CVE-2002-0921

CGIScript.net csNews.cgi allows remote attackers to obtain potentially sensitive information, such as the full server pathname and other configuration settings, via the viewnews command with an invalid database, which leaks the information in error messages...

CVE-2002-0939

The Install Wizard for nCipher MSCAPI CSP 5.50 does not use Operator Card Set protected keys when the user requests them but does not generate the Operator Card Set, which results in a lower protection level than specified by the user module protection only...

CVE-2002-0949

Telindus 1100 series ADSL router allows remote attackers to gain privileges to the device via a certain packet to UDP port 9833, which generates a reply that includes the router's password and other sensitive information in cleartext...

CVE-2002-0957

The default configuration of BlackICE Agent 3.1.eal and 3.1.ebh has a high tcp.maxconnections setting, which could allow remote attackers to cause a denial of service memory consumption via a large number of connections to the BlackICE system that consumes more resources than intended by the user...

CVE-2002-0999

Multiple SQL injection vulnerabilities in CARE 2002 before beta 1.0.02 allow remote attackers to perform unauthorized database operations...

CVE-2002-1010

Lotus Domino R4 allows remote attackers to bypass access restrictions for files in the web root via an HTTP request appended with a "?" character, which is treated as a wildcard character and bypasses the web handlers...

CVE-2002-1011

Buffer overflow in web server for Tivoli Management Framework TMF Endpoint 3.6.x through 3.7.1, before Fixpack 2, allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request...

CVE-2002-1034

none.php for SunPS iRunbook 2.5.2 allows remote attackers to read arbitrary files via an absolute pathname in the argument...

CVE-2002-1043

Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service crash via a malformed Subject "\t\t"...

CVE-2002-1052

Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to 1 cause a denial of service using the "con" device, or 2 obtain the physical path of the server using two requests to the "aux" device...

CVE-2002-1065

Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, does not restrict the number of unsuccessful login attempts, which makes it easier for remote attackers to gain privileges via brute force username and password guessing...

CVE-2002-1066

Thomas Hauck Jana Server 1.4.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large message index value in a 1 RETR or 2 DELE command to the POP3 server, which exceeds the array limits and allows a buffer overflow attack...

CVE-2002-1067

Administrative web interface for IC9 Pocket Print Server Firmware 7.1.30 and 7.1.36f allows remote attackers to cause a denial of service reboot and reset via a long password, possibly due to a buffer overflow...

CVE-2002-1087

The scripts 1 createdir.php, 2 removedir.php and 3 uploadfile.php for ezContents 1.41 and earlier do not check credentials, which allows remote attackers to create or delete directories and upload files via a direct HTTP POST request...

CVE-2002-0885

The CVE-2002-0885 entry describes multiple buffer overflows in in.rarpd (the ARP server) on Solaris and potentially other OSes (Caldera UnixWare, Open UNIX). The underlying issue is a vulnerability in functions (1) syserr and (2) error that could allow remote attackers to execute arbitrary code. ...

CVE-2002-1067

The CVE-2002-1067 entry concerns the IC9 Pocket Print Server Firmware (versions 7.1.30 and 7.1.36f). The vulnerability is a remote denial-of-service (reboot/reset) triggered by sending a long password, with the described root cause possibly a buffer overflow. The available connected documents con...

CVE-2002-0894

Affected software: NewAtlanta ServletExec ISAPI 4.1. The issue: remote denial of service caused by sending an overly long request for a .jsp file or a long URL to com.newatlanta.servletexec.JSP10Servlet. Vulnerable component: the ServletExec/JRun ISAPI handling for JSP requests. Impact: the remot...

CVE-2002-0922

The CVE-2002-0922 issue affects the CGIScript.net csNews.cgi CGI script. It allows remote attackers to obtain database files (default.db and default.db.style) via direct URL-encoded requests, and also permits remote authenticated users to perform administrative actions when a database parameter i...

CVE-2002-0905

CVE-2002-0905 affects Informix SE-7.25, where a vulnerability in the sqlexec component allows a local user to trigger a buffer overflow through a long INFORMIXDIR environment variable, potentially gaining root privileges. The affected software/version is Informix SE-7.25; the vulnerable code path...

CVE-2002-1078

Affects Abyss Web Server 1.0.3. The vulnerability allows remote attackers to trigger directory listing by sending an HTTP GET request that ends with a large sequence of / characters. The underlying cause is not detailed in the provided documents beyond the request construction; the impact is expo...