CVE-2002-0918

CGIScript.net csPassword.cgi leaks sensitive information such as the pathname of the server in debug messages that are presented when the script fails, which allows remote attackers to obtain the information via a "remove" option in the command parameter, which generates an error...

CVE-2002-0919

CGIScript.net csPassword.cgi is vulnerable: remote authenticated users can modify the .htaccess file and gain privileges by injecting newlines in the title field of the edit page. The impact is privilege escalation through file modification. No remediation or fix details are provided in the suppl...

CVE-2002-0930

The CVE-2002-0930 entry describes a format-string vulnerability in the NWFTPD FTP server of Novell NetWare 6.0 SP1. The issue allows remote attackers to cause a denial of service (ABEND) via format strings in the USER command. Affected software explicitly named is the NWFTPD component of NetWare ...

CVE-2002-0930

Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 NWFTPD allows remote attackers to cause a denial of service ABEND via format strings in the USER command...

CVE-2002-1037

CVE-2002-1037 describes a cross-site scripting vulnerability in Double Choco Latte (DCL) prior to 20020706. The issue allows remote attackers to inject arbitrary HTML, including script, into web pages via seven features: Ticket# Find, Priorities, Severities, Projects, WO# Find, Departments, and U...

CVE-2002-1047

The CVE-2002-1047 entry concerns the FTP service in Watchguard Soho Firewall 5.0.35a. The vulnerability, as described in multiple sources, allows remote attackers to gain privileges when supplying a correct password but an incorrect user name. The available documents do not specify the exact root...

CVE-2002-1038

Double Choco Latte DCL before 20020706 does not properly verify if a file was uploaded, which allows remote attackers to conduct certain operations on arbitrary files via the 1 Projects: Upload File Attachment or 2 Work Orders: Import features...

CVE-2002-1061

The CVE-2002-1061 entry concerns multiple buffer overflows in Jana Server (JanaServer) 2.x up to 2.2.1 and 1.4.6 and earlier. The root cause is improper handling of excessively long values in protocol responses/requests, notably: (1) long HTTP major version in an HTTP GET, (2) long major version ...

CVE-2002-0944

Cross-site scripting vulnerability in DeepMetrix LiveStats 5.03 through 6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via the 1 user-agent or 2 referrer, which are not filtered by the stats program...

CVE-2002-1027

Cross-site scripting vulnerability in the default HTTP 500 error script 500error.jsp for Macromedia Sitespring 1.2.0 277.1 allows remote attackers to execute arbitrary web script via a link to 500error.jsp with the script in 1the et parameter...

CVE-2002-1023

BadBlue server allows remote attackers to cause a denial of service crash via an HTTP GET request without a URI...

CVE-2002-1058

CVE-2002-1058 is a directory traversal vulnerability in splashAdmin.php of Cobalt Qube 3.0. The root cause is use of .. sequences in the sessionId cookie that can reference an alternate session file, allowing local users and remote attackers to gain privileges as the Qube Admin. The vulnerability...

CVE-2002-1019

CVE-2002-1019 affects the Adobe Content Server 3.0 library feature. The vulnerability arises in a downloadable eBook workflow where a remote attacker can manipulate the loanMin parameter in download.asp to extend the loan period for an arbitrary length of time. The available documentation explici...

CVE-2002-1009

Cross-site scripting vulnerability in PowerBASIC pbcgi.cgi, as included in Lil' HTTP web server, allows remote attackers to execute arbitrary web script in other web browsers via the 1 "Name" or 2 "E-mail" parameters...

CVE-2002-1043

CVE-2002-1043 affects Ultrafunk Popcorn 1.20. The vulnerability is a denial-of-service triggered by a malformed Subject ("\t\t"), allowing remote attackers to crash the application. The available documents do not provide exploit code, implicated vectors beyond remote trigger, or concrete mitigati...

CVE-2002-1058

Directory traversal vulnerability in splashAdmin.php for Cobalt Qube 3.0 allows local users and remote attackers, to gain privileges as the Qube Admin via .. dot dot sequences in the sessionId cookie that point to an alternate session file...

CVE-2002-1033

Directory traversal vulnerability in none.php for SunPS iRunbook 2.5.2 allows remote attackers to read arbitrary files via a "..:" sequence dot-dot variant in the argument...

CVE-2002-0917

CGIScript.net csPassword.cgi stores .htpasswd files under the web document root, which could allow remote authenticated users to download the file and crack the passwords of other users...

CVE-2002-1005

ArGoSoft Mail Server 1.8.1.7 and earlier allows a webmail user to cause a denial of service CPU consumption by forwarding the email to the user while autoresponse is enabled, which creates an infinite loop...

CVE-2002-0901

Multiple buffer overflows in Advanced Maryland Automatic Network Disk Archiver AMANDA 2.3.0.4 allow 1 remote attackers to execute arbitrary code via long commands to the amindexd daemon, or certain local users to execute arbitrary code via long command line arguments to the programs 2 amcheck, 3...