OSVDB: Open Sourced Vulnerability Database

Browse Database

Browsing Vulnerabilities Disclosed in November of 2002

OSVDB ID	Disclosure Date	Title
17123 [CLOSE] OSVDB ID : 17123 - Disclosed: 2002-11-05 Description: (Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.	2002-11-05	Microsoft IIS Multiple Unspecified Admin Pages XSS
59282 [CLOSE] OSVDB ID : 59282 - Disclosed: 2002-11-05 Description: (Description Provided by CVE) : user_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user_id variable.	2002-11-05	PortalApp user_profile.asp user_id Parameter Modification Local Privilege Escalation
59694 [CLOSE] OSVDB ID : 59694 - Disclosed: 2002-11-05 Description: Networking_Utils contains a flaw that may allow an attacker to access arbitrary files. The issue is triggered when a remote attacker inputs shell metacharacters in the 'Domain Name' or 'IP address' parameters	2002-11-05	Networking_Utils networking_utils.php Multiple Parameter Shell Metacharacter Arbitrary File Access
59951 [CLOSE] OSVDB ID : 59951 - Disclosed: 2002-11-05 Description: (Description Provided by CVE) : Unknown vulnerability in Parallel port powerSwitch (aka pp_powerSwitch) 0.1 does not properly enforce access controls, which allows local users to access arbitrary ports.	2002-11-05	Parallel Port powerSwitch (pp_powerSwitch) Unspecified Arbitrary Local Port Access
78972 [CLOSE] OSVDB ID : 78972 - Disclosed: 2002-11-04 Description: Unknown / Incomplete	2002-11-04	Eudora DLL Search Path Weakness
78969 [CLOSE] OSVDB ID : 78969 - Disclosed: 2002-11-04 Description: Unknown / Incomplete	2002-11-04	Eudora Malformed Image Handling DoS
78970 [CLOSE] OSVDB ID : 78970 - Disclosed: 2002-11-04 Description: Unknown / Incomplete	2002-11-04	Eudora URL Handling Overflow DoS
78971 [CLOSE] OSVDB ID : 78971 - Disclosed: 2002-11-04 Description: Unknown / Incomplete	2002-11-04	Eudora Malformed URL Handling DoS
78967 [CLOSE] OSVDB ID : 78967 - Disclosed: 2002-11-04 Description: Unknown / Incomplete	2002-11-04	Eudora Invalid Long MIME Boundary Handling DoS
78968 [CLOSE] OSVDB ID : 78968 - Disclosed: 2002-11-04 Description: Unknown / Incomplete	2002-11-04	Eudora Message-ID / Date Header Handling Overflow DoS
771 [CLOSE] OSVDB ID : 771 - Disclosed: 2002-11-04 Description: (Description Provided by CVE) : Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."	2002-11-04	Microsoft IIS Hosting Process (dllhost.exe) Out of Process Application Unspecified Privilege Escalation
6870 [CLOSE] OSVDB ID : 6870 - Disclosed: 2002-11-04 Description: (Description Provided by CVE) : The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang).	2002-11-04	Multiple Vendor sunrpc libc Timeout DoS
7057 [CLOSE] OSVDB ID : 7057 - Disclosed: 2002-11-04 Description: Mac OS X contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when opening a disk image file that was created by another computer with administrator level privileges. No further details have been provided.	2002-11-04	Apple Mac OS X Disk Image Mount Privilege Escalation
7058 [CLOSE] OSVDB ID : 7058 - Disclosed: 2002-11-04 Description: Mac OS contains a flaw that may allow a local denial of service. The issue is triggered when a local attacker connects to the port Common Unix Printing System (CUPS) is listening on, which will crash the system and will result in loss of availability.	2002-11-04	Apple Mac OS X CUPS Web Admin Utility DoS
7059 [CLOSE] OSVDB ID : 7059 - Disclosed: 2002-11-04 Description: Mac OS X contains a flaw related to mounted ISO 9600 CDs that may allow a malicious user to log onto the system with valid user credentials. No further details have been provided.	2002-11-04	Apple Mac OS X ISO 9600 CD Mount Privilege Escalation
7060 [CLOSE] OSVDB ID : 7060 - Disclosed: 2002-11-04 Description: Mac OS X contains a flaw that may allow a malicious user to read arbitrary files. It is possible for a malicious user to use the map_fd() Mach system call to gain read access to files that have write permissions only, resulting in a loss of confidentiality. No further details have been provided.	2002-11-04	Apple Mac OS X map_fd() Mach System Call Arbitrary File Read
