CVE-2002-0268

Identix BioLogon 3 is affected. The vulnerability allows users with physical access to elevate to administrative privileges by triggering CTRL-ALT-DEL and invoking a Browse function that launches Explorer with SYSTEM privileges. The issue is described with a CVSSv2 base score of 7.2 (HIGH) and a ...

CVE-2002-0314

Technical details about CVE-2002-0314 are not publicly available in the provided connected documents; the materials here only reiterate the generic description from the NVD listings. Monitor for updates.

CVE-2002-0303

CVE-2002-0303 affects Novell GroupWise 6 when using LDAP authentication and the Post Office has a blank username and password. The vulnerability allows an attacker to log in without a password and gain privileges of other users. Root cause described in the public description is an authentication ...

CVE-2002-0224

MSDTC DoS (CVE-2002-0224) affects Microsoft Windows 2000, IIS 5.x, and SQL Server up to 2000. A DoS can be triggered by sending malformed input to the MSDTC service, potentially causing crashes or hangs. OpenVAS/Nessus refer to MS02-018 as the patch that mitigates related issues; applying that pa...

CVE-2002-0304

Lil HTTP Server 2.1 is affected by a path traversal vulnerability that lets remote attackers read password-protected files by including a /./ sequence in the HTTP request. The available documents confirm the affected product and the vulnerable behavior but do not provide details on attacker explo...

CVE-2002-0325

CVE-2002-0325 describes a directory traversal vulnerability in BadBlue prior to 1.6.1 that allows remote attackers to read arbitrary files via a modified dot-dot sequence in the URL. The vulnerability is confirmed in multiple sources (NVD and CVE listings) and is categorized with medium severity ...

CVE-2002-0286

The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to adduser.php, which causes GetPassword to produce and compare a blank password for the...

CVE-2002-0326

Cross-site scripting vulnerability in BadBlue before 1.6.1 beta allows remote attackers to execute arbitrary script and possibly additional commands via a URL that contains Javascript...

CVE-2002-0236

Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user...

CVE-2002-0223

Infopop UBB.Threads 5.4 and Wired Community Software WWWThreads 5.0 through 5.0.9 allows remote attackers to upload arbitrary files by using a filename that contains an accepted extension, but ends in a different extension...

CVE-2002-0256

The telnet port in Arescom NetDSL 1000 router allows remote attackers to cause a denial of service via a series of connections with long strings, which causes a large number of login failures and causes the telnet service to stop...

CVE-2002-0336

Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a LIST command containing a large number of / slash, wildcard, and .. characters...

CVE-2002-0354

The XMLHttpRequest object XMLHTTP in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories on a client system by opening a URL that redirects the browser to the file on the client, then reading the result using the responseText property...

CVE-2002-0277

Add2it Mailman Free 1.73 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the list parameter...

CVE-2002-0235

Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username and password by submitting an incorrect login, which causes Faxpress to leak the correct username and password in plaintext in an error event...

CVE-2002-0208

PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows remote attackers to determine that the system is running PGPfire...

CVE-2002-0202

PaintBBS 1.2 installs certain files and directories with insecure permissions, which allows local users to 1 obtain the encrypted server password via the world-readable oekakibbs.conf file, or 2 modify the server configuration via the world-writeable /oekaki/ folder...

CVE-2002-0334

xtell xtelld 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file...

CVE-2002-0216

CVE-2002-0216 affects XOOPS 1.0 RC1: the userinfo.php script is vulnerable to SQL injection via the uid parameter, allowing remote attackers to retrieve sensitive data. The vulnerability stems from improper handling of user input in SQL clauses (example: uid value causing a syntax error revealing...

CVE-2002-0353

Concrete details found: CVE-2002-0353 affects Ethereal 0.9.2 and earlier, stemming from the ASN.1 parser, enabling remote denial of service via a malformed packet that triggers improper memory allocation (possibly due to zero-length fields). Public advisories reference multiple vendors (Debian, R...