CVE-2002-0447

CVE-2002-0447 concerns the Xerver Free Web Server (versions 2.10 and earlier). The vulnerability is a directory traversal in which an attacker can use .. in an HTTP GET request to list arbitrary directories. The CVE entry explicitly states this allows remote access to directory listings, indicati...

CVE-2002-0446

categorie.php3 in Black Tie Project BTP 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an invalid category ID cid parameter, which leaks the pathname in an error message...

CVE-2002-0614

PHP-Survey 20000615 and earlier stores the global.inc file under the web root, which allows remote attackers to obtain sensitive information, including database credentials, if .inc files are not preprocessed by the server...

CVE-2002-0482

Directory traversal vulnerability in PCI Netsupport Manager before version 7, when running web extensions, allows remote attackers to read arbitrary files via a .. dot dot in the HTTP GET request...

CVE-2002-0614

PHP-Survey 20000615 and earlier is affected. The issue arises because the global.inc file is stored under the web root, allowing remote attackers to read sensitive information such as database credentials if .inc files are not preprocessed by the server. This is the underlying vulnerability in CV...

CVE-2002-0407

CVE-2002-0407 affects Lotus Domino server prior to 5.0.9a. The vulnerability lies in htcgibin.exe, which can leak the server’s physical pathname to remote attackers via specially crafted requests that include MS-DOS device names (e.g., com5) or long sequences (such as a request with a .pl or .jav...

CVE-2002-0418

The CVE-2002-0418 issue affects Endymion SakeMail prior to 1.0.36, specifically the com.endymion.sake.servlet.mail.MailServlet. The vulnerability is a directory-traversal in the param_name parameter, triggered by a ". ." sequence and a null character, allowing remote attackers to read arbitrary f...

CVE-2002-0602

Affected product: Snapgear Lite+ firewall, versions 1.5.3 and 1.5.4. Issue: remote attackers can cause a denial of service (crash) by establishing a large number of connections to the HTTP web management port or the PPTP port. Root cause is not explicitly detailed in the provided documents. Impac...

CVE-2002-0561

CVE-2002-0561 affects Oracle 9i Application Server's PL/SQL Gateway web administration interface. The default configuration uses null authentication, allowing remote attackers to bypass access controls and modify DAD/settings via the PL/SQL gateway administration pages. Details in connected advis...

CVE-2002-0566

CVE-2002-0566 affects Oracle 9i Application Server (iAS) with the PL/SQL module 3.0.9.8.2. The vulnerability allows an unauthenticated remote attacker to crash the Apache-based PL/SQL service by sending a malformed HTTP Authorization header (no auth type). Impact is denial of service (partial ava...

CVE-2002-0544

CVE-2002-0544 affects Aprelium Abyss Web Server (abyssws) before 1.0.3. The administrative console password is stored in plaintext in the abyss.conf file, allowing local users who can access the file to gain privileges. The connected documents provide the vulnerability description but do not spec...

CVE-2002-0596

CVE-2002-0596 affects WebTrends Reporting Center 4.0d. A remote attacker can cause an error message to disclose the server’s real path by issuing a GET to get_od_toc.pl with an empty Profile parameter, resulting in information disclosure (pathname leakage). Root cause is an error message that rev...

CVE-2002-0466

The CVE-2002-0466 entry concerns Hosting Controller (version 1.4.1 and earlier). The connected OpenVAS entries describe vulnerable ASP pages for Hosting Controller, indicating multiple remote exploits exist that could be used to access confidential data or escalate privileges on the Web server. T...

CVE-2002-0592

CVE-2002-0592 affects AOL Instant Messenger (AIM). The vulnerability allows remote attackers to steal files being transferred to other clients by connecting to AIM’s Direct Connection port 4443 or file transfer port 5190 before the intended user. The available sources describe this as a scheme to...

CVE-2002-0446

The CVE-2002-0446 entry describes a path disclosure vulnerability in Black Tie Project (BTP) versions 0.4b through 0.5b. Specifically, categorie.php3 exposes the server’s absolute path to remote attackers via an invalid category ID (cid) parameter, leaking the pathname in an error message. Affect...

CVE-2002-0559

The CVE-2002-0559 entry concerns a buffer overflow in Oracle9i Application Server’s Apache PL/SQL module exposed via the PL/SQL gateway (mod_plsql). The vulnerability arises from processing long inputs (e.g., long HTTP requests, long DAD passwords, long Authorization headers, or long cache direct...

CVE-2002-0609

CVE-2002-0609 describes a vulnerability in HP MPE/iX 6.0 through 7.0 that can cause a denial of service (system failure described as “SA1457 out of i_port_timeout.fix_up_message_frame”) when processing malformed IP packets. The provided sources identify the affected product family and the attack ...

CVE-2002-0420

CVE-2002-0420 relates to PureTLS prior to version 0.9b2, with an injection-related vulnerability that could allow remote attackers to corrupt or hijack user sessions. The connected sources confirm the affected software and a remote-exploit goal, but do not provide further technical specifics, exp...

CVE-2002-0457

The CVE-2002-0457 entry describes a cross-site scripting (XSS) vulnerability in BG GuestBook 1.0, specifically in signgbook.php. The flaw allows remote attackers to inject arbitrary JavaScript via encoded tags (e.g., , &) in user-submittable fields such as name, email, AIM screen name, website, l...

CVE-2002-0410

CVE-2002-0410 (AeroMail) affects AeroMail before 1.45. The vulnerability is in send_message.php, allowing remote attackers to read arbitrary server files instead of only uploaded ones by crafting the attachment filename during upload. This is caused by improper handling of file path/filename duri...