CVE-2002-0555

IBM Informix Web DataBlade 4.12 unescapes user input even if escaped, enabling remote attackers to execute SQL code in a web form. Root cause is improper input handling that bypasses developer escaping. Public details in connected records confirm the affected product and behavior; no remediation ...

CVE-2002-0560

Oracle 9i Application Server 1.0.2.x with PL/SQL module 3.0.9.8.2 exposes OWA_UTIL procedures (signature, listprint, show_query_columns) to remote attackers, enabling information disclosure. Affected component is the PL/SQL gateway (modplsql) in Oracle 9iAS; exploitation involves unauthenticated ...

CVE-2002-0563

CVE-2002-0563 describes a vulnerability in Oracle 9i Application Server 1.0.2.x where the default configuration allows remote anonymous access to sensitive services without authentication. Affected components include Dynamic Monitoring Services (dms0, dms/DMSDump, servlet/DMSDump, servlet/Spy, so...

CVE-2002-0564

CVE-2002-0564 affects Oracle 9i Application Server 1.0.2.x via PL/SQL module 3.0.9.8.2. An attacker can bypass authentication for a Database Access Descriptor (DAD) by altering the URL to reference a different DAD that already has valid credentials, enabling unauthorized access. The description n...

CVE-2002-0566

CVE-2002-0566 affects Oracle 9i Application Server (iAS) with the PL/SQL module 3.0.9.8.2. The vulnerability allows an unauthenticated remote attacker to crash the Apache-based PL/SQL service by sending a malformed HTTP Authorization header (no auth type). Impact is denial of service (partial ava...

CVE-2002-0577

HP-UX 11.00 and 11.11 systems are affected by a vulnerability in the passwd(1) utility that may allow a local attacker to corrupt the password file, potentially causing a denial of service. The issue affects the passwd component on HP-UX; HP documents a list of patches to mitigate (PHCO_25527 for...

CVE-2002-0579

The CVE covers WorkforceROI Xpede 4.1, where the /admin/adminproc.asp script allows remote attackers to gain Xpede administrator privileges without prompting for a password. The underlying issue is an authentication bypass in that admin endpoint, enabling privilege escalation. The sources confirm...

CVE-2002-0581

The CVE-2002-0581 entry concerns WorkforceROI Xpede 4.1. The vulnerability is a SQL injection in the sprc.asp script, exploited via the Qry parameter, allowing remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database. Root cause: unsafely concate...

CVE-2002-0582

CVE-2002-0582 affects WorkforceROI Xpede 4.1. The vulnerability stems from storing temporary expense claim reports in a world-readable and indexable /reports/temp directory, enabling remote readers to access the reports. The NVD entry lists a CVSS v2 base score of 5.0 (Medium) with network attack...

CVE-2002-0584

The CVE-2002-0584 entry concerns WorkforceROI Xpede 4.1. The vulnerability allows remote attackers to read user timesheets by tampering with the TSN ID parameter in the ts_app_process.asp script. The TSN ID is easily guessable because it is incremented by 1 for each new timesheet, enabling an att...

CVE-2002-0587

CVE-2002-0587 is a buffer overflow in the Ns_PdLog function of AOLServer's external database driver proxy daemon library (libnspd.a), affecting AOLServer versions 3.0 through 3.4.2. The vulnerability allows remote attackers to cause a denial of service or execute arbitrary code via the Error or N...

CVE-2002-0588

PVote before 1.9 is affected. The root cause is missing authentication for restricted operations, enabling remote attackers to add or delete polls by tampering with parameters sent to add.php or del.php. Publications note impact as unauthorized modification of polls; no further exploit details ar...

CVE-2002-0589

The CVE-2002-0589 issue affects PVote prior to 1.9. An unauthenticated remote attacker can change the administrative password by directly calling ch_info.php with newpass and confirm parameters both set to the new password, enabling privilege gain. The available documents confirm the vulnerabilit...

CVE-2002-0596

CVE-2002-0596 affects WebTrends Reporting Center 4.0d. A remote attacker can cause an error message to disclose the server’s real path by issuing a GET to get_od_toc.pl with an empty Profile parameter, resulting in information disclosure (pathname leakage). Root cause is an error message that rev...

CVE-2002-0600

The CVE-2002-0600 entry concerns a heap overflow in the KTH Kerberos 4 FTP client 4-1.1.1. An attacker-controlled long response to a PASV (passive) FTP command can cause a heap overflow, enabling remote code execution on the client. Impact per NVD is high (CVSSv2: base score 7.5) with network att...

CVE-2002-0602

Affected product: Snapgear Lite+ firewall, versions 1.5.3 and 1.5.4. Issue: remote attackers can cause a denial of service (crash) by establishing a large number of connections to the HTTP web management port or the PPTP port. Root cause is not explicitly detailed in the provided documents. Impac...

CVE-2002-0603

The CVE-2002-0603 entry concerns the Snapgear Lite+ firewall, version 1.5.3. Affected component: the IPsec handling vulnerable to a remote denial-of-service triggered by sending a zero-length packet to UDP port 500, causing a crash. The vulnerability is network-exploitable with no authentication ...

CVE-2002-0604

CVE-2002-0604 affects Snapgear Lite+ firewall versions 1.5.3 and 1.5.4. A remote attacker can crash the device (DoS) by sending a large number of packets with malformed IP options. Attack vector: NETWORK; authentication: NONE; impact: availability partial. No remediation/fix details are provided ...

CVE-2002-0607

Snitz Forums 2000, version 3.3.03 and earlier, is affected in members.asp by a SQL injection on parameters (M_NAME, UserName, FirstName, LastName, INITIAL) that enables remote attackers to execute arbitrary code. Root cause is improper input handling in the affected page, allowing injected SQL to...

CVE-2002-0608

The vulnerability CVE-2002-0608 concerns the Matu FTP client 1.74, where a buffer overflow in handling the FTP server banner (a long “220” response) can allow the remote FTP server to execute arbitrary code. This is documented in the NVD/NVD-derived records, with the affected component being the ...