[CLOSE] OSVDB ID : 45284 - Disclosed: 2002-07-31

Description:

(Description Provided by CVE) : ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back button, then logging into the same chat room as a different user, which fills the chat room with invalid users.

[CLOSE] OSVDB ID : 44047 - Disclosed: 2002-07-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 10359 - Disclosed: 2002-07-31

Description:

(Description Provided by CVE) : Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script.

[CLOSE] OSVDB ID : 16033 - Disclosed: 2002-07-31

Description:

FreeBSD contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the FreeBSD kernel allows a malicious user to direcly supply input to file descriptors during the execution of a setuid or setgid program. This flaw may lead to a loss of integrity.

[CLOSE] OSVDB ID : 16019 - Disclosed: 2002-07-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 9682 - Disclosed: 2002-07-31

Description:

(Description Provided by CVE) : IBM UniVerse with UV/ODBC allows attackers to cause a denial of service (client crash or server CPU consumption) via a query with an invalid link between tables, possibly via a buffer overflow.

[CLOSE] OSVDB ID : 60224 - Disclosed: 2002-07-31

Description:

(Description Provided by CVE) : Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files."

[CLOSE] OSVDB ID : 45280 - Disclosed: 2002-07-30

Description:

(Description Provided by CVE) : Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. NOTE: since the only known attack vector requires command line access, this may not be a vulnerability.

[CLOSE] OSVDB ID : 857 - Disclosed: 2002-07-30

Description:

A remote overflow exists in OpenSSL. OpenSSL fails to correctly check the length of a client master key in SSLv2 negotiation, resulting in a buffer overflow. With a specially crafted request, an attacker can cause execution of arbitrary code, resulting in a loss of confidentiality, integrity, and/or availability.

[CLOSE] OSVDB ID : 3940 - Disclosed: 2002-07-30

Description:

A remote overflow exists in OpenSSL. OpenSSL fails to parse ASCII integers correctly on 64-bit platforms, resulting in an integer overflow. With a specially crafted request, an attacker can cause denial of service conditions, and possible code execution, resulting in a loss of availability and potentially also a loss of confidentiality and integrity.

[CLOSE] OSVDB ID : 3943 - Disclosed: 2002-07-30

Description:

OpenSSL's ASN.1 parser contains a flaw that may allow a malicious user to cause Denial of Service conditions. The issue is triggered when invalid ASN.1 encodings are supplied to the parser. It is possible that the flaw may allow crashing of OpenSSL, resulting in a loss of availability.

[CLOSE] OSVDB ID : 3941 - Disclosed: 2002-07-30

Description:

A remote overflow exists in OpenSSL. OpenSSL fails to correctly check the length of a session ID in SSLv3 negotiation, resulting in a buffer overflow. With a specially crafted request, an attacker can cause execution of arbitrary code, resulting in a loss of confidentiality, integrity, and/or availability.

[CLOSE] OSVDB ID : 3942 - Disclosed: 2002-07-30

Description:

A remote overflow exists in OpenSSL. OpenSSL fails to properly check the length of a master key in SSLv3 negotiation with Kerberos enabled, resulting in a stack-based buffer overflow. With a specially crafted request, an attacker can cause execution of arbitrary code, resulting in a loss of confidentiality, integrity, and/or availability.

[CLOSE] OSVDB ID : 9101 - Disclosed: 2002-07-30

Description:

(Description Provided by CVE) : IPSwitch IMail Web Calendaring service (iwebcal) allows remote attackers to cause a denial of service (crash) via an HTTP POST request without a Content-Length field.

[CLOSE] OSVDB ID : 9297 - Disclosed: 2002-07-30

Description:

eBook Reader contains a flaw that may allow a malicious user to bypass Digital Rights Management (DRM). The issue is triggered a user restores a backup from one computer on to another computer, which is supposed to be restricted. eBook Reader implements this restriction using a weak encryption algorithm, which could be exploited resulting in a loss of integrity.

[CLOSE] OSVDB ID : 59656 - Disclosed: 2002-07-30

Description:

(Description Provided by CVE) : Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields.

[CLOSE] OSVDB ID : 2070 - Disclosed: 2002-07-30

Description:

The Compaq Insight Management Agents use a vulnerable version of OpenSSL, which contains many remotely-exploitable buffer overflows. The vendor lists the affected products and versions as "Insight Management Agents for Windows version 5.3 - 5.5, Insight Manager 7, Version Control Agents, Version Control Repository Manager, Array Configuration Utility, HP Survey Utility for Windows, and Intelligent Cluster Administrator." Insight Management Agents for non-Windows platforms are listed as non-vulnerable.

