CVE-2002-0902

CVE-2002-0902 describes a cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2). An attacker can cause script execution in other phpBB users’ browsers by inserting a http:// and a double-quote (") into an IMG tag, bypassing phpBB’s security check, which terminates the src parameter of the IM...

CVE-2002-1001

Buffer overflows in AnalogX Proxy before 4.12 allows remote attackers to cause a denial of service and possibly execute arbitrary code via 1 a long HTTP request to TCP port 6588 or 2 a SOCKS 4A request to TCP port 1080 with a long DNS hostname...

CVE-2002-0913

CVE-2002-0913 describes a format string vulnerability in the Slurp NNTP client 1.1.0, specifically in the log_doit function. A malicious news server can exploit this by sending a crafted server response to execute arbitrary code on the affected client. The vulnerability is network-based with low ...

CVE-2002-0925

Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via 1 the USER command to mmpop3d for mmmail 0.0.13 and earlier, 2 the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or 3 the USER command to mmftpd 0.0.7 and earlier...

CVE-2002-1009

The CVE-2002-1009 issue affects Lil’ HTTP Server (LilHTTP Web Server) via the pbcgi.cgi module. A cross-site scripting vulnerability allows remote attackers to inject and execute arbitrary web scripts in users’ browsers by supplying malicious input in the Name or E-mail parameters. This is a netw...

CVE-2002-0907

CVE-2002-0907 affects SHOUTcast servers (notably 1.8.9 and other versions prior to 1.8.12). The issue is a buffer overflow triggered by a long value in a header starting with icy-, allowing a remote authenticated DJ to execute arbitrary code on the server. The available data do not describe explo...

CVE-2002-0886

Cisco DSL CPE devices running CBOS 2.4.4 and earlier are affected by CVE-2002-0886. The issue allows remote attackers to cause a denial of service by sending (1) a large packet to the DHCP port, (2) a large packet to the Telnet port, or (3) a flood of large packets to the CPE, exhausting TCP/IP s...

CVE-2002-1033

CVE-2002-1033 : Affected product is SunPS iRunbook 2.5.2, vulnerable in the none.php component. The issue is a directory traversal flaw triggered by a using a "..:" sequence in the argument, allowing remote attackers to read arbitrary files. The vulnerability is documented with a Medium impact (p...

CVE-2002-1072

CVE-2002-1072 affects ZyXEL Prestige devices (642R and Prestige 310) due to a vulnerability in handling oversized, fragmented ICMP packets (jolt style). The issue allows remote attackers to induce a denial of service. The available sources confirm affected models and the general impact (availabil...

CVE-2002-1012

CVE-2002-1012 affects IBM Tivoli Management Framework (TMF) ManagedNode, specifically TMF 3.6.x through 3.7.1. It is a remote vulnerability: a crafted long HTTP GET request can trigger a buffer overflow in the web server, leading to denial of service or arbitrary code execution. The issue is docu...

CVE-2002-1069

CVE-2002-1069 concerns the D-Link DI-804 router (firmware 4.68). The weakness allows remote attackers to bypass authentication via direct access to web pages (release.htm, Device Status, Device Information) and perform actions such as releasing DHCP addresses or retrieving sensitive data. The und...

CVE-2002-0936

CVE-2002-0936 affects the Java Server Pages (JSP) engine in Apache Tomcat. A JSP page that calls WPrinterJob().pageSetup(null,null) can cause a denial of service by crashing the web server. The published materials describe the vulnerability and impact but do not provide a listed fix or patch with...

CVE-2002-1011

CVE-2002-1011: A buffer overflow in the Tivoli Management Framework (TMF) Endpoint web server (versions 3.6.x–3.7.1) allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request. Root cause is buffer overflow in the web server handling of long URLs; i...

CVE-2002-0883

Vulnerability in Compaq ProLiant BL e-Class Integrated Administrator 1.0 and 1.10, allows authenticated users with Telnet, SSH, or console access to conduct unauthorized activities...

CVE-2002-0913

Format string vulnerability in logdoit function of Slurp NNTP client 1.1.0 allows a malicious news server to execute arbitrary code on the client via format strings in a server response...

CVE-2002-0908

Cisco IDS Device Manager web server prior to version 3.1.2 is affected by a directory traversal vulnerability that allows remote attackers to read arbitrary files through a .. sequence in an HTTPS request. Affected software is the Cisco IDS Device Manager web service; the root cause is improper v...

CVE-2002-0909

CVE-2002-0909 affects mnews 1.22 and earlier. The issue involves multiple buffer overflows that can be triggered by excessively long NNTP responses, long command-line arguments (-f, -n, -D, -M, -P) or long environment variables (JNAMES, MAILSERVER), enabling either remote code execution by a serv...

CVE-2002-1034

CVE-2002-1034 affects SunPS iRunbook 2.5.2. The vulnerability is triggered through none.php by supplying an absolute pathname as an argument, enabling remote attackers to read arbitrary files and potentially compromise confidentiality (and integrity per CVSS). The available connected documents pr...

CVE-2002-0944

Cross-site scripting vulnerability in DeepMetrix LiveStats 5.03–6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via the (1) user-agent or (2) referrer, which are not filtered by the stats program. Affected: DeepMetrix LiveStats versions 5.03 through 6.2.1. Impact: ...

CVE-2002-1062

The CVE-2002-1062 issue is a signedness error in Thomas Hauck Jana Server versions 2.x (up to 2.2.1) and 1.4.6 and earlier. It allows remote attackers to execute arbitrary code by sending overly long values for (1) Username, (2) Password, or (3) Hostname. The available documents identify the affe...