5356 matches found
CVE-2002-0333
Directory traversal vulnerability in xtell xtelld 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to read files with short names, and local users to read more files using a symlink with a short name, via a .. in the TTY argument...
CVE-2002-0344
Symantec LiveUpdate 1.5 and earlier in Norton Antivirus stores usernames and passwords for a local LiveUpdate server in cleartext in the registry, which may allow remote attackers to impersonate the LiveUpdate server...
CVE-2002-0350
HP Procurve Switch 4000M running firmware C.08.22 and C.09.09 allows remote attackers to cause a denial of service via a port scan of the management IP address, which disables the telnet service...
CVE-2002-0326
Cross-site scripting vulnerability in BadBlue before 1.6.1 beta allows remote attackers to execute arbitrary script and possibly additional commands via a URL that contains Javascript...
CVE-2002-0334
xtell xtelld 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file...
CVE-2002-0381
The TCP implementation in various BSD operating systems tcpinput.c does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address...
CVE-2002-0315
fasttrack p2p, as used in 1 KaZaA, 2 grokster, and 3 morpheus allows remote attackers to spoof other users by modifying the username and network information in the message header...
CVE-2002-0043
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked...
CVE-2002-0128
CVE-2002-0128 affects Sambar Server 5.1 prior to Beta 4, where the CGI component cgitest.exe (and related CGI entries) is vulnerable to a long-argument input. This can cause a denial of service and, per some sources, may allow arbitrary code execution. The vulnerability’s impact is consistent acr...
CVE-2002-0107
CacheFlow CacheOS 4.0.13 and earlier expose a information disclosure vulnerability in a web administration interface: a sequence of GET requests that do not end with a HTTP/1.0 (or another version) string causes leakage of sensitive data in the error message. Affected product: CacheFlow CacheOS (...
CVE-2002-0098
CVE-2002-0098 describes a buffer overflow in Boozt AdBanner’s index.cgi admin interface of Boozt! Standard 0.9.8. The vulnerability occurs when a long banner creation name is copied into internal arrays, allowing local arbitrary code execution or a crash. Connected sources cite a CVSS v2 base sco...
CVE-2002-0064
CVE-2002-0064 affects Funk Software’s Proxy Host v3.x on Windows 2000/NT4/9x. The issues include: (1) default filesystem and registry permissions granting the Everyone group excessive access, enabling modification of host settings and passwords; (2) passwords stored in recoverable formats (obfusc...
CVE-2002-0226
CVE-2002-0226 relates to DCForum 6.x and 2000. The flaw is that retrieve_password.pl generates new passwords using a sessionID, enabling a remote attacker to request a new password for another user and calculate that user’s new password from the sessionID. The connected documents confirm the affe...
CVE-2002-0060
IRC connection tracking helper module in the netfilter subsystem for Linux 2.4.18-pre9 and earlier does not properly set the mask for conntrack expectations for incoming DCC connections, which could allow remote attackers to bypass intended firewall restrictions...
CVE-2002-0176
The printf wrappers in libsafe 2.0-11 and earlier do not properly handle argument indexing specifiers, which could allow attackers to exploit certain function calls through arguments that are not verified by libsafe...
CVE-2002-0070
CVE-2002-0070 describes a buffer overflow in the Windows Shell (the Windows Desktop environment) that can allow arbitrary code execution. The vulnerability stems from an unchecked buffer in the URL handler mapping for applications that have been partially removed; if an application with custom UR...
CVE-2002-0007
CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which causes a null password to be sent to the LDAP server...
CVE-2002-0115
The CVE-2002-0115 entry concerns Snort 1.8.3, where the minimum ICMP header size is not properly defined. This allows remote attackers to cause a denial of service (crash and core dump) by sending a malformed ICMP packet. The documents state the affected component is the ICMP handling in Snort 1....