CVE-2002-0235

Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event...

CVE-2002-0238

Cross-site scripting vulnerability in web administration interface for NetGear RT314 and RT311 Gateway Routers allows remote attackers to execute arbitrary script on another client via a URL that contains the script...

CVE-2002-0253

PHP, when not configured with the "displayerrors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and...

CVE-2002-0259

InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in 1 .pwd files in the miniportal/apache directory, or 2 mplog.txt, which could allow local users to gain privileges...

CVE-2002-0362

Buffer overflow in AOL Instant Messenger AIM 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711...

CVE-2002-0232

Directory traversal vulnerability in Multi Router Traffic Grapher MRTG allows remote attackers to read portions of arbitrary files via a .. dot dot in the cfg parameter for 1 14all.cgi, 2 14all-1.1.cgi, 3 traffic.cgi, or 4 mrtg.cgi...

CVE-2002-0241

NDSAuth.DLL in Cisco Secure Authentication Control Server ACS 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services NDS, which could allow those users to authenticate to the server...

CVE-2002-0258

Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs...

CVE-2002-0269

Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent...

CVE-2002-0355

netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions...

Important: Red Hat Security Advisory: : : : Updated nss_ldap packages fix pam_ldap vulnerability

Updated nssldap packages are now available for Red Hat Linux 6.2, 7, 7.1, 7.2, and 7.3. These packages fix a string format vulnerability in the pamldap module. Update Jun 4, 2002 Replacement packages have been added for Red Hat Linux 6.2. The previous packages could not be installed with the...

MS02-024: Windows Debugger flaw can Lead to Elevated Privileges (320206)

The remote host contains a flaw in the Windows Debugger that could allow a local user to elevate his privileges. To exploit this vulnerability, a user needs to send a specially crafted code to the Debbuging handler to execute arbitrary code with SYSTEM privileges. %NASLMINLEVEL 70300 C Tenable...

CVE-2002-0360

The CVE-2002-0360 issue affects Sun AnswerBook2 1.4–1.4.3, where a buffer overflow in the gettransbitmap CGI allows a remote attacker to execute arbitrary code via a long filename argument. Impact is remote code execution with the daemon privileges; no exploit details are provided in the document...

CVE-2002-0360

Buffer overflow in Sun AnswerBook2 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program...

CVE-2002-0192

CVE-2002-0193 and CVE-2002-1564 describe Internet Explorer 5.01/5.5/6.0 vulnerabilities. CVE-2002-0193: remote code execution via malformed Content-Disposition/Content-Type headers causing the spoofed file type to be handled by the OS. CVE-2002-1564: cookie-based script in cookies that can expose...

CVE-2002-0189

Summary: IE 6.0 contains cross-site scripting vulnerabilities that let an attacker script the Local Machine Zone by abusing local HTML resources via dialog frames. Vectors/Resources: vulnerable resources include local res:// HTML objects (e.g., res://shdoclc.dll/privacypolicy.dlg and related file...

CVE-2002-0224

The MSDTC Microsoft Distributed Transaction Service Coordinator for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to cause a denial of service crash or hang via malformed random input...

CVE-2002-0185

modpython version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attackers to call possibly dangerous functions from the imported module...

CVE-2002-0204

Buffer overflow in GNU Chess gnuchess 5.02 and earlier, if modified or used in a networked capacity contrary to its own design as a single-user application, may allow local or remote attackers to execute arbitrary code via a long command...

CVE-2002-0212

The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack...