# CVEs published 2002-06-11

167 CVEs were published on June 11, 2002: 0 critical, 1 high. Days are UTC.

- [CVE-2001-1354](https://cve.now/CVE-2001-1354.md): NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashi (no CVSS)
- [CVE-2001-1355](https://cve.now/CVE-2001-1355.md): Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, (no CVSS)
- [CVE-2001-1356](https://cve.now/CVE-2001-1356.md): NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote a (no CVSS)
- [CVE-2001-1357](https://cve.now/CVE-2001-1357.md): Multiple vulnerabilities in phpMyChat before 0.14.5 exist in (1) input.php3, (2) handle\_inputH.php3, or (3) index.lib.php3 with unknown cons (no CVSS)
- [CVE-2001-1358](https://cve.now/CVE-2001-1358.md): Vulnerabilities in phpMyChat before 0.14.4 allow local and possibly remote attackers to gain privileges by specifying an alternate library f (no CVSS)
- [CVE-2001-1360](https://cve.now/CVE-2001-1360.md): Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned. (no CVSS)
- [CVE-2001-1361](https://cve.now/CVE-2001-1361.md): Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto lin (no CVSS)
- [CVE-2001-1362](https://cve.now/CVE-2001-1362.md): Vulnerability in the server for nPULSE before 0.53p4. (no CVSS)
- [CVE-2001-1363](https://cve.now/CVE-2001-1363.md): Vulnerability in phpWebSite before 0.7.9 related to running multiple instances in the same domain, which may allow attackers to gain adminis (no CVSS)
- [CVE-2001-1364](https://cve.now/CVE-2001-1364.md): Vulnerability in autodns.pl for AutoDNS before 0.0.4 related to domain names that are not fully qualified. (no CVSS)
- [CVE-2001-1365](https://cve.now/CVE-2001-1365.md): Vulnerability in IntraGnat before 1.4. (no CVSS)
- [CVE-2001-1366](https://cve.now/CVE-2001-1366.md): netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive informatio (no CVSS)
- [CVE-2001-1368](https://cve.now/CVE-2001-1368.md): Vulnerability in iPlanet Web Server 4 included in Virtualvault Operating System (VVOS) 4.0 running HP-UX 11.04 could allow attackers to corr (no CVSS)
- [CVE-2001-1376](https://cve.now/CVE-2001-1376.md): Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and p (no CVSS)
- [CVE-2001-1377](https://cve.now/CVE-2001-1377.md): Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers t (no CVSS)
- [CVE-2002-0031](https://cve.now/CVE-2002-0031.md): Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long argu (no CVSS)
- [CVE-2002-0393](https://cve.now/CVE-2002-0393.md): Buffer overflow in Red-M 1050 (Bluetooth Access Point) management web interface allows remote attackers to cause a denial of service and pos (no CVSS)
- [CVE-2002-0405](https://cve.now/CVE-2002-0405.md): Buffer overflow in Transsoft Broker FTP Server 5.0 evaluation allows remote attackers to cause a denial of service and possibly execute arbi (no CVSS)
- [CVE-2002-0407](https://cve.now/CVE-2002-0407.md): htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via request (no CVSS)
- [CVE-2002-0408](https://cve.now/CVE-2002-0408.md): htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the (no CVSS)
- [CVE-2002-0409](https://cve.now/CVE-2002-0409.md): orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote at (no CVSS)
- [CVE-2002-0410](https://cve.now/CVE-2002-0410.md): send\_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via (no CVSS)
- [CVE-2002-0411](https://cve.now/CVE-2002-0411.md): Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user (no CVSS)
- [CVE-2002-0413](https://cve.now/CVE-2002-0413.md): Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose UR (no CVSS)
- [CVE-2002-0415](https://cve.now/CVE-2002-0415.md): Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read fil (no CVSS)
