CVE Vulnerability Catalog

CGIScript.net csNews.cgi allows remote authenticated users to read arbitrary files and possibly gain privileges via the (1) pheader or (2) pfooter parameters in the 'Advanced Settings' capability.

Cross-site scripting (XSS) vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier allows remote attackers to execute arbitrary script as other web site visitors via script in the num parameter, which is not filtered in the resulting error message.

BlackICE Agent 3.1.eal does not always reactivate after a system standby, which could allow remote attackers and local users to bypass intended firewall restrictions.

CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privileges via newlines in the title field of the edit page.

CVE-2002-0958 is a cross-site scripting vulnerability in browse.php for PHP(Reactor) 1.2.7 that allows remote attackers to execute scripts as other users via the go parameter in the comments section.

Buffer overflow in HylaFAX faxgetty before version 4.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long line of image data.

The summary_graph_functions.php file in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location of the PHP code.

Cross-site scripting vulnerability in TransWARE Active! mail 1.422 and 2.0 allows remote attackers to execute arbitrary code via a certain e-mail header, which is not properly filtered.

Directory traversal vulnerability in splashAdmin.php for Cobalt Qube 3.0 allows local users and remote attackers to gain privileges as the Qube Admin via .. (dot dot) sequences in the sessionId cookie that point to an alternate session file.

Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 allows remote attackers to execute arbitrary code via a long RCPT TO command.

Jana Server versions 2.x through 2.2.1, and 1.4.6 and earlier do not restrict the number of unsuccessful login attempts, making it easier for remote attackers to gain privileges via brute force username and password guessing.

Buffer overflow in web server for Tivoli Management Framework (TMF) Endpoint versions 3.6.x through 3.7.1, before Fixpack 2, allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request.

Cisco VPN 3000 Concentrator versions 2.2.x and 3.x before 3.5.3 introduces an 'HTTPS on Public Inbound (XML-Auto)(forward/in)' rule but sets the protocol to 'ANY', allowing arbitrary traffic to pass through the concentrator.

RealJukebox 2 and RealOne Player Gold allow remote attackers to execute arbitrary script in the Local computer zone by modifying the skin.ini file in an RJS archive. After extraction, the skin.ini file is parsed as HTML by Microsoft-based web readers.

Buffer overflow in MyWebServer 1.02 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

Multiple SQL injection vulnerabilities in CARE 2002 before beta 1.0.02 allow remote attackers to perform unauthorized database operations.

Signedness error in Jana Server versions 2.x through 2.2.1, and 1.4.6 and earlier allows remote attackers to execute arbitrary code via long (1) Username, (2) Password, or (3) Hostname entries.

Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.5.1C does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, allowing remote attackers to conduct man-in-the-middle attacks.

CVE-2002-1036 is a vulnerability in search.pl for Fluid Dynamics Search Engine (FDSE) before version 2.0.0.0055, allowing remote attackers to execute web scripts via the Rank or Match parameters.

Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.5.2B does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.