[CLOSE] OSVDB ID : 59091 - Disclosed: 2002-12-31

Description:

Perl-HTTPd contains a flaw that allows a remote user to traverse outside of a restricted path. The issue is due to the application not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the URI. This directory traversal attack would allow the attacker to view files outside of the web root directory.

[CLOSE] OSVDB ID : 60056 - Disclosed: 2002-12-31

Description:

PEEL contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'haut.php' script not properly sanitizing user input supplied to the 'dirroot' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 9836 - Disclosed: 2002-12-30

Description:

A remote overflow exists in John Frank's WN Server. The application fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted GET request containing 1,600 or more characters, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 16568 - Disclosed: 2002-12-29

Description:

(Description Provided by CVE) : The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a denial of service (infinite loop) when leafnode requests a cross-posted article to one group whose name is a prefix of another group.

[CLOSE] OSVDB ID : 23497 - Disclosed: 2002-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 60140 - Disclosed: 2002-12-29

Description:

(Description Provided by CVE) : Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

[CLOSE] OSVDB ID : 60141 - Disclosed: 2002-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4762 - Disclosed: 2002-12-28

Description:

Telindus ADSL Routers contain a flaw that may allow a remote attacker to gain administrative access. The issue is due to the use of weak encryption for remote management access. If an attacker can sniff the remote management traffic stream they could trivially decrypt the traffic to learn the administrative password.

[CLOSE] OSVDB ID : 9076 - Disclosed: 2002-12-28

Description:

glFTPd contains a non-descript flaw only described as "small exploit". No further details have been provided and the vendor did not respond to e-mails regarding the issue.

[CLOSE] OSVDB ID : 34153 - Disclosed: 2002-12-28

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in publish_xp_docs.php for Gallery 1.3.2 allows remote attackers to inject arbitrary PHP code by specifying a URL to an init.php file in the GALLERY_BASEDIR parameter.

[CLOSE] OSVDB ID : 22165 - Disclosed: 2002-12-27

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 10357 - Disclosed: 2002-12-27

Description:

(Description Provided by CVE) : Buffer overflow in typespeed 0.4.2 and earlier allows local users to gain privileges via long input.

[CLOSE] OSVDB ID : 14530 - Disclosed: 2002-12-27

Description:

(Description Provided by CVE) : Heap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow attackers to cause a denial of service or execute arbitrary code.

[CLOSE] OSVDB ID : 66731 - Disclosed: 2002-12-27

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 7916 - Disclosed: 2002-12-26

Description:

Microsoft Internet Explorer (IE) contains a flaw that allows a remote cross site scripting attack. This issue is due to IE inproperly sanitizing URL input when it generates a page to load a multimedia file. By creating a specially crafted URL for a multimedia file containing embedded script, a remote attacker can execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 2973 - Disclosed: 2002-12-26

Description:

Microsoft Internet Explorer contains a flaw in the 'plugin.ocx' file. This issue is triggered when it renders third party file types (such as .swf). The "EnableFullPage" parameter does not have sufficient sanity checking performed which allows an attacker to inject arbitrary script code. This can be exploited when a vulnerable browser loads a web document.

[CLOSE] OSVDB ID : 60057 - Disclosed: 2002-12-26

Description:

(Description Provided by CVE) : Windows File Protection (WFP) in Windows 2000 and XP does not remove old security catalog .CAT files, which could allow local users to replace new files with vulnerable old files that have valid hash codes.

[CLOSE] OSVDB ID : 14848 - Disclosed: 2002-12-24

Description:

(Description Provided by CVE) : Unknown vulnerability in the AUTH_DES authentication for RPC in Solaris 2.5.1, 2.6, and 7, SGI IRIX 6.5 to 6.5.19f, and possibly other platforms, allows remote attackers to gain privileges.

[CLOSE] OSVDB ID : 2937 - Disclosed: 2002-12-24

Description:

UNIXcode.org's monopd has a flaw which may allow a remote attacker to execute arbitrary code. The issue is due to the use of vsprintf which allows for a buffer overflow in the messaging framework.