- [CVE-2002-0416](https://cve.now/CVE-2002-0416.md): Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary cod (no CVSS)
- [CVE-2002-0417](https://cve.now/CVE-2002-0417.md): Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-0418](https://cve.now/CVE-2002-0418.md): Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows (no CVSS)
- [CVE-2002-0419](https://cve.now/CVE-2002-0419.md): Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force (no CVSS)
- [CVE-2002-0420](https://cve.now/CVE-2002-0420.md): Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user se (no CVSS)
- [CVE-2002-0421](https://cve.now/CVE-2002-0421.md): IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing prog (no CVSS)
- [CVE-2002-0422](https://cve.now/CVE-2002-0422.md): IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by (no CVSS)
- [CVE-2002-0426](https://cve.now/CVE-2002-0426.md): VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via man (no CVSS)
- [CVE-2002-0427](https://cve.now/CVE-2002-0427.md): Buffer overflows in fpexec in mod\_frontpage before 1.6.1 may allow attackers to gain root privileges. (no CVSS)
- [CVE-2002-0428](https://cve.now/CVE-2002-0428.md): Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the to\_expire or (no CVSS)
- [CVE-2002-0430](https://cve.now/CVE-2002-0430.md): MultiFileUploadHandler.php in the Sun Cobalt RaQ XTR administration interface allows local users to bypass authentication and overwrite arbi (no CVSS)
- [CVE-2002-0432](https://cve.now/CVE-2002-0432.md): Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2002-0433](https://cve.now/CVE-2002-0433.md): Pi3Web 2.0.0 allows remote attackers to view restricted files via an HTTP request containing a "\*" (wildcard or asterisk) character. (no CVSS)
- [CVE-2002-0434](https://cve.now/CVE-2002-0434.md): Marcus S. (no CVSS)
- [CVE-2002-0436](https://cve.now/CVE-2002-0436.md): sscd\_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in (no CVSS)
- [CVE-2002-0438](https://cve.now/CVE-2002-0438.md): ZyXEL ZyWALL 10 before 3.50 allows remote attackers to cause a denial of service via an ARP packet with the firewall's IP address and an inc (no CVSS)
- [CVE-2002-0439](https://cve.now/CVE-2002-0439.md): Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary J (no CVSS)
- [CVE-2002-0440](https://cve.now/CVE-2002-0440.md): Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web serve (no CVSS)
- [CVE-2002-0446](https://cve.now/CVE-2002-0446.md): categorie.php3 in Black Tie Project (BTP) 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an (no CVSS)
- [CVE-2002-0447](https://cve.now/CVE-2002-0447.md): Directory traversal vulnerability in Xerver Free Web Server 2.10 and earlier allows remote attackers to list arbitrary directories via a .. (no CVSS)
- [CVE-2002-0448](https://cve.now/CVE-2002-0448.md): Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request that contains many (no CVSS)
- [CVE-2002-0449](https://cve.now/CVE-2002-0449.md): Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to (no CVSS)
- [CVE-2002-0450](https://cve.now/CVE-2002-0450.md): Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) fi (no CVSS)
- [CVE-2002-0452](https://cve.now/CVE-2002-0452.md): Foundry Networks ServerIron switches do not decode URIs when applying "url-map" rules, which could make it easier for attackers to cause the (no CVSS)
- [CVE-2002-0453](https://cve.now/CVE-2002-0453.md): The account lockout capability in Oblix NetPoint 5.2 and earlier only locks out users once for the specified lockout period, which makes it (no CVSS)
- [CVE-2002-0455](https://cve.now/CVE-2002-0455.md): IncrediMail stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in othe (no CVSS)
- [CVE-2002-0456](https://cve.now/CVE-2002-0456.md): Eudora 5.1 and earlier versions stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vul (no CVSS)
