CVE-2002-0345

Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, which could allow an attacker to gain privileges...

CVE-2002-0352

Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication...

CVE-2002-0240

PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message...

CVE-2002-0248

CVE-2002-0248 affects wmtv versions 0.6.5 and earlier. Local users can modify arbitrary files via a symlink attack on the configuration file due to improper handling of symlinks. Impact is local, complete confidentiality/integrity/availability as described; remediation recommended is upgrading to...

CVE-2002-0235

Castelle FaxPress (likely v6.3 and other versions) is affected when configured to use the Network print queue. An incorrect login can cause FaxPress to leak the correct username and password in plaintext in an error event. This may impact confidentiality and integrity (PARTIAL) and could affect a...

CVE-2002-0272

The CVE-2002-0272 issue affects mpg321 before 0.2.9, with a buffer overflow in the network streaming code. A long URL can be crafted via (1) a command line option, (2) an HTTP request, or (3) an FTP request to trigger arbitrary code execution. The vulnerability is exploitable locally or remotely ...

CVE-2002-0324

Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-.reg file which contains the administrator name and password in cleartext, then retrieving the file from...

CVE-2002-0315

The CVE-2002-0315 entry describes a flaw in the FastTrack P2P protocol used by KaZaA, Grokster, and Morpheus where remote attackers can spoof other users by modifying the username and network information in the message header. Affected software involves the FastTrack P2P components integrated int...

CVE-2002-0354

The CVE-2002-0354 issue concerns the XMLHttpRequest (XMLHTTP) object in Netscape 6.1 and Mozilla 0.9.7. It permits remote attackers to read arbitrary files and list directories on a client by directing the browser to a file via a URL redirect and then reading the result through responseText. This...

CVE-2002-0317

CVE-2002-0317 involves the Gator ActiveX component (IEGator.dll) 3.0.6.1. The vulnerability allows remote websites to install arbitrary software by specifying a Trojan Gator installation file (setup.ex_) in the src parameter, enabling a remote-initiated installation via the ActiveX control. This ...

CVE-2002-0225

Tac_plus Tacacs+ daemon F4.0.4.alpha (originally Cisco) is vulnerable because the accounting directive creates files with world-readable and world-writable permissions, allowing local users to access and modify sensitive files. Affected component: tac_plus Tacacs+ daemon; root cause: insecure fil...

CVE-2002-0256

CVE-2002-0256 affects the Telnet service of the Arescom NetDSL 1000 router. Affected component: Telnet port. Root cause: remote attackers can trigger a denial-of-service by sending a sequence of connections containing long strings, causing a large number of login failures and stopping the Telnet ...

CVE-2002-0261

CVE-2002-0261 describes a directory traversal in InstantServers MiniPortal 1.1.5 and earlier. A remote authenticated user can read arbitrary files by using a modified dot dot (.. ) in the GET request, exposing sensitive files. The connected documents corroborate this description. No explicit reme...

CVE-2002-0349

CVE-2002-0349 affects Tiny Personal Firewall (TPF) 2.0.15. In certain configurations, it can pop up an alert to the system even when the screen is locked, which could allow a physically proximate attacker to hide activities or bypass access restrictions. The provided connected documents describe ...

CVE-2002-0270

CVE-2002-0270 involves Opera. When the option “Determine action by MIME type” is disabled, Opera may treat an object as an HTML document even if its Content-Type is text/plain. This can allow remote attackers to execute arbitrary scripts in documents users do not expect, potentially affecting web...

CVE-2002-0205

The CVE-2002-0205 entry describes a cross‑site scripting (XSS) flaw in Plumtree Corporate Portal 3.5–4.5, where an attacker could inject arbitrary script via the Description parameter in error.asp, potentially affecting other clients. The affected product/component is Plumtree Corporate Portal (e...

CVE-2002-0273

CVE-2002-0273 affects NetWin CWMail.exe prior to version 2.8a. The vulnerability is a buffer overflow in CWMail.exe that allows remote authenticated users to execute arbitrary code by submitting a long item parameter. This is the core impact stated across multiple sources in the connected documen...

CVE-2002-0337

The CVE-2002-0337 entry concerns RealPlayer 8 and a denial-of-service condition triggered by processing malformed MP3 files. The vulnerability allows a remote attacker to induce high CPU usage, leading to service disruption. Affected software is RealPlayer 8; the exact component/file and root cau...

CVE-2002-0269

Summary: CVE-2002-0269 concerns Internet Explorer 5.x/6 that treats a loaded object as an HTML document even when its MIME type is text/plain, potentially enabling remote script execution in documents the user trusts not to contain executable content. What is affected: Internet Explorer 5.x and 6...

CVE-2002-0334

CVE-2002-0334 affects xtell/xtelld; vulnerable are xtell 1.91.1 and earlier, and 2.x before 2.7. The issue is a local symlink attack on the temporary .xtell-log file that allows local users to modify files. OpenVAS/Nessus entries confirm Debian/DSA advisories; remediation involves upgrading to fi...