CVE-2002-0894

Affected software: NewAtlanta ServletExec ISAPI 4.1. The issue: remote denial of service caused by sending an overly long request for a .jsp file or a long URL to com.newatlanta.servletexec.JSP10Servlet. Vulnerable component: the ServletExec/JRun ISAPI handling for JSP requests. Impact: the remot...

CVE-2002-1087

The CVE-2002-1087 entry concerns ezContents 1.41 and earlier, where three scripts (createdir.php, removedir.php, uploadfile.php) fail to perform credential checks. This allows remote attackers to create or delete directories and upload files via a direct HTTP POST request. Documented impact is un...

CVE-2002-1065

The CVE-2002-1065 entry affects Jana Server 2.x up to 2.2.1 and 1.4.6 and earlier. The root cause is that the server does not restrict the number of unsuccessful login attempts, enabling remote attackers to perform brute-force username/password guesses to gain privileges. The connected documents ...

CVE-2002-0940

This CVE concerns domesticinstall.exe for nCipher MSCAPI CSP 5.50 and 5.54, where the software does not use Operator Card Set protected keys when the user requests them if the Operator Card Set has not been generated. The outcome is a lower protection level than the user-specified module protecti...

CVE-2002-0905

CVE-2002-0905 affects Informix SE-7.25, where a vulnerability in the sqlexec component allows a local user to trigger a buffer overflow through a long INFORMIXDIR environment variable, potentially gaining root privileges. The affected software/version is Informix SE-7.25; the vulnerable code path...

CVE-2002-0878

The vulnerability CVE-2002-0878 affects LogiSense software products Hawk-i Billing, Hawk-i ASP, and DNS Manager. It is a SQL injection flaw in the login form that allows remote attackers to bypass authentication by injecting SQL in the password field. The underlying issue is improper handling of ...

CVE-2002-0930

The CVE-2002-0930 entry describes a format-string vulnerability in the NWFTPD FTP server of Novell NetWare 6.0 SP1. The issue allows remote attackers to cause a denial of service (ABEND) via format strings in the USER command. Affected software explicitly named is the NWFTPD component of NetWare ...

CVE-2002-0960

CVE-2002-0960 describes multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier . The flaws allow remote attackers to execute arbitrary script in the context of other CBMS users, implying user-session impact and potential credential exposure via manipulated inputs. The...

CVE-2002-1037

CVE-2002-1037 describes a cross-site scripting vulnerability in Double Choco Latte (DCL) prior to 20020706. The issue allows remote attackers to inject arbitrary HTML, including script, into web pages via seven features: Ticket# Find, Priorities, Severities, Projects, WO# Find, Departments, and U...

CVE-2002-0997

CVE-2002-0997 affects Novell NetMail (NIMS) IMAP Agent (imapd) 3.0.3 and earlier. The issue is a buffer overflow that allows remote attackers to cause a denial of service. The available records describe the vulnerable component and impact but do not specify a patch version or remediation steps. N...

CVE-2002-1047

The CVE-2002-1047 entry concerns the FTP service in Watchguard Soho Firewall 5.0.35a. The vulnerability, as described in multiple sources, allows remote attackers to gain privileges when supplying a correct password but an incorrect user name. The available documents do not specify the exact root...

CVE-2002-0954

CVE-2002-0954 relates to Cisco PIX Firewall where the encryption algorithms for the enable and passwd commands can be cracked quickly due to a limited number of rounds. The published description indicates that this weakness facilitates brute‑force decryption of stored or transmitted passwords. Th...

CVE-2002-1009

The CVE-2002-1009 issue affects Lil’ HTTP Server (LilHTTP Web Server) via the pbcgi.cgi module. A cross-site scripting vulnerability allows remote attackers to inject and execute arbitrary web scripts in users’ browsers by supplying malicious input in the Name or E-mail parameters. This is a netw...

CVE-2002-0991

CVE-2002-0991 : Buffer overflows in the cifslogin command of HP CIFS/9000 Client A.01.06 and earlier (based on the Sharity package) allow local users to gain root privileges by supplying excessively long parameters (-U, -D, -P, -S, -N, or -u). Affected versions are A.01.06 and earlier. The provid...

CVE-2002-0879

CVE-2002-0879 affects Gafware CFXImage 1.6.6. The vulnerability arises in showtemp.cfm, allowing remote attackers to read arbitrary files via the FILE parameter using a .. path traversal or a C: style pathname. This is a file read/arbitrary file disclosure issue. The available documents do not pr...

CVE-2002-1058

CVE-2002-1058 is a directory traversal vulnerability in splashAdmin.php of Cobalt Qube 3.0. The root cause is use of .. sequences in the sessionId cookie that can reference an alternate session file, allowing local users and remote attackers to gain privileges as the Qube Admin. The vulnerability...

CVE-2002-1036

CVE-2002-1036 describes a cross-site scripting vulnerability in the Fluid Dynamics Search Engine (FDSE), specifically in search.pl. The issue allows remote attackers to inject and execute web script via the Rank or Match parameters on FDSE versions prior to 2.0.0.0055. The only details available ...

CVE-2002-0998

The CVE-2002-0998 entry affects CARE 2002 prior to beta 1.0.02 in cafenews.php, where the lang parameter is processed by include, enabling directory traversal to read arbitrary files via .. patterns (and null chars). The issue arises in the cafenews.php include call, affecting CARE 2002’s web com...

CVE-2002-1052

CVE-2002-1052 affects Jigsaw Web server 2.2.1 on Windows. The vulnerability arises from processing HTTP requests that reference MS-DOS device names (notably the con and aux devices), allowing an attacker to cause denial of service and, in some reports, to obtain the server’s physical path by send...

CVE-2002-1061

The CVE-2002-1061 entry concerns multiple buffer overflows in Jana Server (JanaServer) 2.x up to 2.2.1 and 1.4.6 and earlier. The root cause is improper handling of excessively long values in protocol responses/requests, notably: (1) long HTTP major version in an HTTP GET, (2) long major version ...