14516 [CLOSE] OSVDB ID : 14516 - Disclosed: 2002-11-04 Description: (Description Provided by CVE) : Northern Solutions Xeneo Web Server 2.1.0.0, 2.0.759.6, and other versions before 2.1.5 allows remote attackers to cause a denial of service (crash) via a GET request for a "%" URI.	2002-11-04	Xeneo Web Server Malformed GET Request DoS
39498 [CLOSE] OSVDB ID : 39498 - Disclosed: 2002-11-04 Description: The Magic Notebook contains a flaw that may allow a remote denial of service. The issue is triggered when attempting to handle an invalid username, and will result in loss of availability for the application.	2002-11-04	The Magic Notebook Invalid Username DoS
59691 [CLOSE] OSVDB ID : 59691 - Disclosed: 2002-11-03 Description: (Description Provided by CVE) : astrocam.cgi in AstroCam 0.9-1-1 through 1.4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request. NOTE: earlier disclosures stated that the affected versions were 1.7.1 through 2.1.2, but the vendor explicitly stated that these were incorrect.	2002-11-03	AstroCam astrocam.cgi HTTP Request Shell Metacharacter Arbitrary Command Execution
60445 [CLOSE] OSVDB ID : 60445 - Disclosed: 2002-11-03 Description: (Description Provided by CVE) : GlobalSunTech Wireless Access Points (1) WISECOM GL2422AP-0T, and possibly OEM products such as (2) D-Link DWL-900AP+ B1 2.1 and 2.2, (3) ALLOY GL-2422AP-S, (4) EUSSO GL2422-AP, and (5) LINKSYS WAP11-V2.2, allow remote attackers to obtain sensitive information like WEP keys, the administrator password, and the MAC filter via a "getsearch" request to UDP port 27155.	2002-11-03	WISECOM GL2422AP-0T gstsearch Remote Information Disclosure
60446 [CLOSE] OSVDB ID : 60446 - Disclosed: 2002-11-03 Description: (Description Provided by CVE) : GlobalSunTech Wireless Access Points (1) WISECOM GL2422AP-0T, and possibly OEM products such as (2) D-Link DWL-900AP+ B1 2.1 and 2.2, (3) ALLOY GL-2422AP-S, (4) EUSSO GL2422-AP, and (5) LINKSYS WAP11-V2.2, allow remote attackers to obtain sensitive information like WEP keys, the administrator password, and the MAC filter via a "getsearch" request to UDP port 27155.	2002-11-03	D-Link Multiple Router gstsearch Remote Information Disclosure
60447 [CLOSE] OSVDB ID : 60447 - Disclosed: 2002-11-03 Description: (Description Provided by CVE) : GlobalSunTech Wireless Access Points (1) WISECOM GL2422AP-0T, and possibly OEM products such as (2) D-Link DWL-900AP+ B1 2.1 and 2.2, (3) ALLOY GL-2422AP-S, (4) EUSSO GL2422-AP, and (5) LINKSYS WAP11-V2.2, allow remote attackers to obtain sensitive information like WEP keys, the administrator password, and the MAC filter via a "getsearch" request to UDP port 27155.	2002-11-03	Linksys WAP11 gstsearch Remote Information Disclosure
59636 [CLOSE] OSVDB ID : 59636 - Disclosed: 2002-11-02 Description: (Description Provided by CVE) : Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.	2002-11-02	Microsoft SQL Server SQL Authentication Password Encryption Weakness
59935 [CLOSE] OSVDB ID : 59935 - Disclosed: 2002-11-02 Description: (Description Provided by CVE) : Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer.	2002-11-02	EventSave Event Log Locking Data Write DoS
3933 [CLOSE] OSVDB ID : 3933 - Disclosed: 2002-11-01 Description: PHP-Nuke contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the bio variable in the Your_Account module is not verified properly and will allow an attacker to reset all passwords.	2002-11-01	PHP-Nuke Password Reset Injection
4376 [CLOSE] OSVDB ID : 4376 - Disclosed: 2002-11-01 Description: NetScreen ScreenOS contains a flaw that allows a remote attacker to crash the device. The issue is due to improper handling of SSH1 requests. If an attacker sends a specially crafted request to the SSH service they may be able to crash the service and/or device.	2002-11-01	NetScreen ScreenOS SSH1 Remote Request DoS
6661 [CLOSE] OSVDB ID : 6661 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Directory traversal vulnerability in ion-p.exe (aka ion-p) allows remote attackers to read arbitrary files via (1) C: (drive letter) or (2) .. (dot-dot) sequences in the page parameter.	2002-11-01	ION ion-p.exe page Parameter Traversal Arbitrary File Access
