain the physical path of the server using two requests to the "aux" device...

CVE-2002-1071

CVE-2002-1071 affects ZyXEL Prestige 642R. A remote attacker can cause denial of service on Telnet, FTP, and DHCP services by sending a TCP packet with both SYN and ACK flags set. The description in the sources confirms the crash vector but does not provide specific patch versions or remediation ...

CVE-2002-1073

CVE-2002-1073 describes a buffer overflow in the control service of MERCUR Mailserver 4.2, allowing remote attackers to execute arbitrary code via a long password. The vulnerability is documented in CVE databases (NVD/CVE) with a CVSS v2 base score of 7.5 (HIGH) and remote network access without ...

CVE-2002-0943

CVE-2002-0943 describes a vulnerability where MetaCart2.sql stores the user database (metacart.mdb) under the web document root without access controls, enabling remote attackers to obtain sensitive information (passwords, credit card numbers) via direct request. The root cause is lack of access ...

CVE-2002-1011

CVE-2002-1011: A buffer overflow in the Tivoli Management Framework (TMF) Endpoint web server (versions 3.6.x–3.7.1) allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request. Root cause is buffer overflow in the web server handling of long URLs; i...

CVE-2002-1062

The CVE-2002-1062 issue is a signedness error in Thomas Hauck Jana Server versions 2.x (up to 2.2.1) and 1.4.6 and earlier. It allows remote attackers to execute arbitrary code by sending overly long values for (1) Username, (2) Password, or (3) Hostname. The available documents identify the affe...

CVE-2002-0999

CARE 2002 is affected by multiple SQL injection vulnerabilities in versions before beta 1.0.02, allowing remote attackers to perform unauthorized database operations. The root cause is SQL injection in CARE 2002 prior to 1.0.02. Impact, as described in sources, includes unauthorized database mani...

CVE-2002-1080

The CVE-2002-1080 entry affects Abyss Web Server 1.0.3 prior to Patch 2. Remote attackers can gain privileges and modify server configuration through direct requests to CHL files (srvstatus.chl, consport.chl, general.chl, srvparam.chl, advanced.chl). The available sources confirm the affected pro...

CVE-2002-0929

CVE-2002-0929 describes a buffer overflow in the DHCP server of NetWare 6.0 SP1 that allows remote attackers to cause a denial of service (reboot) by sending long DHCP requests. The affected component is the DHCP server on NetWare 6.0 SP1; the underlying cause is a buffer overflow vulnerability. ...

CVE-2002-1045

CVE-2002-1045 affects Ultrafunk Popcorn 1.20. A malformed Date field can be converted into a year > 2037, allowing remote attackers to cause a crash (DoS). Based on NVD/NVD summaries, impact is partial availability with network access, no authentication required, and no confidentiality/integri...

CVE-2002-0918

The vulnerability CVE-2002-0918 affects CGIScript.net csPassword.cgi. The root cause is leakage of the server pathname via debug messages generated on script failure, which can be triggered through a remote attacker using a remove option in the command parameter to cause an error. Impact is expos...

CVE-2002-0944

Cross-site scripting vulnerability in DeepMetrix LiveStats 5.03–6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via the (1) user-agent or (2) referrer, which are not filtered by the stats program. Affected: DeepMetrix LiveStats versions 5.03 through 6.2.1. Impact: ...