CVE-2002-0233

The CVE-2002-0233 entry concerns the eshare Expressions 4 Web server. The vulnerability is a directory traversal flaw that allows an attacker to read arbitrary files by using a .. (dot dot) in an HTTP request. Affected component: the web server’s request handling. Underlying cause: improper valid...

CVE-2002-0316

The connected Nessus NASL confirms that XMB Forum (PHP) versions older than 1.9.1 are affected by multiple cross-site scripting (XSS) flaws, including CVE-2002-0316. The vulnerability allows an attacker to inject scripts that run in the context of other XMB users’ browsers. Affected software: XMB...

CVE-2002-0249

PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message...

CVE-2002-0252

Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header...

CVE-2002-0200

The CVE-2002-0200 entry concerns Cyberstop Web Server for Windows 0.1. Affected: the HTTP handling of the server. Root cause: an HTTP request for an MS-DOS device name (e.g., CON\CON, AUX.*) can trigger a denial of service by freezing/rebooting Windows. Impact: Partial availability loss as the se...

CVE-2002-0244

Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. dot dot in the pathname argument to chdir...

CVE-2002-0277

CVE-2002-0277 affects Add2it Mailman Free versions 1.73 and earlier. The vulnerability allows remote attackers to execute arbitrary commands by supplying shell metacharacters in the list parameter. This is evidenced by the NVD entry and associated descriptions. The connected documents confirm the...

CVE-2002-0217

CVE-2002-0217 affects XOOPS 1.0 RC1 — the Private Message System is vulnerable to cross-site scripting via the PM title/field or the image parameter in pmlite.php. The root cause is insufficient input filtering, allowing remote attackers to run Javascript in other users’ browsers. Documented impa...

CVE-2002-0204

CVE-2002-0204 : Buffer overflow in GNU Chess (gnuchess) 5.02 and earlier. When modified or used in a networked capacity contrary to its single‑user design, it may allow local or remote attackers to execute arbitrary code via a long command. The vulnerability is described in the NVD entry; no fixe...

CVE-2002-0295

CVE-2002-0295 affects Alcatel OmniPCX 4400; the flaw is that setup installs files with world-writable permissions, enabling local users to reconfigure the system and potentially obtain privileges. Documented impact is local, with partial confidentiality/integrity/availability. No explicit exploit...

CVE-2002-0282

DCP-Portal versions 3.7–4.5 contain an information disclosure vulnerability that allows remote attackers to obtain the server’s physical path. The issue occurs when an empty request to add_user.php is made, or via an invalid new_language parameter in contents.php, categories.php, or files.php, ca...

CVE-2002-0347

The CVE-2002-0347 entry concerns a directory traversal vulnerability in the Cobalt RAQ 4 web server. An attacker can leverage a .. (dot dot) in an HTTP request to read files, including password-protected files, and potentially access files outside the web root. The issue is described in the NVD e...

CVE-2002-0288

Directory traversal vulnerability in Phusion web server 1.0 allows remote attackers to read arbitrary files via a ... triple dot dot in the HTTP request...

CVE-2002-0305

CVE-2002-0305 concerns the Zero One Tech (ZOT) P100s print server, which does not properly disable the SNMP service or change the default password. The underlying issue allows potential unauthorized access without administrator awareness, as described in the NVD entry. The impact is described as ...

CVE-2002-0314

fasttrack p2p, as used in 1 KaZaA before 1.5, 2 grokster, and 3 morpheus allows remote attackers to cause a denial of service memory exhaustion via a series of client-to-client messages, which pops up new windows per message...

CVE-2002-0215

Agora.cgi versions 3.2r through 4.0 in debug mode disclose the full pathname of the agora.cgi file when a non-existent .html file is requested, enabling remote disclosure of server file paths. This is an information disclosure vulnerability in the web application component. The affected component...

CVE-2002-0350

CVE-2002-0350 affects HP Procurve Switch 4000M running firmware C.08.22 and C.09.09. The issue allows a remote attacker to trigger a denial of service by port scanning the management IP address, resulting in the telnet service being disabled. The vulnerability is described in multiple sources (NV...

CVE-2002-0222

The CVE-2002-0222 entry concerns Etype Eserv 2.97, where the PORT command enables an FTP bounce attack. An attacker can redirect data connections to arbitrary hosts, potentially affecting confidentiality, integrity, and availability. The NVD notes a network-accessible, low-complexity exploit with...

CVE-2002-0284

The CVE-2002-0284 entry affects Winamp versions 2.77 and 2.78. When opening a WMA file that requires a license, Winamp apparently sends the full path of the Temporary Internet Files directory to the web page processing the license, potentially allowing a malicious web server to obtain that pathna...

CVE-2002-0327

The CVE-2002-0327 entry documents a local privilege escalation in Century Software TERM caused by a buffer overflow in the callin program when given a long tty argument. The vulnerability allows local users to gain root privileges. No specific exploit code or affected versions are provided in the...