5507 matches found
CVE-2002-1086
The CVE-2002-1086 entry relates to multiple SQL injection vulnerabilities in ezContents 1.41 and earlier. The affected software is ezContents (versions up to 1.41). Underlying cause is input handling leading to SQL injection. The vulnerability is assessable as network-exploitable with no authenti...
CVE-2002-1087
The CVE-2002-1087 entry concerns ezContents 1.41 and earlier, where three scripts (createdir.php, removedir.php, uploadfile.php) fail to perform credential checks. This allows remote attackers to create or delete directories and upload files via a direct HTTP POST request. Documented impact is un...
CVE-2002-1089
CVE-2002-1089 affects rwcgi60, the CGI used with Oracle Reports Server. The flaw is an information disclosure: the program can reveal sensitive data (the full pathname), which an attacker could leverage for further attacks. Connected documents (Nessus plugin) confirm rwcgi60 exposure as part of O...
CVE-2002-0942
Buffer overflows in Lugiment Log Explorer before 3.02 allow attackers with database permissions to execute arbitrary code via long arguments to the extended stored procedures 1 xplogattachStartProf, 2 xplogattachsetport, or 3 xplogattach...
CVE-2002-1044
CVE-2002-1044 describes a buffer overflow in Ultrafunk Popcorn 1.20. The vulnerability allows remote attackers to crash the application and potentially execute arbitrary code via a long Subject field. The available sources confirm a network-exploitable flaw with Partial confidentiality, integrity...
CVE-2002-0926
The CVE-2002-0926 issue affects Wolfram Research webMathematica 1.0.0 and 1.0.0.1. A directory-traversal vulnerability allows remote attackers to read arbitrary files by manipulating the MSPStoreID parameter. The CERT/CC entry corroborates that reading arbitrary files is possible via absolute pat...
CVE-2002-0955
CVE-2002-0955 describes a cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier. An attacker can supply a malicious script via the num parameter, which is not filtered in the resulting error message, allowing the script to run in the context o...
CVE-2002-1077
IMail Web Calendaring service (iwebcal) in IPSwitch IMail is affected by CVE-2002-1077. A remote attacker can cause a denial of service (crash) by sending an HTTP POST request that lacks a Content-Length header. The description and connected records confirm the affected component and the vulnerab...
CVE-2002-1021
Summary of CVE-2002-1021 (BadBlue Hex-encoded Null Byte) The vulnerability affects the BadBlue web server and allows remote attackers to read restricted files (notably EXT.INI, the BadBlue configuration file) by sending an HTTP request containing a hex-encoded NULL byte. This constitutes an infor...
CVE-2002-1080
The CVE-2002-1080 entry affects Abyss Web Server 1.0.3 prior to Patch 2. Remote attackers can gain privileges and modify server configuration through direct requests to CHL files (srvstatus.chl, consport.chl, general.chl, srvparam.chl, advanced.chl). The available sources confirm the affected pro...
CVE-2002-1026
CVE-2002-1026 affects Macromedia Sitespring 1.2.0 (277.1) using the Sybase runtime engine 7.0.2.1480. The vulnerability allows remote attackers to cause a denial of service (crash) via a long malformed request to TCP port 2500, possibly triggering a buffer overflow. Impact is listed as partial av...
CVE-2002-0929
CVE-2002-0929 describes a buffer overflow in the DHCP server of NetWare 6.0 SP1 that allows remote attackers to cause a denial of service (reboot) by sending long DHCP requests. The affected component is the DHCP server on NetWare 6.0 SP1; the underlying cause is a buffer overflow vulnerability. ...
CVE-2002-0999
CARE 2002 is affected by multiple SQL injection vulnerabilities in versions before beta 1.0.02, allowing remote attackers to perform unauthorized database operations. The root cause is SQL injection in CARE 2002 prior to 1.0.02. Impact, as described in sources, includes unauthorized database mani...
CVE-2002-0962
Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via 1 the url variable in the Link field of a calendar event, 2 the topic parameter in index.php, or 3 the title parameter in comment.php...
CVE-2002-1029
CVE-2002-1029 describes a Denial of Service in Worldspan for Windows Gateway 4.1, specifically the Res Manager component. An attacker can remotely crash the service by sending a malformed request to TCP port 17990, leading to partial availability impact. The vulnerability is documented in multipl...
CVE-2002-1001
AnalogX Proxy (versions before 4.12) is vulnerable to a buffer overflow in the SOCKS4A hostname handling and in long HTTP requests sent to port 6588 and 1080, respectively. An attacker could remotely crash the service and potentially execute code due to the overflow. Evidence in connected documen...
CVE-2002-1045
Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service crash via a malformed Date field that is converted into a year greater than 2037...
CVE-2002-0934
Directory traversal vulnerability in Jon Hedley AlienForm2 typically installed as af.cgi or alienform.cgi allows remote attackers to read or modify arbitrary files via an illegal character in the middle of a .. dot dot sequence in the parameters 1 browserout or 2 outfile...