CVE-2002-0604

CVE-2002-0604 affects Snapgear Lite+ firewall versions 1.5.3 and 1.5.4. A remote attacker can crash the device (DoS) by sending a large number of packets with malformed IP options. Attack vector: NETWORK; authentication: NONE; impact: availability partial. No remediation/fix details are provided ...

CVE-2002-0607

Snitz Forums 2000, version 3.3.03 and earlier, is affected in members.asp by a SQL injection on parameters (M_NAME, UserName, FirstName, LastName, INITIAL) that enables remote attackers to execute arbitrary code. Root cause is improper input handling in the affected page, allowing injected SQL to...

CVE-2002-0608

The vulnerability CVE-2002-0608 concerns the Matu FTP client 1.74, where a buffer overflow in handling the FTP server banner (a long “220” response) can allow the remote FTP server to execute arbitrary code. This is documented in the NVD/NVD-derived records, with the affected component being the ...

CVE-2002-0610

The CVE-2002-0610 vulnerability affects HP MPE/iX FTPSRVR (versions 6.0–7.0). The FTP server does not properly validate certain FTP commands, enabling a remote attacker to gain unauthorized access. HP/HP-UX bulletin HPSBMP0204-014 documents the issue and provides patches: 6.0 FTPGD91A, 6.5 FTPGD9...

CVE-2002-0611

CVE-2002-0611 describes a directory traversal vulnerability in FileSeek.cgi that allows remote attackers to read arbitrary files by supplying a ....// (modified dot dot) in the head or foot parameters, which are not properly filtered. Root cause is insufficient validation of path components in th...

CVE-2002-0614

PHP-Survey 20000615 and earlier is affected. The issue arises because the global.inc file is stored under the web root, allowing remote attackers to read sensitive information such as database credentials if .inc files are not preprocessed by the server. This is the underlying vulnerability in CV...

CVE-2002-0434

The CVE-2002-0434 issue centers on the directory.php script by Marcus S. Xenakis, which allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter. Connected sources (OpenVAS NASL and Tenable plugin) confirm a remote command-execution vulnerability in the ...

CVE-2002-0562

The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa...

CVE-2002-0478

CVE-2002-0478 concerns Foundry Networks EdgeIron 4802F. The default configuration allows remote attackers to modify sensitive information via arbitrary SNMP community strings. The root cause is the use of default, potentially insecure SNMP community strings that enable unauthorized write access t...

CVE-2002-0550

Dynamic Guestbook 3.0 is affected by a remote code execution vulnerability where an attacker can execute arbitrary code by supplying shell metacharacters in the gbdaten parameter. The root cause is input allowing shell metacharacter processing; impact is described as arbitrary code execution. Exp...

CVE-2002-0593

CVE-2002-0593: A buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier can be triggered by a long channel name in an IRC URI, allowing remote DoS and possibly arbitrary code execution. Affected software is Netscape 6 and Mozilla 1.0 RC1 and earlier; the underlying issue is a buffer overfl...

CVE-2002-0393

Buffer overflow in Red-M 1050 Bluetooth Access Point management web interface allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password...

CVE-2002-0405

Buffer overflow in Transsoft Broker FTP Server 5.0 evaluation allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CWD command with a large number of . dot characters...

CVE-2002-0407

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as 1 a request with a .pl or .java extension, or 2 a request containing a large number of...

CVE-2002-0409

orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter...

CVE-2002-0415

Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read files that are accessible to RealPlayer via a .. dot dot in an HTTP GET request to port 1275...

CVE-2002-0418

Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows remote attackers to read arbitrary files via a .. dot dot and a null character in the paramname parameter...

CVE-2002-0419

Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which 2 in certain configurations, the server IP address is provided as the realm for Basic authentication, which...

CVE-2002-0421

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including 1 aexp2.htr, 2 aexp2b.htr, 3 aexp3.htr , or 4 aexp4.htr...

CVE-2002-0422

IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system which may be obscured by NAT via 1 a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or 2 via the WRITE or...