- [CVE-2002-0457](https://cve.now/CVE-2002-0457.md): Cross-site scripting vulnerability in signgbook.php for BG GuestBook 1.0 allows remote attackers to execute arbitrary Javascript via encoded (no CVSS)
- [CVE-2002-0458](https://cve.now/CVE-2002-0458.md): Cross-site scripting vulnerability in News-TNK 1.2.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB paramet (no CVSS)
- [CVE-2002-0459](https://cve.now/CVE-2002-0459.md): Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parame (no CVSS)
- [CVE-2002-0460](https://cve.now/CVE-2002-0460.md): Bitvise WinSSHD before 2002-03-16 allows remote attackers to cause a denial of service (resource exhaustion) via a large number of incomplet (no CVSS)
- [CVE-2002-0461](https://cve.now/CVE-2002-0461.md): Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service (application crash) via Javascript in a web page that (no CVSS)
- [CVE-2002-0465](https://cve.now/CVE-2002-0465.md): Directory traversal vulnerability in filemanager.asp for Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arb (no CVSS)
- [CVE-2002-0466](https://cve.now/CVE-2002-0466.md): Hosting Controller 1.4.1 and earlier allows remote attackers to browse arbitrary directories via a full C: style pathname in the filepath ar (no CVSS)
- [CVE-2002-0467](https://cve.now/CVE-2002-0467.md): Buffer overflows in Ecartis (formerly Listar) 1.0.0 before snapshot 20020125 allows remote attackers to execute arbitrary code via (1) addre (no CVSS)
- [CVE-2002-0468](https://cve.now/CVE-2002-0468.md): Buffer overflows in Ecartis (formerly Listar) 1.0.0 in snapshot 20020427 and earlier allow local users to gain privileges via (1) a long com (no CVSS)
- [CVE-2002-0469](https://cve.now/CVE-2002-0469.md): Ecartis (formerly Listar) 1.0.0 in snapshot 20020125 and earlier does not properly drop privileges when Ecartis is installed setuid-root, "l (no CVSS)
- [CVE-2002-0470](https://cve.now/CVE-2002-0470.md): PHPNetToolpack 0.1 relies on its environment's PATH to find and execute the traceroute program, which could allow local users to gain privil (no CVSS)
- [CVE-2002-0471](https://cve.now/CVE-2002-0471.md): PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the a\_query variable. (no CVSS)
- [CVE-2002-0472](https://cve.now/CVE-2002-0472.md): MSN Messenger Service 3.6, and possibly other versions, uses weak authentication when exchanging messages between clients, which allows remo (no CVSS)
- [CVE-2002-0474](https://cve.now/CVE-2002-0474.md): Cross-site scripting vulnerability in ZeroForum allows remote attackers to execute arbitrary Javascript on web clients by embedding the scri (no CVSS)
- [CVE-2002-0475](https://cve.now/CVE-2002-0475.md): Cross-site scripting vulnerability in phpBB 1.4.4 and earlier allows remote attackers to execute arbitrary Javascript on web clients by embe (no CVSS)
- [CVE-2002-0476](https://cve.now/CVE-2002-0476.md): Standalone Macromedia Flash Player 5.0 allows remote attackers to save arbitrary files and programs via a .SWF file containing the undocumen (no CVSS)
- [CVE-2002-0477](https://cve.now/CVE-2002-0477.md): Standalone Macromedia Flash Player 5.0 before 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the (no CVSS)
- [CVE-2002-0478](https://cve.now/CVE-2002-0478.md): The default configuration of Foundry Networks EdgeIron 4802F allows remote attackers to modify sensitive information via arbitrary SNMP comm (no CVSS)
- [CVE-2002-0479](https://cve.now/CVE-2002-0479.md): Gravity Storm Service Pack Manager 2000 creates a hidden share (SPM2000c$) mapped to the C drive, which may allow local users to bypass acce (no CVSS)
