CVE-2002-0967

Buffer overflow in eDonkey 2000 35.16.60 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long "ed2k:" URL...

CVE-2002-0968

Buffer overflow in AnalogX SimpleServer:WWW 1.16 and earlier allows remote attackers to cause a denial of service crash and execute code via a long HTTP request method name...

CVE-2002-1089

rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in additional attacks...

Apache Httpd < 1.3.27 : Error page XSS using wildcard DNS

Cross-site scripting XSS vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header...

CVE-2001-1402

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting CSS and possibly SQL injection attacks on 1 the product or output form variables for reports.cgi, 2 the voteon, bugid, and user...

CVE-2002-1078

Abyss Web Server 1.0.3 allows remote attackers to list directory contents via an HTTP GET request that ends in a large number of / slash characters...

CVE-2002-0735

Format string vulnerability in the logging function in C-Note Squid LDAP authentication module squidauthLDAP 2.0.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code by triggering log messages...

CVE-2002-0822

Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly excecute arbitrary code via the 1 SOCKS, 2 RSVP, 3 AFS, or 4 LMP dissectors, which can be caused to core dump...

CVE-2002-0848

Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier, when using RADIUS with a challenge type of Password Authentication Protocol PAP or Challenge, sends the user password in cleartext in a validation retry request, which could allow remote attackers to...

CVE-2002-0515

IPFilter 3.4.25 and earlier sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attackers to identify filtered ports by comparing TTLs...

CVE-2002-0738

MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by 1 splitting the SCRIPT tag into smaller pieces, 2 including the script in a SRC argument to an IMG tag, or 3 using "&=script" syntax...

Exploiting the Google toolbar &#40;GM#001-MC&#41;

GreyMagic Security Advisory GM001-MC ===================================== By GreyMagic Software, Israel. 08 Aug 2002. Available in HTML format at http://security.greymagic.com/adv/gm001-mc/. Topic: Exploiting the Google toolbar. Discovery date: 31 Jul 2002. Affected applications:...

Vulnerability in OpenSSL CVE-2002-0659

A flaw in the ASN1 library allowed remote attackers to cause a denial of service by sending invalid encodings...

CVE-2002-0787

Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified 1 LOCID or 2 OC parameters...

CVE-2001-1183

PPTP implementation in Cisco IOS 12.1 and 12.2 allows remote attackers to cause a denial of service crash via a malformed packet...

CVE-2001-1072

CVE-2001-1072 affects Apache with mod_rewrite enabled on UNIX systems. The vulnerability arises when an attacker can insert extra / characters into the requested path, causing the RewriteRule’s regular expression to fail and allowing the path to bypass RewriteRules. The affected component is mod_...

CVE-2001-0901

CVE-2001-0901 involves Hypermail and remote command execution via Server Side Includes (SSI). A malicious user can attach a file with a .shtml extension, which is archived on the server and can be executed by requesting the attachment’s URL, allowing arbitrary commands to run on the server. The c...

CVE-2001-0962

The CVE-2001-0962 entry concerns IBM WebSphere Application Server versions 3.02 through 3.53, where session IDs used in cookies are predictable. This predictability enables remote attackers to brute-force session IDs and gain privileges of WebSphere users. The documented impact is privilege escal...

CVE-2002-0237

Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a flood of large ICMP ping packets...

CVE-2001-1161

Affected software: IBM Domino (Lotus Domino) 5.0.6. Vulnerable component: cross-site scripting due to improper sanitization when requesting a '.nsf' file or URL ending with Javascript; an attacker can craft a URL to execute script in the user’s browser. Impact: remote script execution in the brow...