CVE Vulnerability Catalog

CVE-2002-0958 is a cross-site scripting vulnerability in browse.php for PHP(Reactor) 1.2.7 that allows remote attackers to execute scripts as other users via the go parameter in the comments section.

Buffer overflow in HylaFAX faxgetty before version 4.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long line of image data.

The summary_graph_functions.php file in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location of the PHP code.

Cross-site scripting vulnerability in TransWARE Active! mail 1.422 and 2.0 allows remote attackers to execute arbitrary code via a certain e-mail header, which is not properly filtered.

Directory traversal vulnerability in splashAdmin.php for Cobalt Qube 3.0 allows local users and remote attackers to gain privileges as the Qube Admin via .. (dot dot) sequences in the sessionId cookie that point to an alternate session file.

Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 allows remote attackers to execute arbitrary code via a long RCPT TO command.

Jana Server versions 2.x through 2.2.1, and 1.4.6 and earlier do not restrict the number of unsuccessful login attempts, making it easier for remote attackers to gain privileges via brute force username and password guessing.

Buffer overflow in web server for Tivoli Management Framework (TMF) Endpoint versions 3.6.x through 3.7.1, before Fixpack 2, allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request.

Cisco VPN 3000 Concentrator versions 2.2.x and 3.x before 3.5.3 introduces an 'HTTPS on Public Inbound (XML-Auto)(forward/in)' rule but sets the protocol to 'ANY', allowing arbitrary traffic to pass through the concentrator.

RealJukebox 2 and RealOne Player Gold allow remote attackers to execute arbitrary script in the Local computer zone by modifying the skin.ini file in an RJS archive. After extraction, the skin.ini file is parsed as HTML by Microsoft-based web readers.

Buffer overflow in MyWebServer 1.02 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

Multiple SQL injection vulnerabilities in CARE 2002 before beta 1.0.02 allow remote attackers to perform unauthorized database operations.

Signedness error in Jana Server versions 2.x through 2.2.1, and 1.4.6 and earlier allows remote attackers to execute arbitrary code via long (1) Username, (2) Password, or (3) Hostname entries.

Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.5.1C does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, allowing remote attackers to conduct man-in-the-middle attacks.

Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier allow local users to gain root privileges via long parameters (-U, -D, -P, -S, -N, -u).

CVE-2002-1036 is a vulnerability in search.pl for Fluid Dynamics Search Engine (FDSE) before version 2.0.0.0055, allowing remote attackers to execute web scripts via the Rank or Match parameters.

Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.5.2B does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.

Buffer overflow in 4D web server 6.7.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.

none.php for SunPS iRunbook 2.5.2 allows remote attackers to read arbitrary files via an absolute pathname in the argument.

CVE-2002-1007 describes cross-site scripting vulnerabilities in Blackboard 5 that allow remote attackers to execute arbitrary web scripts. The attack can be carried out by manipulating parameters in various scripts, such as login.pl, ProcessInfo.cgi, and index.cgi.