CVE-2002-0934

Directory traversal vulnerability in Jon Hedley AlienForm2 typically installed as af.cgi or alienform.cgi allows remote attackers to read or modify arbitrary files via an illegal character in the middle of a .. dot dot sequence in the parameters 1 browserout or 2 outfile...

CVE-2002-0998

Directory traversal vulnerability in cafenews.php for CARE 2002 before beta 1.0.02 allows remote attackers to read arbitrary files via .. dot dot sequences and null characters in the lang parameter, which is processed by a call to the include function...

CVE-2002-0919

CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privileges via newlines in the title field of the edit page...

CVE-2002-1034

none.php for SunPS iRunbook 2.5.2 allows remote attackers to read arbitrary files via an absolute pathname in the argument...

CVE-2002-1026

CVE-2002-1026 affects Macromedia Sitespring 1.2.0 (277.1) using the Sybase runtime engine 7.0.2.1480. The vulnerability allows remote attackers to cause a denial of service (crash) via a long malformed request to TCP port 2500, possibly triggering a buffer overflow. Impact is listed as partial av...

CVE-2002-0886

Cisco DSL CPE devices running CBOS 2.4.4 and earlier are affected by CVE-2002-0886. The issue allows remote attackers to cause a denial of service by sending (1) a large packet to the DHCP port, (2) a large packet to the Telnet port, or (3) a flood of large packets to the CPE, exhausting TCP/IP s...

CVE-2002-1045

Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service crash via a malformed Date field that is converted into a year greater than 2037...

CVE-2002-0877

CVE-2002-0877 describes a directory traversal vulnerability in the FTP server for Shambala 4.5. The flaw allows remote attackers to read arbitrary files by injecting .. (dot dot) into the LIST (ls) or GET commands. Public details in the provided sources confirm the vulnerability class (directory ...

CVE-2002-1026

Macromedia Sitespring 1.2.0 277.1 using Sybase runtime engine 7.0.2.1480 allows remote attackers to cause a denial of service crash via a long malformed request to TCP port 2500, possibly triggering a buffer overflow...

CVE-2002-0955

CVE-2002-0955 describes a cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier. An attacker can supply a malicious script via the num parameter, which is not filtered in the resulting error message, allowing the script to run in the context o...

CVE-2002-0921

The CVE-2002-0921 vulnerability affects CGIScript.net csNews.cgi, where the viewnews command against an invalid database may cause error messages to reveal sensitive information such as the full server pathname and configuration settings. The available sources (NVD/CVE entries) describe the infor...

CVE-2002-1065

Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, does not restrict the number of unsuccessful login attempts, which makes it easier for remote attackers to gain privileges via brute force username and password guessing...

CVE-2002-0913

Format string vulnerability in logdoit function of Slurp NNTP client 1.1.0 allows a malicious news server to execute arbitrary code on the client via format strings in a server response...

CVE-2002-1038

CVE-2002-1038 concerns Double Choco Latte (DCL) prior to 20020706, where upload handling does not properly verify the file uploaded. This allows remote attackers to perform certain operations on arbitrary files via the two features: (1) Projects: Upload File Attachment and (2) Work Orders: Import...

CVE-2002-1008

CVE-2002-1008 describes a cross-site scripting vulnerability in PowerBASIC urlcount.cgi, included with Lil’ HTTP web server. The flaw allows remote attackers to induce execution of web script in another browser by crafting a request to urlcount.cgi that contains unfiltered script, particularly wh...

CVE-2002-0959

The CVE-2002-0959 entry refers to a Cross-site scripting vulnerability in Splatt Forum 3.0. The issue allows remote attackers to execute arbitrary script as other users by abusing an tag with a closing quote followed by malicious script. According to the NVD entry, the vulnerability has a base s...

CVE-2002-0921

CGIScript.net csNews.cgi allows remote attackers to obtain potentially sensitive information, such as the full server pathname and other configuration settings, via the viewnews command with an invalid database, which leaks the information in error messages...

CVE-2002-1080

The Administration console for Abyss Web Server 1.0.3 before Patch 2 allows remote attackers to gain privileges and modify server configuration via direct requests to CHL files such as 1 srvstatus.chl, 2 consport.chl, 3 general.chl, 4 srvparam.chl, and 5 advanced.chl...

CVE-2002-1022

CVE-2002-1022 affects BadBlue server. The vulnerability arises because passwords are stored in plaintext in the ext.ini file, enabling local and possibly remote attackers to escalate privileges. The connected documents corroborate the plaintext storage and the potential privilege gain, but do not...

CVE-2002-1020

The CVE-2002-1020 entry concerns Adobe Content Server 3.0. The vulnerability arises in the library feature used for the Add to bookbag operation: when the server reports that no more copies are available, a remote attacker can still check out an eBook. This implies an underlying logic flaw where ...