- [CVE-2002-0480](https://cve.now/CVE-2002-0480.md): ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d is configured to allow a user "skank" on a machine "starscream" to become a (no CVSS)
- [CVE-2002-0481](https://cve.now/CVE-2002-0481.md): An interaction between Windows Media Player (WMP) and Outlook 2002 allows remote attackers to bypass Outlook security settings and execute J (no CVSS)
- [CVE-2002-0482](https://cve.now/CVE-2002-0482.md): Directory traversal vulnerability in PCI Netsupport Manager before version 7, when running web extensions, allows remote attackers to read a (no CVSS)
- [CVE-2002-0483](https://cve.now/CVE-2002-0483.md): index.php for PHP-Nuke 5.4 and earlier allows remote attackers to determine the physical pathname of the web server when the file parameter (no CVSS)
- [CVE-2002-0485](https://cve.now/CVE-2002-0485.md): Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition heade (CVSS 7.5)
- [CVE-2002-0486](https://cve.now/CVE-2002-0486.md): Intellisol Xpede 4.1 uses weak encryption to store authentication information in cookies, which could allow local users with access to the c (no CVSS)
- [CVE-2002-0487](https://cve.now/CVE-2002-0487.md): Intellisol Xpede 4.1 stores passwords in plaintext in a Javascript "session timeout" re-authentication capability, which could allow local u (no CVSS)
- [CVE-2002-0489](https://cve.now/CVE-2002-0489.md): Linux Directory Penguin NsLookup CGI script (nslookup.pl) 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in (no CVSS)
- [CVE-2002-0491](https://cve.now/CVE-2002-0491.md): admin.php in AlGuest 1.0 guestbook checks for the existence of the admin cookie to authenticate the AlGuest administrator, which allows remo (no CVSS)
- [CVE-2002-0492](https://cve.now/CVE-2002-0492.md): dcshop.cgi in DCShop 1.002 Beta allows remote attackers to delete arbitrary setup files via a null character in the database parameter. (no CVSS)
- [CVE-2002-0496](https://cve.now/CVE-2002-0496.md): The HTTP server for SouthWest Talker server 1.0.0 allows remote attackers to cause a denial of service (server crash) via a malformed URL to (no CVSS)
- [CVE-2002-0498](https://cve.now/CVE-2002-0498.md): Etnus TotalView 5.0.0-4 installs certain files with UID 5039 and GID 59, which could allow local users with that UID or GID to modify the fi (no CVSS)
- [CVE-2002-0499](https://cve.now/CVE-2002-0499.md): The d\_path function in Linux kernel 2.2.20 and earlier, and 2.4.18 and earlier, truncates long pathnames without generating an error, which (no CVSS)
- [CVE-2002-0500](https://cve.now/CVE-2002-0500.md): Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc pro (no CVSS)
- [CVE-2002-0502](https://cve.now/CVE-2002-0502.md): Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page. (no CVSS)
- [CVE-2002-0503](https://cve.now/CVE-2002-0503.md): Directory traversal vulnerability in boilerplate.asp for Citrix NFuse 1.5 allows remote authenticated users to read arbitrary files via a .. (no CVSS)
- [CVE-2002-0504](https://cve.now/CVE-2002-0504.md): Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote (no CVSS)
- [CVE-2002-0507](https://cve.now/CVE-2002-0507.md): An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a pre (no CVSS)
- [CVE-2002-0508](https://cve.now/CVE-2002-0508.md): wwwisis 3.45 and earlier allows remote attackers to execute arbitrary commands and read files via the parameters (1) prolog or (2) epilog. (no CVSS)
- [CVE-2002-0509](https://cve.now/CVE-2002-0509.md): Transparent Network Substrate (TNS) Listener in Oracle 9i 9.0.1.1 allows remote attackers to cause a denial of service (CPU consumption) via (no CVSS)
- [CVE-2002-0510](https://cve.now/CVE-2002-0510.md): The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remot (no CVSS)
