CVE-2002-0508

CVE-2002-0508 affects wwwisis 3.45 and earlier. The issue allows remote attackers to execute arbitrary commands and read files via the parameters (1) prolog or (2) epilog). The connected documents confirm the vulnerable product/version and the impact as described; no explicit remediation or mitig...

CVE-2002-0514

OpenBSD 3.0 PF with the return-rst rule is vulnerable. The RST packet’s TTL is set to 128, allowing remote attackers to infer whether a port is filtered by comparing TTL to the default. Affected component: PF rule handling in OpenBSD 3.0. Root cause: TTL manipulation in RST responses leads to dis...

CVE-2002-0469

Affected product: Ecartis (formerly Listar) 1.0.0 in snapshot 20020125 and earlier. Issue: when installed setuid-root and lock-to-user is not set, and ecartis is invoked by certain MTAs, privileges are not properly dropped, potentially allowing local privilege escalation. Impact: local users coul...

CVE-2002-0548

CVE-2002-0548 affects Anthill. The vulnerability allows remote attackers to bypass authentication and file bug reports by directly accessing postbug.php instead of enterbug.php. Public references confirm the authentication bypass and report filing path. The connected EUVD and CVE sources corrobor...

CVE-2002-0535

CVE-2002-0535 covers cross-site scripting in PostBoard 2.0.1 and earlier. The vulnerability enables remote attackers to execute script in the context of other users via (1) an IMG tag when BBCode is enabled, or (2) in a topic title. Documents confirm affected software/version and the underlying a...

CVE-2002-0448

CVE-2002-0448 affects Xerver Free Web Server up to version 2.10, where a crafted HTTP request containing many C:/ sequences can cause the server to crash (remote DoS). The vulnerability is triggered through the HTTP request handling path and is exploitable remotely with no authentication. CVSS v2...

CVE-2002-0590

Cross-site scripting (XSS) in IcrediBB 1.1 Beta allows remote attackers to execute arbitrary script and steal cookies via the title or body of posts. The vulnerability affects the web application’s posting features and stems from improper handling/encoding of user-supplied input. Impact is descri...

CVE-2002-0419

The CVE-2002-0419 entry describes information leaks in Microsoft IIS versions 4 through 5.1 where remote attackers can learn sensitive details via server responses. Specifically, when Basic authentication is used, the server may reveal its IP address as the realm, potentially exposing NAT-obscure...

CVE-2002-0525

Format string vulnerabilities in 1 inews or 2 rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses...

CVE-2002-0611

CVE-2002-0611 describes a directory traversal vulnerability in FileSeek.cgi that allows remote attackers to read arbitrary files by supplying a ....// (modified dot dot) in the head or foot parameters, which are not properly filtered. Root cause is insufficient validation of path components in th...

CVE-2002-0517

The CVE-2002-0517 issue affects the X11 libX11 library in Caldera Open UNIX 8.0.0 and UnixWare 7.1.1 (and possibly other OSes). A buffer overflow occurs when handling a long -xrm argument in programs such as dtterm or xterm, allowing local users to gain root privileges. Exploitation details and a...

CVE-2002-0486

Affected: Intellisol Xpede 4.1. The CVE-2002-0486 entry describes that the product stores authentication information in cookies using weak encryption, enabling local access to cookies to escalate privileges. Root cause: weak encryption used for cookie-stored credentials. Impact: according to NVD ...

CVE-2002-0496

The CVE-2002-0496 issue affects the HTTP server component of SouthWest Talker server 1.0.0. A remote attacker can cause a denial of service (server crash) by sending a malformed URL to port 5002. The available documents confirm the vulnerable product/version and the nature of the impact (DoS/part...

CVE-2002-0504

CVE-2002-0504 describes a remote cross-site scripting flaw in Citrix NFuse 1.6 and earlier where results from getLastError are not quoted, allowing an attacker to inject script via the NFuse_Application parameter to launch.jsp or launch.asp. The CVSS v2 base metrics are provided (AV:N/AC:L/Au:N/C...

CVE-2002-0393

Affected product: Red-M 1050 Bluetooth Access Point (management web interface). Vulnerable component: the management web server where a buffer overflow can be triggered by a long administration password, leading to remote DoS and potentially arbitrary code execution. Exploitation details are not ...

CVE-2002-0428

The CVE-2002-0428 issue affects Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1. A vulnerability in the client configuration allows bypassing the authentication timeout by modifying the to_expire or expire values in the users.C file, potentially extending session validity beyond intended...

CVE-2002-0432

Citadel/UX 5.90 and earlier are affected by a buffer overflow in sysdep.c (functions lprintf and cprintf). The flaw can be triggered by long HELO commands sent to the SMTP server, leading to denial of service and possibly arbitrary code execution on a remote attacker. Affected product/version: Ci...

CVE-2002-0578

CVE-2002-0578 affects 4D WebServer 6.7.3. A buffer overflow in handling HTTP requests with Basic Authentication containing an excessively long user name or password allows remote DoS and possibly arbitrary code execution. The vulnerability is triggered by crafted credentials in the request, poten...

CVE-2002-0450

Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language wml file name to 1 webplus.dll or 2 webplus.exe...

CVE-2002-0422

IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system which may be obscured by NAT via 1 a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or 2 via the WRITE or...