CVE-2002-1407

TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack...

CVE-2002-1416

The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct brute force attacks...

CVE-2002-1143

Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using 1 INCLUDETEXT or 2 INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates...

CVE-2002-0074

Cross-site scripting vulnerability in Help File search facility for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session...

CVE-2002-1015

RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary script in the Local computer zone by inserting the script into the skin.ini file of an RJS archive, then referencing skin.ini from a web page after it has been extracted, which ...

CVE-2001-0959

The CVE-2001-0959 entry concerns Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0, which create a hidden administrative share named ARCSERVE$. This behavior enables remote attackers to access sensitive information and to overwrite critical files. The vulnerability is described ...

CVE-2002-0147

CVE-2002-0147 describes a heap-based buffer overflow in IIS's ASP data transfer/chunked encoding, affecting IIS 4.0, 5.0 and 5.1. An attacker could cause a denial of service or execute arbitrary code on the server, with privileges depending on the affected ISAPI/ASP context (IWAM_computername or ...

CVE-2002-0691

CVE-2002-0691 affects Microsoft Internet Explorer 5.01 and 5.5, enabling remote attackers to execute scripts in the Local Computer zone via a URL referencing a local HTML resource file (Cross-Site Scripting in Local HTML Resource, CAN-2002-0189). CERT and CVE records describe vulnerable local res...

CVE-2002-0006

Vulnerability summary (CVE-2002-0006) : XChat versions 1.8.7 and earlier (including default configurations of 1.4.2 and 1.4.3) are vulnerable. A remote attacker can execute arbitrary IRC commands as another client by sending specially encoded characters in a PRIVMSG that calls CTCP PING, which ca...

CVE-2002-0513

CVE-2002-0513 affects the popper_mod PHP administration script (versions 1.2.1 and earlier). The vulnerability arises because the admin interface relies on Apache .htaccess authentication, enabling remote attackers to gain administrative privileges if the administrator does not configure the scri...

CVE-2002-0014

CVE-2002-0014 affects Pine up to version 4.43 and earlier. The vulnerability lies in URL-handling code that allows remote attackers to execute arbitrary commands when a URL enclosed in single quotes and containing shell metacharacters is processed. Impact is remote code execution with network acc...

CVE-2002-0431

CVE-2002-0431 affects the XTux system, where remote attackers can trigger a denial of service by sending random inputs during the initial connection. The vulnerability is described as causing CPU consumption, with no details about affected versions, exploit methods, or available fixes in the prov...

CVE-2002-0392

Affected software: Apache HTTP Server 1.3.x (up to 1.3.24) and 2.0.x (up to 2.0.36). The vulnerability arises from processing chunk-encoded HTTP requests, causing Apache to compute an incorrect size, which can lead to a remote denial of service and, in some reports, potential arbitrary code execu...

CVE-2002-0011

Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login...

CVE-2002-0163

Vulnerability: Squid earlier than 2.4 STABLE4 and some 2.5/2.6 builds were exposed to a heap-based buffer overflow in the internal DNS code when handling compressed DNS responses, caused by improper bounds/checks in lib/rfc1035.c. Impact per sources: potential denial of service and possible remot...

CVE-2002-1495

Cross-site scripting XSS vulnerability in JAWmail 1.0-rc1 allows remote attackers to insert arbitrary script or HTML via 1 attached file names in the Read Mail feature, 2 text/html mails that are displayed in a pop-up window, and 3 certain malicious attributes within otherwise safe tags, such as...

APC < 3.8.0 apcupsd Multiple Vulnerabilities

The remote host is running the apcupsd client which, according to its version number, is affected by multiple vulnerabilities : - The configuration file '/var/run/apcupsd.pid' is by default world-writable. A local attacker could re-write this file with other process IDs in order to crash the...

MDKSA-2003:036 - Updated netpbm packages fix math overflow errors

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrake Linux Security Update Advisory Package name: netpbm Advisory ID: MDKSA-2003:036 Date: March 25th, 2003 Affected versions: 8.2, 9.0, 9.1, Corporate Server 2.1, Multi Network Firewall 8.2 Problem Description: Several math overflow errors were...

CVE-2002-1484

DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems port scan via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error...

CVE-2002-1455

CVE-2002-1455 describes multiple cross-site scripting (XSS) vulnerabilities in OmniHTTPd that allow remote attackers to inject script or HTML into web pages. Exploitation via (1) test.php, (2) test.shtml, or (3) redir.exe is indicated in the description. The connected documents corroborate the pr...