- [CVE-2002-0514](https://cve.now/CVE-2002-0514.md): PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is be (no CVSS)
- [CVE-2002-0515](https://cve.now/CVE-2002-0515.md): IPFilter 3.4.25 and earlier sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attac (no CVSS)
- [CVE-2002-0517](https://cve.now/CVE-2002-0517.md): Buffer overflow in X11 library (libX11) on Caldera Open UNIX 8.0.0, UnixWare 7.1.1, and possibly other operating systems, allows local users (no CVSS)
- [CVE-2002-0518](https://cve.now/CVE-2002-0518.md): The SYN cache (syncache) and SYN cookie (syncookie) mechanism in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2002-0520](https://cve.now/CVE-2002-0520.md): Cross-site scripting vulnerability in functions-inc.asp for ASP-Nuke RC1 allows remote attackers to execute script as other ASP-Nuke users b (no CVSS)
- [CVE-2002-0521](https://cve.now/CVE-2002-0521.md): Cross-site scripting vulnerabilities in ASP-Nuke RC2 and earlier allow remote attackers to execute script or gain privileges as other ASP-Nu (no CVSS)
- [CVE-2002-0522](https://cve.now/CVE-2002-0522.md): ASP-Nuke RC2 and earlier allows remote attackers to bypass authentication and gain privileges by modifying the "pseudo" cookie. (no CVSS)
- [CVE-2002-0523](https://cve.now/CVE-2002-0523.md): ASP-Nuke RC2 and earlier allows remote attackers to list all logged-in users by submitting an invalid "pseudo" cookie. (no CVSS)
- [CVE-2002-0524](https://cve.now/CVE-2002-0524.md): ASP-Nuke RC2 and earlier allows remote attackers to determine the absolute path of the server by (1) calling database-inc.asp with incorrect (no CVSS)
- [CVE-2002-0525](https://cve.now/CVE-2002-0525.md): Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gai (no CVSS)
- [CVE-2002-0526](https://cve.now/CVE-2002-0526.md): Vulnerability in (1) inews or (2) rnews for INN 2.2.3 and earlier, related to insecure open() calls. (no CVSS)
- [CVE-2002-0527](https://cve.now/CVE-2002-0527.md): Watchguard SOHO firewall before 5.0.35 allows remote attackers to cause a denial of service (crash and reboot) when SOHO forwards a packet w (no CVSS)
- [CVE-2002-0528](https://cve.now/CVE-2002-0528.md): Watchguard SOHO firewall 5.0.35 unpredictably disables certain IP restrictions for customized services that were set before the administrato (no CVSS)
- [CVE-2002-0529](https://cve.now/CVE-2002-0529.md): HP Photosmart printer driver for Mac OS X installs the hp\_imaging\_connectivity program and the hp\_imaging\_connectivity.app directory with wo (no CVSS)
- [CVE-2002-0530](https://cve.now/CVE-2002-0530.md): Cross-site scripting vulnerability in Novell Web Search 2.0.1 allows remote attackers to execute arbitrary script as other Web Search users (no CVSS)
- [CVE-2002-0533](https://cve.now/CVE-2002-0533.md): phpBB 1.4.4 and earlier with BBcode allows remote attackers to cause a denial of service (CPU consumption) and corrupt the database via null (no CVSS)
- [CVE-2002-0534](https://cve.now/CVE-2002-0534.md): PostBoard 2.0.1 and earlier with BBcode allows remote attackers to cause a denial of service (CPU consumption) and corrupt the database via (no CVSS)
- [CVE-2002-0535](https://cve.now/CVE-2002-0535.md): Cross-site scripting vulnerabilities in PostBoard 2.0.1 and earlier allows remote attackers to execute script as other users via (1) an \[IMG (no CVSS)
- [CVE-2002-0537](https://cve.now/CVE-2002-0537.md): The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, which allows remote attackers who can access (no CVSS)
- [CVE-2002-0540](https://cve.now/CVE-2002-0540.md): Nortel CVX 1800 is installed with a default "public" community string, which allows remote attackers to read usernames and passwords and mod (no CVSS)