8864 [CLOSE] OSVDB ID : 8864 - Disclosed: 2002-11-01 Description: A local overflow exists in Abuse. The -net command-line argument fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted request to the -net command line option, a malicious user can cause arbitrary code execution resulting in a loss of integrity.	2002-11-01	Abuse -net Command Line Argument Overflow
14517 [CLOSE] OSVDB ID : 14517 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Buffer overflow in log2mail before 0.2.5.1 allows remote attackers to execute arbitrary code via a long log message.	2002-11-01	log2mail Log Message Remote Overflow
14518 [CLOSE] OSVDB ID : 14518 - Disclosed: 2002-11-01 Description: Abuse contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when Abuse starts up and is provided with external Lisp startup scripts to execute. This flaw may lead to the attacker executing arbitrary commands or modifying files with escalated privileges.	2002-11-01	Abuse Command Line Argument Arbitrary Lisp Script Execution
39357 [CLOSE] OSVDB ID : 39357 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Com21 DOXport 1100 series cable modem running firmware 2.1.1.106, and possibly other versions before 2.1.1.108.003, downloads a DOCSIS configuration file from a TFTP server running on the internal network, which allows local users to modify configuration of the modem via a malicious TFTP server.	2002-11-01	Com21 DOXport Cable Modems Remote Alternate Configuration
59777 [CLOSE] OSVDB ID : 59777 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : The Network Attached Storage (NAS) Administration Web Page for Iomega NAS A300U transmits passwords in cleartext, which allows remote attackers to sniff the administrative password.	2002-11-01	Iomega NAS A300U Administration Web Page Cleartext Password Transmission Remote Disclosure
59776 [CLOSE] OSVDB ID : 59776 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Iomega NAS A300U uses cleartext LANMAN authentication when mounting CIFS/SMB drives, which allows remote attackers to perform a man-in-the-middle attack.	2002-11-01	Iomega NAS A300U CIFS/SMB Drive Mounting Cleartext LANMAN Authentication Weakness
59784 [CLOSE] OSVDB ID : 59784 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software 1.2.000, when the "Save Password" option is used, stores the password with a weak encryption scheme (one-to-one mapping) in a registry key, which allows local users to obtain and decrypt the password.	2002-11-01	Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software Password Encryption Weakness
59884 [CLOSE] OSVDB ID : 59884 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Iomega Network Attached Storage (NAS) A300U, and possibly other models, does not allow the FTP service to be disabled, which allows local users to access home directories via FTP even when access to all shared directories have been disabled.	2002-11-01	Iomega Network Attached Storage (NAS) A300U FTP Service Persistence Weakness
59903 [CLOSE] OSVDB ID : 59903 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.56b5 and (2) Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 through 1.42.7 and Linksys WAP11 1.3 and 1.4, allows remote attackers to cause a denial of service (crash) via a long header, as demonstrated using the Host header.	2002-11-01	D-Link Multiple Router Embedded Web Server HTTP Header Handling Remote Overflow DoS
59904 [CLOSE] OSVDB ID : 59904 - Disclosed: 2002-11-01 Description: (Description Provided by CVE) : Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.56b5 and (2) Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 through 1.42.7 and Linksys WAP11 1.3 and 1.4, allows remote attackers to cause a denial of service (crash) via a long header, as demonstrated using the Host header.	2002-11-01	Linksys BEFW11S4 Embedded Web Server HTTP Header Handling Remote Overflow DoS

« Previous 1 2 3 4 5 6 Next »

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.