CVE-2002-0314

fasttrack p2p, as used in 1 KaZaA before 1.5, 2 grokster, and 3 morpheus allows remote attackers to cause a denial of service memory exhaustion via a series of client-to-client messages, which pops up new windows per message...

CVE-2002-0284

The CVE-2002-0284 entry affects Winamp versions 2.77 and 2.78. When opening a WMA file that requires a license, Winamp apparently sends the full path of the Temporary Internet Files directory to the web page processing the license, potentially allowing a malicious web server to obtain that pathna...

CVE-2002-0342

Kmail 1.2 on KDE 2.1.1 is affected by a vulnerability that allows remote attackers to cause a denial-of-service (crash) by sending an email with a body of about 55 KB. The available sources confirm the affected product and the nature of the impact (availability impact: crash) but do not provide a...

CVE-2002-0217

CVE-2002-0217 affects XOOPS 1.0 RC1 — the Private Message System is vulnerable to cross-site scripting via the PM title/field or the image parameter in pmlite.php. The root cause is insufficient input filtering, allowing remote attackers to run Javascript in other users’ browsers. Documented impa...

CVE-2002-0216

CVE-2002-0216 affects XOOPS 1.0 RC1: the userinfo.php script is vulnerable to SQL injection via the uid parameter, allowing remote attackers to retrieve sensitive data. The vulnerability stems from improper handling of user input in SQL clauses (example: uid value causing a syntax error revealing...

CVE-2002-0332

The CVE-2002-0332 issue affects xtell/xtelld (Debian xtell package) and is described to allow remote code execution through three vectors: (1) a long DNS hostname obtained via reverse DNS, (2) a long AUTH string, and (3) certain data in the xtell request, across xtell versions 1.91.1 and earlier ...

CVE-2002-0303

CVE-2002-0303 affects Novell GroupWise 6 when using LDAP authentication and the Post Office has a blank username and password. The vulnerability allows an attacker to log in without a password and gain privileges of other users. Root cause described in the public description is an authentication ...

CVE-2002-0235

Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event...

CVE-2002-0208

PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows remote attackers to determine that the system is running PGPfire...

CVE-2002-0282

DCP-Portal versions 3.7–4.5 contain an information disclosure vulnerability that allows remote attackers to obtain the server’s physical path. The issue occurs when an empty request to add_user.php is made, or via an invalid new_language parameter in contents.php, categories.php, or files.php, ca...

CVE-2002-0294

The CVE-2002-0294 entry concerns Alcatel 4400. The affected component is the /chetc/shutdown command which is installed with setgid privileges. The underlying issue is privilege escalation by assigning setgid to a program used for system shutdown, enabling local users to shut down the system (imp...

CVE-2002-0295

CVE-2002-0295 affects Alcatel OmniPCX 4400; the flaw is that setup installs files with world-writable permissions, enabling local users to reconfigure the system and potentially obtain privileges. Documented impact is local, with partial confidentiality/integrity/availability. No explicit exploit...

CVE-2002-0293

The CVE-2002-0293 entry describes a Local Privilege Escalation in the Alcatel OmniPCX 4400 FTP service: the halt user can gain root privileges by modifying root's .profile. This yields full confidentiality, integrity, and availability impact as stated. The connected documents do not provide speci...

CVE-2002-0225

tacplus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and writable permissions, which allows local users to access and modify sensitive files...

CVE-2002-0216

userinfo.php in XOOPS 1.0 RC1 allows remote attackers to obtain sensitive information via a SQL injection attack in the "uid" parameter...

CVE-2002-0327

The CVE-2002-0327 entry documents a local privilege escalation in Century Software TERM caused by a buffer overflow in the callin program when given a long tty argument. The vulnerability allows local users to gain root privileges. No specific exploit code or affected versions are provided in the...

CVE-2002-0154

Microsoft SQL Server 7.0 and SQL Server 2000 contain buffer overflow vulnerabilities in multiple extended stored procedures. A remote attacker could exploit these to cause a denial of service or execute arbitrary code (potentially with the SQL Server service account privileges), and could even af...

CVE-2002-1602

Buffer overflow in the Braille module for GNU screen 3.9.11, when HAVEBRAILLE is defined, allows local users to execute arbitrary code...

CVE-2002-0072

The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server IIS 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service crash when the URL parser accesses a nu...

CVE-2002-0153

Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, aka the "Local Applescript Invocation" vulnerability...