CVE-2002-0234

CVE-2002-0234 affects NetScreen ScreenOS prior to 2.6.1. The issue is a lack of a maximum concurrent-session limit, allowing a trusted-network attacker to perform a port scan to an external network that exhausts connections and causes denial of service. The provided documents describe the vulnera...

CVE-2002-0233

The CVE-2002-0233 entry concerns the eshare Expressions 4 Web server. The vulnerability is a directory traversal flaw that allows an attacker to read arbitrary files by using a .. (dot dot) in an HTTP request. Affected component: the web server’s request handling. Underlying cause: improper valid...

CVE-2002-0257

CVE-2002-0257 affects MakeBid Auction Deluxe 3.30 and is a cross-site scripting vulnerability in Auction Deluxe’s auction.pl. The issue allows remote attackers to read other users’ data via multiple form fields (TITLE, DESCTIT, DESC, searchstring, ALIAS, EMAIL, ADDRESS1-3, PHONE1-4). The NASL ent...

CVE-2002-0232

Directory traversal vulnerability in Multi Router Traffic Grapher MRTG allows remote attackers to read portions of arbitrary files via a .. dot dot in the cfg parameter for 1 14all.cgi, 2 14all-1.1.cgi, 3 traffic.cgi, or 4 mrtg.cgi...

CVE-2002-0279

The kernel in HP-UX 11.11 does not properly provide arguments for setrlimit, which could allow local attackers to cause a denial of service kernel panic and possibly gain privileges...

CVE-2002-0304

Lil HTTP Server 2.1 allows remote attackers to read password-protected files via a /./ in the HTTP request...

CVE-2002-0263

Buffer overflow in EasyBoard 2000 1.27 aka EZboard allows remote attackers to execute arbitrary code via a long boundary value in a multipart Content-Type header to 1 ezboard.cgi, 2 ezman.cgi, or 3 ezadmin.cgi...

CVE-2002-0319

Cross-site scripting vulnerability in edituser.php for pforum 1.14 and earlier allows remote attackers to execute script and steal cookies from other users via Javascript in a username...

CVE-2002-0203

ttawebtop.cgi in Tarantella Enterprise 3.20 on SPARC Solaris and Linux, and 3.1x and 3.0x including 3.11.903, allows remote attackers to view directory contents via an empty pg parameter...

CVE-2002-0221

Etype Eserv 2.97 allows remote attackers to cause a denial of service resource exhaustion via a large number of PASV commands that consume ports 1024 through 5000, which prevents the server from accepting valid PASV...

CVE-2002-0312

Directory traversal vulnerability in Essentia Web Server 2.1 allows remote attackers to read arbitrary files via a .. dot dot in a URL...

CVE-2002-0217

Cross-site scripting CSS vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients via 1 the Title field or a Private Message Box or 2 the image field parameter in pmlite.php...

CVE-2002-0218

Format string vulnerability in 1 sastcpd in SAS/Base 8.0 and 8.1 or 2 objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via format specifiers in a command line argument...

CVE-2002-0262

Directory traversal vulnerability in netget for Sybex E-Trainer web server allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2002-0338

The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service crash via an attachment whose name includes an MS-DOS device name...

CVE-2002-0228

Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and web site navigation, and possibly more when the user is connected to certain Microsoft sites or DNS-spoofed sites...

CVE-2002-0249

PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message...

CVE-2002-0298

Summary: CVE-2002-0298 affects ScriptEase MiniWeb Server 0.95. Vulnerability: remotely trigger a denial of service (crash) via crafted HTTP GET requests that include (1) encoded dot-dot (%2e%2e), (2) multiple /../ sequences, (3) a missing URI, or (4) ..// in a URI that does not start with a slash...

CVE-2002-0303

GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of other users by logging in without a password...

CVE-2002-0281

Cross-site scripting vulnerability in DCP-Portal 4.2 and earlier allows remote attackers to gain privileges of other portal users by providing Javascript in the job information field to userupdate.php...