CVE-2002-0589

The CVE-2002-0589 issue affects PVote prior to 1.9. An unauthenticated remote attacker can change the administrative password by directly calling ch_info.php with newpass and confirm parameters both set to the new password, enabling privilege gain. The available documents confirm the vulnerabilit...

CVE-2002-0525

The CVE-2002-0525 entry corresponds to a format string vulnerability in INN components (inews or rnews) affecting INN 2.2.3 and earlier. The underlying issue is format string specifiers in NNTP (NTTP) responses, which could allow a local user or a remote malicious NNTP server to gain privileges. ...

CVE-2002-0520

The CVE-2002-0520 entry describes an XSS in ASP-Nuke RC1 via the IMG tag in functions-inc.asp. The root cause is insufficient filtering of content within the [img] tag, allowing remote attackers to execute script in other users’ browsers. The affected software is ASP-Nuke RC1; exploitation detail...

CVE-2002-0588

PVote before 1.9 is affected. The root cause is missing authentication for restricted operations, enabling remote attackers to add or delete polls by tampering with parameters sent to add.php or del.php. Publications note impact as unauthorized modification of polls; no further exploit details ar...

CVE-2002-0523

ASP-Nuke RC2 and earlier are affected by an information disclosure vulnerability where an attacker can locally modify the user cookie and submit it to cause the server to reveal the list of currently logged-in users (or show the web root path in an error). Affected component: ASP-Nuke RC1–RC2 (co...

CVE-2002-0502

CVE-2002-0502 affects Citrix NFuse 1.6. Affected component: applist.asp handling within NFuse, enabling remote attackers to list available applications without authentication. Root cause is improper access control on the applist.asp endpoint, leading to potential information disclosure. CVSS metr...

CVE-2002-0499

The CVE relates to the Linux kernel vulnerability where the d_path function truncates long pathnames without error in Linux kernel versions 2.2.20 and earlier, and 2.4.18 and earlier. This behavior can cause local users to cause programs to operate on incorrect directories, potentially enabling i...

CVE-2002-0440

CVE-2002-0440 affects Trend Micro InterScan VirusWall HTTP proxy 3.6. The issue arises when the product is configured with the Skip scanning if Content-length equals 0 option enabled: a malicious HTTP server can bypass content scanning by sending a Content-length header of 0, which many HTTP cl...

CVE-2002-0474

ZeroForum 1.0 contains a Cross-site scripting (XSS) flaw that allows remote attackers to execute arbitrary JavaScript in a victim’s browser by embedding code in the IMG tag within posts. Root cause: inadequate filtering of content inside image tags, enabling script execution when other users view...

CVE-2002-0436

The CVE-2002-0436 entry maps to the SunSolve CD package: the CGI script sscd_suncourier.pl does not validate the email parameter, enabling remote command execution via shell metacharacters. Documented by NVD/Nessus/OpenVAS references, this is a clientless, remote issue affecting Sunsolve CD CGI i...

CVE-2002-0470

PHPNetToolpack 0.1 is affected: it relies on the environment PATH to locate and execute traceroute. This allows a local user to escalate privileges by placing a Trojan horse program earlier in the PATH, enabling execution of the attacker’s code with higher rights. The impact is local privilege el...

CVE-2002-0529

The CVE-2002-0529 entry concerns HP Photosmart printer driver for Mac OS X. The vulnerability arises because the hp_imaging_connectivity program and the hp_imaging_connectivity.app directory are installed with world-writable permissions, enabling a local user to replace the executable with a Troj...

CVE-2002-0581

The CVE-2002-0581 entry concerns WorkforceROI Xpede 4.1. The vulnerability is a SQL injection in the sprc.asp script, exploited via the Qry parameter, allowing remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database. Root cause: unsafely concate...

CVE-2002-0409

CVE-2002-0409 involves an issue in orderdetails.aspx used as example code for Microsoft .NET developers, where an attacker can view other users’ orders by tampering the OrderID parameter. The description from NVD/CVE records states that remote attackers can access another user’s orders due to the...

CVE-2002-0415

Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read files that are accessible to RealPlayer via a .. dot dot in an HTTP GET request to port 1275...

CVE-2002-0419

Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which 2 in certain configurations, the server IP address is provided as the realm for Basic authentication, which...

CVE-2002-0578

Buffer overflow in 4D WebServer 6.7.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP request with Basic Authentication containing a long 1 user name or 2 password...

CVE-2002-0408

CVE-2002-0408 affects htcgibin.exe in Lotus Domino Server 5.0.9a and earlier. When configured with the NoBanner setting, a remote attacker can cause an HTTP 500 error and leak the server version in a hard-coded error message. This is an information-disclosure vulnerability that exposes version de...

CVE-2002-0483

CVE-2002-0483 affects PHP-Nuke versions 5.4 and earlier, where requesting index.php with the file parameter set to index.php can trigger an error message that leaks the web server’s physical pathname. This is a remote vulnerability that primarily exposes confidential information (the server path)...

CVE-2002-0438

CVE-2002-0438 affects ZyXEL ZyWALL 10; firmware versions before 3.50 are vulnerable to a crafted ARP packet using the firewall’s IP and a malformed MAC, causing the firewall to disable its LAN interface (DoS). The referenced fix is a ZyWALL 10 firmware update to 3.50 (or newer). If exploitation d...