[CLOSE] OSVDB ID : 10747 - Disclosed: 2002-12-23

Description:

(Description Provided by CVE) : Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf.

[CLOSE] OSVDB ID : 35407 - Disclosed: 2002-12-22

Description:

(Description Provided by CVE) : Untrusted search path vulnerability in Pedro Lineu Orso chetcpasswd 2.4.1 and earlier allows local users to gain privileges via a modified PATH that references a malicious cp binary. NOTE: this issue might overlap CVE-2006-6639.

[CLOSE] OSVDB ID : 143 - Disclosed: 2002-12-22

Description:

(Description Provided by CVE) : Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.

[CLOSE] OSVDB ID : 6351 - Disclosed: 2002-12-21

Description:

Bugzilla contains a flaw that may lead to an unauthorized information disclosure. The default .htaccess scripts fail to properly prevent access to backups of the lcoalconfig file created by a text editor (typically with a .swp or ~ suffix). It is possible for a remote attacker to download a backup copy of the localconfig file and obtain a user's database password, resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 7352 - Disclosed: 2002-12-21

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages.

[CLOSE] OSVDB ID : 19897 - Disclosed: 2002-12-20

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4805 - Disclosed: 2002-12-20

Description:

An unspecified overflow exists in several Axis Communications Products (Camera, DVR and Video Server). These products contain an unspecified flaw in the authentication code module resulting in a stack overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 4534 - Disclosed: 2002-12-20

Description:

SPGpartenaires contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the pass variable in the ident.php module is not verified properly and will allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 4537 - Disclosed: 2002-12-20

Description:

SPGpartenaires contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the SPGP variable in the delete.php module is not verified properly and will allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 4468 - Disclosed: 2002-12-20

Description:

RealNetworks Helix Universal Server and RealServer contain a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the server not properly handling multiple simultaneous HTTP GET requests. If an attacker sends two specially crafted requests it will overflow a buffer allowing execution of arbitrary code with the privileges of the server.

[CLOSE] OSVDB ID : 4579 - Disclosed: 2002-12-20

Description:

Real Networks Helix Universal Server and RealServer contain a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to a flaw in the RTSP DESCRIBE request handling that doesn't properly sanitize user input. If an attacker sends a specially crafted RTSP DESCRIBE request with an overly long URL they may be able to overflow a buffer and execute arbitrary code with the same privilege as the server.

[CLOSE] OSVDB ID : 4580 - Disclosed: 2002-12-20

Description:

Real Networks Helix Universal Server and RealServer contain a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to a flaw in the RTSP SETUP request handling that doesn't properly sanitize user input. If an attacker sends a specially crafted RTSP SETUP request with an overly long transport field they may be able to overflow a buffer and execute arbitrary code with the same privilege as the server.

[CLOSE] OSVDB ID : 7980 - Disclosed: 2002-12-20

Description:

PunBB contains a flaw that may allow unauthorized users to view restriced forums resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 13000 - Disclosed: 2002-12-20

Description:

(Description Provided by CVE) : Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.

[CLOSE] OSVDB ID : 3169 - Disclosed: 2002-12-19

Description:

W-Agora contains a flaw that may allow an "admin" or "root" user to include php files. The issue is triggered when a specially crafted URL request to ediform.php3 occurs. It is possible that the flaw may allow execution of arbitrary code resulting in a loss of confidentiality, integrity, and/or availability.

[CLOSE] OSVDB ID : 28560 - Disclosed: 2002-12-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 44527 - Disclosed: 2002-12-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 44526 - Disclosed: 2002-12-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 14151 - Disclosed: 2002-12-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 10739 - Disclosed: 2002-12-19

Description:

(Description Provided by CVE) : Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream.

[CLOSE] OSVDB ID : 10740 - Disclosed: 2002-12-19

Description:

(Description Provided by CVE) : Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need authorization" page, as demonstrated by new-coke.