[CLOSE] OSVDB ID : 14492 - Disclosed: 2002-07-30

Description:

(Description Provided by CVE) : eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by reading password.txt.

[CLOSE] OSVDB ID : 14537 - Disclosed: 2002-07-30

Description:

(Description Provided by CVE) : Unknown vulnerability in Sympoll 1.2 allows remote attackers to read arbitrary files when register_globals is enabled, possibly by modifying certain PHP variables through URL parameters.

[CLOSE] OSVDB ID : 5002 - Disclosed: 2002-07-29

Description:

HylaFAX faxgetty contains a flaw that may allow a remote denial of service. The issue is triggered when format string occurs via the TSI data element, which may allow for an attacker to casue the service to stop responding and or execute arbitrary code on the targeted host.

[CLOSE] OSVDB ID : 37815 - Disclosed: 2002-07-29

Description:

(Description Provided by CVE) : Buffer overflow in Fake Identd 0.9 through 1.4 allows remote attackers execute arbitrary code as root via a long request that is that is split into multiple packets.

[CLOSE] OSVDB ID : 5164 - Disclosed: 2002-07-29

Description:

The util-linux utilities contain a flaw that may allow a malicious user to gain elevated priviliges. The race condition can be triggered if the attacker is able to successfully execute a complex attack-sequence using /usr/bin/chfn or usr/bin/chsh. The attack requires that the system administrator interacts with the system. He specifically needs to remove /etc/ptmp before the attacker can complete the attack. The flaw, if executed successfully, will allow the attacker to create new entries in /etc/passwd.

[CLOSE] OSVDB ID : 8034 - Disclosed: 2002-07-29

Description:

Endity.com Shoutbox contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'site' variables upon submission. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 20753 - Disclosed: 2002-07-29

Description:

Multiple BSD OSs contain a flaw that may allow a malicious local user to manipulate arbitrary files on the system. The issue is due to pppd changing the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 14201 - Disclosed: 2002-07-29

Description:

(Description Provided by CVE) : The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP and SOAP/XML content from restricted sites by mapping the malicious server's parent DNS domain name to the restricted site, loading a page from the restricted site into one frame, and passing the information to the attacker-controlled frame, which is allowed because the document.domain of the two frames matches on the parent domain.

[CLOSE] OSVDB ID : 20142 - Disclosed: 2002-07-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 3591 - Disclosed: 2002-07-28

Description:

dotProject contains a flaw that allows a remote user to obtain administrative priveleges remotely. The issue is due to index.php accepting a "user_cookie" variable which it trusts to authenticate the user. By changing this value to "1", the program will log you in as the administrator.

[CLOSE] OSVDB ID : 60093 - Disclosed: 2002-07-28

Description:

(Description Provided by CVE) : Integrity Protection Driver (IPD) 1.2 and earlier blocks access to \Device\PhysicalMemory by its name, which could allow local privileged processes to overwrite kernel memory by accessing the device through a symlink.

[CLOSE] OSVDB ID : 11951 - Disclosed: 2002-07-27

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 32978 - Disclosed: 2002-07-27

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 10862 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 characters, possibly triggering a buffer overflow.

[CLOSE] OSVDB ID : 14531 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of admin.cgi, or (2) reconfigure Guestbook via direct access of config.cgi.

[CLOSE] OSVDB ID : 14536 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : The print_html_to_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users.

[CLOSE] OSVDB ID : 2079 - Disclosed: 2002-07-27

Description:

A problem with older (e.g. J3263A, J2591A, 300.0 X) JetDirect printers could make it possible for a remote user to gain administrative access to the printer which could allow a remote user to access and change configuration of the printer.

[CLOSE] OSVDB ID : 9404 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : The web server for D-Link DP-300 print server allows remote attackers to cause a denial of service (hang) via a large HTTP POST request.

[CLOSE] OSVDB ID : 14483 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : Buffer overflow in administrative web server for Brother NC-3100h printer allows remote attackers to cause a denial of service via a long password.

[CLOSE] OSVDB ID : 14486 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : Administrative web interface for IC9 Pocket Print Server Firmware 7.1.30 and 7.1.36f allows remote attackers to cause a denial of service (reboot and reset) via a long password, possibly due to a buffer overflow.

[CLOSE] OSVDB ID : 14532 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of admin.cgi, or (2) reconfigure Guestbook via direct access of config.cgi.

[CLOSE] OSVDB ID : 59548 - Disclosed: 2002-07-27

Description:

(Description Provided by CVE) : Rlaj whois CGI script (whois.cgi) 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field.

[CLOSE] OSVDB ID : 16396 - Disclosed: 2002-07-26

Description:

Unknown / Incomplete