5506 matches found
Xerver Web Server < 2.20 Crafted C:/ Request Remote DoS
It is possible to crash the Xerver web server by sending a long URL to its administration port. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Added BugtraqID and CAN From Bugtraq : Date: Fri, 8 Mar 2002 18:39:39...
CVE-2002-0388
CVE-2002-0388 affects Mailman releases prior to 2.0.11, enabling remote XSS via the admin login page or Pipermail index summaries. The root cause is cross-site scripting in Mailman’s web interfaces. Public advisories and OpenVAS/Nessus entries corroborate a fix in 2.0.11 (debian/DSA-147-1/DSA-147...
CVE-2002-0273
Buffer overflow in CWMail.exe in NetWin before 2.8a allows remote authenticated users to execute arbitrary code via a long item parameter...
CVE-2002-0275
Falcon web server 2.0.0.1020 and earlier allows remote attackers to bypass authentication and read restricted files via an extra / slash in the requested URL...
CVE-2002-0277
Add2it Mailman Free 1.73 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the list parameter...
CVE-2002-0278
Directory traversal vulnerability in Add2it Mailman Free 1.73 and earlier allows remote attackers to modify arbitrary files via a .. dot dot in the list parameter...
CVE-2002-0282
DCP-Portal 3.7 through 4.5 allows remote attackers to obtain the physical path of the server via 1 a direct request to adduser.php, or via an invalid newlanguage parameter in 2 contents.php, 3 categories.php, or 4 files.php, which leaks the path in an error message...
CVE-2002-0284
Winamp 2.78 and 2.77, when opening a wma file that requires a license, sends the full path of the Temporary Internet Files directory to the web page that is processing the license, which could allow malicious web servers to obtain the pathname...
CVE-2002-0286
The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to adduser.php, which causes GetPassword to produce and compare a blank password for the...
CVE-2002-0287
pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default...
CVE-2002-0290
Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument...
CVE-2002-0293
FTP service in Alcatel OmniPCX 4400 allows the "halt" user to gain root privileges by modifying root's .profile file...
CVE-2002-0298
ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service crash via certain HTTP GET requests containing 1 a %2e%2e encoded dot-dot, 2 several /../ dot dot sequences, 3 a missing URI, or 4 several ../ in a URI that does not begin with a / slash character...
CVE-2002-0299
CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension such as .BAT, which is executed during a scan...
CVE-2002-0300
gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the requested file...
CVE-2002-0301
Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSEUSER and NFUSEPASSWORD parameters...
CVE-2002-0302
The Notify daemon for Symantec Enterprise Firewall SEF 6.5.x drops large alerts when SNMP is used as the transport, which could prevent some alerts from being sent in the event of an attack...
CVE-2002-0303
GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of other users by logging in without a password...