CVE-2002-0213

xkas in Xinet K-AShare 0.011.01 for IRIX allows local users to read arbitrary files via a symlink attack on the VOLICON file, which is copied to the .HSicon file in a shared directory...

CVE-2002-0215

Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the full pathname of the agora.cgi file by requesting a non-existent .html file, which leaks the pathname in an error message...

CVE-2002-0216

userinfo.php in XOOPS 1.0 RC1 allows remote attackers to obtain sensitive information via a SQL injection attack in the "uid" parameter...

CVE-2002-0217

Cross-site scripting CSS vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients via 1 the Title field or a Private Message Box or 2 the image field parameter in pmlite.php...

CVE-2002-0218

Format string vulnerability in 1 sastcpd in SAS/Base 8.0 and 8.1 or 2 objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via format specifiers in a command line argument...

CVE-2002-0219

Buffer overflow in 1 sastcpd in SAS/Base 8.0 and 8.1 or 2 objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via large command line argument...

CVE-2002-0220

phpsmssend.php in PhpSmsSend 1.0 allows remote attackers to execute arbitrary commands via an SMS message containing shell metacharacters...

CVE-2002-0224

The MSDTC Microsoft Distributed Transaction Service Coordinator for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to cause a denial of service crash or hang via malformed random input...

CVE-2002-0225

tacplus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and writable permissions, which allows local users to access and modify sensitive files...

CVE-2002-0226

retrievepassword.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to request a new password on behalf of another user and use the sessionID to calculate the new password for that user...

CVE-2002-0228

Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and web site navigation, and possibly more when the user is connected to certain Microsoft sites or DNS-spoofed sites...

CVE-2002-0230

Cross-site scripting vulnerability in fom.cgi of Faq-O-Matic 2.712 allows remote attackers to execute arbitrary Javascript on other clients via the cmd parameter, which causes the script to be inserted into an error message...

CVE-2002-0231

Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname...

CVE-2002-0210

setlicense for TOLIS Group Backup and Restore Utility BRU 17.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/brutest.$$ temporary file...

OpenSSH Kerberos TGT/AFS Token Passing Remote Overflow

You are running a version of OpenSSH older than OpenSSH 3.2.1. A buffer overflow exists in the daemon if AFS is enabled on your system, or if the options KerberosTgtPassing or AFSTokenPassing are enabled. Even in this scenario, the vulnerability may be avoided by enabling UsePrivilegeSeparation...

CVE-2002-0375

CVE-2002-0375 affects the SGDynamo CGI executable (sgdynamo.exe). The vulnerability is a cross-site scripting (XSS) flaw that lets remote attackers inject arbitrary Javascript via the HTNAME parameter in a URL. The root cause is described as a bug in some versions of this CGI. Exploitation detail...

CVE-2002-0375

Cross-site scripting vulnerability in sgdynamo.exe for Sgdynamo allows remote attackers to execute arbitrary Javascript via a URL with the script in the HTNAME parameter...

CVE-2002-0331

CVE-2002-0331 describes a directory traversal vulnerability in the HTTP server of BPM Studio Pro 4.2, enabling remote attackers to read arbitrary files by using a dot-dot sequence in the HTTP request. Per the provided records, the impact is listed as confidentiality: none , integrity: partial , a...

CVE-2002-0332

The CVE-2002-0332 issue affects xtell/xtelld (Debian xtell package) and is described to allow remote code execution through three vectors: (1) a long DNS hostname obtained via reverse DNS, (2) a long AUTH string, and (3) certain data in the xtell request, across xtell versions 1.91.1 and earlier ...

CVE-2002-0333

CVE-2002-0333 affects xtell/xtelld prior to 2.7 and 1.91.1 and allows directory traversal via a .. in the TTY argument. The vulnerability lets remote attackers read files with short names, and local users read more files through a short-name symlink. Impact described in public records includes cr...