CVE-2002-0249

PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message...

CVE-2002-0250

Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authentication via a direct HTTP request to the webaccess.html file, which allows the user to change the switch's configuration and modify the...

CVE-2002-0252

Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header...

CVE-2002-0253

PHP, when not configured with the "displayerrors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and...

CVE-2002-0254

ICQ 2001b Build 3659 allows remote attackers to cause a denial of service crash via a malformed picture that contains large height and width values, which causes the crash when viewed in Userdetails...

CVE-2002-0257

Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields 1 TITLE, 2 DESCTIT, 3 DESC, 4 searchstring, 5 ALIAS, 6 EMAIL, 7 ADDRESS1, 8 ADDRESS2, 9 ADDRESS3, 10 PHONE1, 11 PHONE2, 12 PHONE3, or ...

CVE-2002-0258

Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs...

CVE-2002-0263

Buffer overflow in EasyBoard 2000 1.27 aka EZboard allows remote attackers to execute arbitrary code via a long boundary value in a multipart Content-Type header to 1 ezboard.cgi, 2 ezman.cgi, or 3 ezadmin.cgi...

CVE-2002-0267

preferences.php in Simple Internet Publishing System SIPS before 0.3.1 allows remote attackers to gain administrative privileges via a linebreak in the "theme" field followed by the Status::admin command, which causes the Status line to be entered into the password file...

CVE-2002-0269

Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent...

CVE-2002-0355

netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions...

CVE-2002-0362

Buffer overflow in AOL Instant Messenger AIM 4.2 and later allows remote attackers to execute arbitrary code via a long AddExternalApp request and a TLV type greater than 0x2711...

CVE-2002-0363

ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice...

CVE-2002-0374

Format string vulnerability in the logging function for the pamldap PAM LDAP module before version 144 allows attackers to execute arbitrary code via format strings in the configuration file name...

CVE-2002-0377

Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files...

CVE-2002-0259

InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in 1 .pwd files in the miniportal/apache directory, or 2 mplog.txt, which could allow local users to gain privileges...

Important: Red Hat Security Advisory: : : : Updated nss_ldap packages fix pam_ldap vulnerability

Updated nssldap packages are now available for Red Hat Linux 6.2, 7, 7.1, 7.2, and 7.3. These packages fix a string format vulnerability in the pamldap module. Update Jun 4, 2002 Replacement packages have been added for Red Hat Linux 6.2. The previous packages could not be installed with the...

Oracle 8i TNS Listener SERVICE_NAME Buffer Overflow

This module exploits a stack buffer overflow in Oracle. When sending a specially crafted packet containing a long SERVICENAME to the TNS service, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/oracle/tns/servicename msf undefinedservicename show actions...

MS02-024: Windows Debugger flaw can Lead to Elevated Privileges (320206)

The remote host contains a flaw in the Windows Debugger that could allow a local user to elevate his privileges. To exploit this vulnerability, a user needs to send a specially crafted code to the Debbuging handler to execute arbitrary code with SYSTEM privileges. %NASLMINLEVEL 70300 C Tenable...

CVE-2002-0360

The CVE-2002-0360 issue affects Sun AnswerBook2 1.4–1.4.3, where a buffer overflow in the gettransbitmap CGI allows a remote attacker to execute arbitrary code via a long filename argument. Impact is remote code execution with the daemon privileges; no exploit details are provided in the document...