CVE-2002-0419

The CVE-2002-0419 entry describes information leaks in Microsoft IIS versions 4 through 5.1 where remote attackers can learn sensitive details via server responses. Specifically, when Basic authentication is used, the server may reveal its IP address as the realm, potentially exposing NAT-obscure...

CVE-2002-0420

CVE-2002-0420 relates to PureTLS prior to version 0.9b2, with an injection-related vulnerability that could allow remote attackers to corrupt or hijack user sessions. The connected sources confirm the affected software and a remote-exploit goal, but do not provide further technical specifics, exp...

CVE-2002-0421

The CVE-2002-0421 entry concerns Microsoft IIS 4.0 on Windows NT where local users can bypass the password policy by directly invoking password-changing programs in the /iisadmpwd directory. The affected components are the .htr programs: aexp2.htr, aexp2b.htr, aexp3.htr, and aexp4.htr. The root c...

CVE-2002-0426

CVE-2002-0426 affects the Linksys EtherFast BEFVP41 Cable/DSL VPN Router (VPN Server module) prior to firmware version 1.40.1. The issue: the router reduces key lengths for keys entered manually, making it easier to crack keys. The NVD entry notes a network attack vector with low attack complexit...

CVE-2002-0427

CVE-2002-0427 affects Apache mod_frontpage up to version 1.6.1, where buffer overflows in fpexec may allow remote attackers to gain root privileges. The underlying issue is lack of boundary checks in fpexec.c. Mandrake MDKSA-2002:021 notes remote-exploit potential; FreeBSD/others discuss remediat...

CVE-2002-0428

The CVE-2002-0428 issue affects Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1. A vulnerability in the client configuration allows bypassing the authentication timeout by modifying the to_expire or expire values in the users.C file, potentially extending session validity beyond intended...

CVE-2002-0430

CVE-2002-0430 affects the Sun Cobalt RaQ XTR admin interface. The MultiFileUploadHandler.php allows a local attacker to bypass authentication via a symlink attack on a temporary file, then trigger MultiFileUpload.php to overwrite arbitrary files. The vulnerability is local with high attack comple...

CVE-2002-0433

The CVE-2002-0433 entry concerns Pi3Web 2.0.0 where remote attackers can view restricted files by issuing an HTTP request containing a wildcard character ("*"). This is an unauthorized disclosure vulnerability via crafted requests, as described in NVD and CVE records. Connected documents confirm ...

CVE-2002-0440

CVE-2002-0440 affects Trend Micro InterScan VirusWall HTTP proxy 3.6. The issue arises when the product is configured with the Skip scanning if Content-length equals 0 option enabled: a malicious HTTP server can bypass content scanning by sending a Content-length header of 0, which many HTTP cl...

CVE-2002-0446

The CVE-2002-0446 entry describes a path disclosure vulnerability in Black Tie Project (BTP) versions 0.4b through 0.5b. Specifically, categorie.php3 exposes the server’s absolute path to remote attackers via an invalid category ID (cid) parameter, leaking the pathname in an error message. Affect...

CVE-2002-0447

CVE-2002-0447 concerns the Xerver Free Web Server (versions 2.10 and earlier). The vulnerability is a directory traversal in which an attacker can use .. in an HTTP GET request to list arbitrary directories. The CVE entry explicitly states this allows remote access to directory listings, indicati...

CVE-2002-0448

CVE-2002-0448 affects Xerver Free Web Server up to version 2.10, where a crafted HTTP request containing many C:/ sequences can cause the server to crash (remote DoS). The vulnerability is triggered through the HTTP request handling path and is exploitable remotely with no authentication. CVSS v2...

CVE-2002-0453

CVE-2002-0453 affects Oblix NetPoint 5.2 and earlier. The vulnerability is in the account lockout mechanism, which only locks out a user once for the specified period. This allows remote attackers to repeat brute-force password guessing by waiting for the lockout window to reset and attempting pa...

CVE-2002-0455

Product affected: IncrediMail. Vulnerability: attachments stored in a directory with a fixed name, enabling a predictable path. Impact (per sources): could facilitate exploitation of vulnerabilities in other software that rely on known directory pathnames when installing or reading files. Root ca...

CVE-2002-0456

CVE-2002-0456 affects Eudora 5.1 and earlier. The issue arises because attachments are stored in a directory with a fixed name, which could enable attackers to exploit vulnerabilities in other software that rely on installing/reading files from directories with known pathnames. The provided docum...

CVE-2002-0457

The CVE-2002-0457 entry describes a cross-site scripting (XSS) vulnerability in BG GuestBook 1.0, specifically in signgbook.php. The flaw allows remote attackers to inject arbitrary JavaScript via encoded tags (e.g., , &) in user-submittable fields such as name, email, AIM screen name, website, l...

CVE-2002-0459

CVE-2002-0459 describes a cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier. The flaw allows remote attackers to execute arbitrary JavaScript via the WEB parameter, indicating a client-side scripting input handling weakness that leads to code execution in the context of authentica...

CVE-2002-0460

The vulnerability CVE-2002-0460 affects Bitvise WinSSHD prior to 2002-03-16. It allows remote attackers to cause a denial of service (resource exhaustion) by initiating a large number of incomplete connections that are not properly terminated and not properly freed by SSHd. The connected document...

CVE-2002-0461

CVE-2002-0461 affects Internet Explorer 5.01 through 6. A crafted web page using JavaScript that calls location.replace on itself can create a loop, leading to a denial of service via application crash. The connected sources confirm the affected product and the underlying cause (recursive locatio...

CVE-2002-0465

Hosting Controller 1.4.1 and earlier are affected by CVE-2002-0465. A directory traversal flaw in filemanager.asp allows remote attackers to read/modify arbitrary files and execute commands via an open path parameter containing .. (dot dot). The issue is identified in the NVD/CVE records for this...