5356 matches found
CVE-2002-0579
The CVE covers WorkforceROI Xpede 4.1, where the /admin/adminproc.asp script allows remote attackers to gain Xpede administrator privileges without prompting for a password. The underlying issue is an authentication bypass in that admin endpoint, enabling privilege escalation. The sources confirm...
CVE-2002-0608
Buffer overflow in Matu FTP client 1.74 allows remote FTP servers to execute arbitrary code via a long "220" banner...
CVE-2002-0459
CVE-2002-0459 describes a cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier. The flaw allows remote attackers to execute arbitrary JavaScript via the WEB parameter, indicating a client-side scripting input handling weakness that leads to code execution in the context of authentica...
CVE-2002-0570
The encrypted loop device in Linux kernel 2.4.10 and earlier does not authenticate the entity that is encrypting data, which allows local users to modify encrypted data without knowing the key...
CVE-2002-0552
Multiple buffer overflows in Melange Chat server 2.02 allow remote or local attackers to cause a denial of service crash and possibly execute arbitrary code via 1 a long argument in the /yell command, 2 long lines in the /etc/melange.conf configuration file, 3 long file names, or possibly other...
CVE-2002-0592
AOL Instant Messenger AIM allows remote attackers to steal files that are being transferred to other clients by connecting to port 4443 Direct Connection or port 5190 file transfer before the intended user...
CVE-2002-0434
The CVE-2002-0434 issue centers on the directory.php script by Marcus S. Xenakis, which allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter. Connected sources (OpenVAS NASL and Tenable plugin) confirm a remote command-execution vulnerability in the ...
CVE-2002-0482
PCI Netsupport Manager (before v7) is affected by a directory traversal vulnerability in web extensions that allows an attacker to read arbitrary files via .. in an HTTP GET request. The issue arises from insufficient validation of path input in the web extension context, enabling access to files...
CVE-2002-0472
CVE-2002-0472 affects MSN Messenger Service 3.6 and possibly other versions, where weak authentication during client message exchange enables remote spoofing of messages from other users. The OpenVAS entry for Windows Messenger (MSN/Windows Messenger family) classifies this as multiple vulnerabil...
CVE-2002-0498
CVE-2002-0498 affects Etnus TotalView 5.0.0-4, where certain files are installed with UID 5039 and GID 59. This ownership mishandling could allow local users with that UID/GID to modify those files and gain privileges as other TotalView users. No exploit details are provided in the supplied docum...
CVE-2002-0537
The CVE-2002-0537 entry concerns StepWeb Search Engine (SWS) 2.5 where passwords are stored in links to manager.pl within the admin.html page. This design allows remote attackers who can access admin.html to gain administrative privileges on SWS. The description in multiple sources confirms the v...
CVE-2002-0577
HP-UX 11.00 and 11.11 systems are affected by a vulnerability in the passwd(1) utility that may allow a local attacker to corrupt the password file, potentially causing a denial of service. The issue affects the passwd component on HP-UX; HP documents a list of patches to mitigate (PHCO_25527 for...
CVE-2002-0481
The CVE-2002-0481 issue involves Microsoft Windows Media Player and Outlook 2002. An HTML email containing an IFRAME referencing Windows Media files (.WMS or similar) can trigger onload code that calls player.LaunchURL(), allowing remote attackers to bypass Outlook security settings and execute J...
CVE-2002-0475
The CVE-2002-0475 entry describes a cross-site scripting (XSS) vulnerability in phpBB versions 1.4.4 and earlier. The flaw allows remote attackers to cause arbitrary JavaScript execution on a user’s browser by embedding a script inside an IMG tag while editing a message. Affected software is phpB...
CVE-2002-0572
CVE-2002-0572 affects BSD-based systems (notably FreeBSD 4.5 and earlier); the issue arises when a local user closes standard input/output/error (FDs 0–2) and a subsequent setuid-invoked I/O operation reuses those descriptors, allowing read/write access to restricted files. Connected records corr...
CVE-2002-0580
The CVE-2002-0580 entry concerns WorkforceROI Xpede 4.1. The provided materials indicate that remote attackers can obtain the database username by requesting datasource.asp, which leaks the username in a form. This exposure can facilitate easier brute-force password guessing attacks against the d...
CVE-2002-0604
Snapgear Lite+ firewall 1.5.3 and 1.5.4 allows remote attackers to cause a denial of service crash via a large number of packets with malformed IP options...
CVE-2002-0460
The vulnerability CVE-2002-0460 affects Bitvise WinSSHD prior to 2002-03-16. It allows remote attackers to cause a denial of service (resource exhaustion) by initiating a large number of incomplete connections that are not properly terminated and not properly freed by SSHd. The connected document...