CVE Notifier

CVE-2002-0421 CWE-? N/A

CVE-2002-0421

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) a…

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0420 CWE-? N/A

CVE-2002-0420

Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user sessions.

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0419 CWE-? N/A

CVE-2002-0419

Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which (2) in certain configurations, t…

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0418 CWE-? N/A

CVE-2002-0418

Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) and a null character…

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0417 CWE-? N/A

CVE-2002-0417

Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the ALTERNATE_TEMPLATES parameter for various mmstdo*.cgi progra…

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0416 CWE-? N/A

CVE-2002-0416

Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0415 CWE-? N/A

CVE-2002-0415

Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read files that are accessible to RealPlayer via a .. (dot dot) in an HTTP GET request t…

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0413 CWE-? N/A

CVE-2002-0413

Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0411 CWE-? N/A

CVE-2002-0411

Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0410 CWE-? N/A

CVE-2002-0410

send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded.

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0409 CWE-? N/A

CVE-2002-0409

orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter.

MITRE n/a:n/a 11 Jun 2002

CVE-2002-0408 CWE-? N/A

CVE-2002-0408

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code…

MITRE n/a:n/a 11 Jun 2002