- [CVE-2002-0541](https://cve.now/CVE-2002-0541.md): Buffer overflow in Tivoli Storage Manager TSM (1) Server or Storage Agents 3.1 through 5.1, and (2) the TSM Client Acceptor Service 4.2 and (no CVSS)
- [CVE-2002-0544](https://cve.now/CVE-2002-0544.md): Aprelium Abyss Web Server (abyssws) before 1.0.3 stores the administrative console password in plaintext in the abyss.conf file, which allow (no CVSS)
- [CVE-2002-0547](https://cve.now/CVE-2002-0547.md): Buffer overflow in the mini-browser for Winamp 2.79 and earlier allows remote attackers to cause a denial of service (crash) and possibly ex (no CVSS)
- [CVE-2002-0548](https://cve.now/CVE-2002-0548.md): Anthill allows remote attackers to bypass authentication and file bug reports by directly accessing the postbug.php program instead of enter (no CVSS)
- [CVE-2002-0549](https://cve.now/CVE-2002-0549.md): Cross-site scripting vulnerabilities in Anthill allow remote attackers to execute script as other Anthill users. (no CVSS)
- [CVE-2002-0550](https://cve.now/CVE-2002-0550.md): Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter. (no CVSS)
- [CVE-2002-0551](https://cve.now/CVE-2002-0551.md): Cross-site scripting vulnerability in Dynamic Guestbook 3.0 allows remote attackers to execute code in clients who access guestbook pages vi (no CVSS)
- [CVE-2002-0552](https://cve.now/CVE-2002-0552.md): Multiple buffer overflows in Melange Chat server 2.02 allow remote or local attackers to cause a denial of service (crash) and possibly exec (no CVSS)
- [CVE-2002-0554](https://cve.now/CVE-2002-0554.md): webdriver in IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injectio (no CVSS)
- [CVE-2002-0555](https://cve.now/CVE-2002-0555.md): IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQ (no CVSS)
- [CVE-2002-0556](https://cve.now/CVE-2002-0556.md): Directory traversal vulnerability in Quik-Serv HTTP server 1.1B allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-0557](https://cve.now/CVE-2002-0557.md): Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes (1) rexec or (2) rsh to run another user's shell (no CVSS)
- [CVE-2002-0558](https://cve.now/CVE-2002-0558.md): Directory traversal vulnerability in TYPSoft FTP server 0.97.1 and earlier allows a remote authenticated user (possibly anonymous) to list a (no CVSS)
- [CVE-2002-0559](https://cve.now/CVE-2002-0559.md): Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or e (no CVSS)
- [CVE-2002-0560](https://cve.now/CVE-2002-0560.md): PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA\_UTIL sto (no CVSS)
- [CVE-2002-0561](https://cve.now/CVE-2002-0561.md): The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authenticatio (no CVSS)
- [CVE-2002-0562](https://cve.now/CVE-2002-0562.md): The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which (no CVSS)
- [CVE-2002-0563](https://cve.now/CVE-2002-0563.md): The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authent (no CVSS)
- [CVE-2002-0564](https://cve.now/CVE-2002-0564.md): PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descr (no CVSS)
- [CVE-2002-0565](https://cve.now/CVE-2002-0565.md): Oracle 9iAS 1.0.2.x compiles JSP files in the \_pages directory with world-readable permissions under the web root, which allows remote attac (no CVSS)
- [CVE-2002-0566](https://cve.now/CVE-2002-0566.md): PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Aut (no CVSS)
- [CVE-2002-0568](https://cve.now/CVE-2002-0568.md): Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information i (no CVSS)
- [CVE-2002-0570](https://cve.now/CVE-2002-0570.md): The encrypted loop device in Linux kernel 2.4.10 and earlier does not authenticate the entity that is encrypting data, which allows local us (no CVSS)
- [CVE-2002-0572](https://cve.now/CVE-2002-0572.md): FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by clo (no CVSS)
