CVE Vulnerability Catalog

CVE-2002-0501 describes a format string vulnerability in the log_print() function of the Posadis DNS server before version m5pre2, allowing local users and possibly remote attackers to execute arbitrary code via format strings inserted into logging messages.

Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.

The db.php file in phpBB 2.0 (including RC-3 and earlier versions) contains a vulnerability that allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter.

The file filemanager_forms.php in PHProjekt versions 3.1 and 3.1a has a vulnerability that allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in the lib_path parameter.

Check Point FireWall-1 SecuRemote/SecuClient versions 4.0 and 4.1 allow clients to bypass the 'authentication timeout' by modifying the to_expire or expire values in the client's users.C configuration file.

Foundry Networks ServerIron switches do not decode URIs when applying 'url-map' rules, which could make it easier for attackers to forward traffic to a different server than intended.

CVE-2002-0458 is a cross-site scripting vulnerability in News-TNK version 1.2.1 and earlier that allows remote attackers to execute arbitrary Javascript via the WEB parameter.

Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parameter.

Standalone Macromedia Flash Player 5.0 before version 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the 'exec' FSCommand.

AeroMail versions before 1.45 have a cross-site scripting vulnerability in message.php, allowing remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.

ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d allows user 'skank' on machine 'starscream' to become a key manager when the 'first time connection' feature is enabled and before any legitimate administrators have connected.

Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients.

CVE-2002-0412 describes a vulnerability in the TraceEvent function in ntop before version 2.1 that allows remote attackers to execute arbitrary code by injecting format strings into calls to the syslog function. This can be done via an HTTP GET request, a username in HTTP authentication, or a password in HTTP authentication.

A cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.

The traceroute.pl CGI script version 1.0 for Linux Directory Penguin allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter.

KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems do not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.

Instant Web Mail versions before 0.60 do not properly filter CR/LF sequences, allowing remote attackers to execute arbitrary POP commands via the id parameter in message.php or modify certain mail message headers via various parameters in write.php.

Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.

The admin.php file in AlGuest 1.0 guestbook checks for the existence of the admin cookie to authenticate the AlGuest administrator, allowing remote attackers to bypass authentication and gain privileges by setting the admin cookie to an arbitrary value.

Ecartis (formerly Listar) 1.0.0 in snapshot 20020125 and earlier does not properly drop privileges when installed setuid-root, and 'lock-to-user' is not set. This could allow local users to gain elevated privileges.