5356 matches found
CVE-2002-0378
The default configuration of LPRng print spooler in Red Hat Linux 7.0 through 7.3, Mandrake 8.1 and 8.2, and other operating systems, accepts print jobs from arbitrary remote hosts...
CVE-2002-0378
The CVE-2002-0378 issue concerns the LPRng print spooler defaulting to accept print jobs from arbitrary remote hosts in Red Hat Linux 7.0–7.3, Mandrake 8.1–8.2, and similar OSes. Connected advisories (e.g., RHSA-2002:120, RHSA-2002:089, MDKSA-2002:042) document that the default policy allowed rem...
Microsoft IIS .HTR Filter Multiple Overflows (MS02-028)
The remote server is vulnerable to a buffer overflow in the .HTR filter. An attacker may use this flaw to execute arbitrary code on this host although the exploitation of this flaw is considered difficult. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from...
MS02-029: Windows RAS Local Overflow (318138)
An overflow in the RAS phonebook service allows a local user to execute code on the system with the privileges of LocalSystem. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11029; scriptversion"1.41"; scriptcvsdate"Date: 2018/11/15 20:50:29";...
CVE-2002-0550
Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter...
CVE-2002-0409
orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter...
CVE-2002-0593
Buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long channel name in an IRC URI...
CVE-2002-0607
Snitz Forums 2000, version 3.3.03 and earlier, is affected in members.asp by a SQL injection on parameters (M_NAME, UserName, FirstName, LastName, INITIAL) that enables remote attackers to execute arbitrary code. Root cause is improper input handling in the affected page, allowing injected SQL to...
CVE-2002-0555
IBM Informix Web DataBlade 4.12 unescapes user input even if escaped, enabling remote attackers to execute SQL code in a web form. Root cause is improper input handling that bypasses developer escaping. Public details in connected records confirm the affected product and behavior; no remediation ...
CVE-2002-0459
Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parameter...
CVE-2002-0418
Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows remote attackers to read arbitrary files via a .. dot dot and a null character in the paramname parameter...
CVE-2002-0479
Gravity Storm Service Pack Manager 2000 creates a hidden share SPM2000c$ mapped to the C drive, which may allow local users to bypass access restrictions on certain directories in the C drive, such as system32, by accessing them through the hidden share...
CVE-2002-0491
The CVE-2002-0491 entry concerns AlGuest 1.0 guestbook’s admin.php authentication, which incorrectly relies on the existence of an admin cookie. An attacker can set the admin cookie to an arbitrary value, bypassing authentication and gaining administrative privileges. The vulnerability is web‑acc...
CVE-2002-0524
The CVE-2002-0524 entry affects ASP-Nuke RC2 and earlier . The vulnerability arises from error messages that disclose the server’s absolute path when attackers trigger two conditions: (1) calling database-inc.asp with incorrect cookies, or (2) calling Post.asp with certain arguments. This results...
CVE-2002-0471
PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the aquery variable...
CVE-2002-0481
An interaction between Windows Media Player WMP and Outlook 2002 allows remote attackers to bypass Outlook security settings and execute Javascript via an IFRAME in an HTML email message that references .WMS Windows Media Skin or other WMP media files, whose onload handlers execute the...
CVE-2002-0564
PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor DAD by modifying the URL to reference an alternate DAD that already has valid credentials...
CVE-2002-0466
Hosting Controller 1.4.1 and earlier allows remote attackers to browse arbitrary directories via a full C: style pathname in the filepath arguments to 1 Statsbrowse.asp, 2 servubrowse.asp, 3 browsedisk.asp, 4 browsewebalizerexe.asp, or 5 sqlbrowse.asp...
CVE-2002-0407
htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as 1 a request with a .pl or .java extension, or 2 a request containing a large number of...