5356 matches found
CVE-2002-0278
CVE-2002-0278: Directory traversal vulnerability in Add2it Mailman Free 1.73 and earlier enables remote attackers to modify arbitrary files via a .. in the list parameter. Affected product: Add2it Mailman Free (version 1.73 and earlier). Root cause: improper handling of directory traversal in the...
CVE-2002-0244
Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. dot dot in the pathname argument to chdir...
CVE-2002-0259
CVE-2002-0259 affects InstantServers MiniPortal 1.1.5 and earlier. The vulnerability arises from storing sensitive login/account data in plaintext in (1) .pwd files under miniportal/apache, and (2) mplog.txt, enabling local users to gain privileges. Details in connected records confirm the file p...
CVE-2002-0239
CVE-2002-0239 affects hanterm (Hangul terminal for X11). The vulnerability is a buffer overflow in the font handling code that reads Korean characters, triggered by long strings in the (1) -fn, (2) -hfb, or (3) -hfn arguments, for hanterm versions 3.3.1 and earlier. The issue can let a local atta...
CVE-2002-0316
The connected Nessus NASL confirms that XMB Forum (PHP) versions older than 1.9.1 are affected by multiple cross-site scripting (XSS) flaws, including CVE-2002-0316. The vulnerability allows an attacker to inject scripts that run in the context of other XMB users’ browsers. Affected software: XMB...
CVE-2002-0286
The CVE affects SiteNews 0.10 and 0.11. In function.php, the GetPassword routine can be abused when a remote attacker supplies a non-existent username and the MD5 checksum of an empty password to add_user.php. This causes GetPassword to generate and compare a blank password for the non-existent u...
CVE-2002-0344
Symantec LiveUpdate 1.5 and earlier in Norton Antivirus stores usernames and passwords for a local LiveUpdate server in cleartext in the registry, which may allow remote attackers to impersonate the LiveUpdate server...
CVE-2002-0253
PHP, when not configured with the "displayerrors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and...
CVE-2002-0286
The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to adduser.php, which causes GetPassword to produce and compare a blank password for the...
CVE-2002-0202
PaintBBS 1.2 installs certain files and directories with insecure permissions, which allows local users to 1 obtain the encrypted server password via the world-readable oekakibbs.conf file, or 2 modify the server configuration via the world-writeable /oekaki/ folder...
CVE-2002-0231
Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname...
CVE-2002-0308
admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments...
CVE-2002-0336
Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a LIST command containing a large number of / slash, wildcard, and .. characters...
CVE-2002-0256
The telnet port in Arescom NetDSL 1000 router allows remote attackers to cause a denial of service via a series of connections with long strings, which causes a large number of login failures and causes the telnet service to stop...
CVE-2002-0223
Infopop UBB.Threads 5.4 and Wired Community Software WWWThreads 5.0 through 5.0.9 allows remote attackers to upload arbitrary files by using a filename that contains an accepted extension, but ends in a different extension...
CVE-2002-0353
The ASN.1 parser in Ethereal 0.9.2 and earlier allows remote attackers to cause a denial of service crash via a certain malformed packet, which causes Ethereal to allocate memory incorrectly, possibly due to zero-length fields...
CVE-2002-0258
Merak Mail IceWarp Web Mail uses a static user session ID that does not change across sessions. This could allow remote attackers who obtain the session ID to elevate privileges as the targeted user (e.g., via IDs exposed in answers or forward URLs). Affected product: Merak Mail IceWarp Web Mail....
CVE-2002-0326
Cross-site scripting vulnerability in BadBlue before 1.6.1 beta allows remote attackers to execute arbitrary script and possibly additional commands via a URL that contains Javascript...
CVE-2002-0254
ICQ 2001b Build 3659 allows remote attackers to cause a denial of service crash via a malformed picture that contains large height and width values, which causes the crash when viewed in Userdetails...