- [CVE-2002-0577](https://cve.now/CVE-2002-0577.md): Vulnerability in passwd for HP-UX 11.00 and 11.11 allows local users to corrupt the password file and cause a denial of service. (no CVSS)
- [CVE-2002-0578](https://cve.now/CVE-2002-0578.md): Buffer overflow in 4D WebServer 6.7.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP r (no CVSS)
- [CVE-2002-0579](https://cve.now/CVE-2002-0579.md): WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminpro (no CVSS)
- [CVE-2002-0580](https://cve.now/CVE-2002-0580.md): WorkforceROI Xpede 4.1 allows remote attackers to obtain the database username via a request to datasource.asp, which leaks the username in (no CVSS)
- [CVE-2002-0581](https://cve.now/CVE-2002-0581.md): WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database vi (no CVSS)
- [CVE-2002-0582](https://cve.now/CVE-2002-0582.md): WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote (no CVSS)
- [CVE-2002-0583](https://cve.now/CVE-2002-0583.md): WorkforceROI Xpede 4.1 uses a small random namespace (5 alphanumeric characters) for temporary expense claim reports in the /reports/temp di (no CVSS)
- [CVE-2002-0584](https://cve.now/CVE-2002-0584.md): WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the ts\_app\_process.asp script, w (no CVSS)
- [CVE-2002-0585](https://cve.now/CVE-2002-0585.md): Unknown vulnerability in ndd for HP-UX 11.11 with certain TRANSPORT patches allows attackers to cause a denial of service. (no CVSS)
- [CVE-2002-0586](https://cve.now/CVE-2002-0586.md): Format string vulnerability in Ns\_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through (no CVSS)
- [CVE-2002-0587](https://cve.now/CVE-2002-0587.md): Buffer overflow in Ns\_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows (no CVSS)
- [CVE-2002-0588](https://cve.now/CVE-2002-0588.md): PVote before 1.9 does not authenticate users for restricted operations, which allows remote attackers to add or delete polls by modifying pa (no CVSS)
- [CVE-2002-0589](https://cve.now/CVE-2002-0589.md): PVote before 1.9 allows remote attackers to change the administrative password and gain privileges by directly calling ch\_info.php with the (no CVSS)
- [CVE-2002-0590](https://cve.now/CVE-2002-0590.md): Cross-site scripting (CSS) vulnerability in IcrediBB 1.1 Beta allows remote attackers to execute arbitrary script and steal cookies as other (no CVSS)
- [CVE-2002-0591](https://cve.now/CVE-2002-0591.md): Directory traversal vulnerability in AOL Instant Messenger (AIM) 4.8 beta and earlier allows remote attackers to create arbitrary files and (no CVSS)
- [CVE-2002-0592](https://cve.now/CVE-2002-0592.md): AOL Instant Messenger (AIM) allows remote attackers to steal files that are being transferred to other clients by connecting to port 4443 (D (no CVSS)
- [CVE-2002-0593](https://cve.now/CVE-2002-0593.md): Buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to cause a denial of service (crash) and possibly exec (no CVSS)
- [CVE-2002-0595](https://cve.now/CVE-2002-0595.md): Buffer overflow in WTRS\_UI.EXE (WTX\_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2002-0596](https://cve.now/CVE-2002-0596.md): WebTrends Reporting Center 4.0d allows remote attackers to determine the real path of the web server via a GET request to get\_od\_toc.pl with (no CVSS)
- [CVE-2002-0600](https://cve.now/CVE-2002-0600.md): Heap overflow in the KTH Kerberos 4 FTP client 4-1.1.1 allows remote malicious servers to execute arbitrary code on the client via a long re (no CVSS)
- [CVE-2002-0602](https://cve.now/CVE-2002-0602.md): Snapgear Lite+ firewall 1.5.4 and 1.5.3 allows remote attackers to cause a denial of service (crash) via a large number of connections to (1 (no CVSS)
- [CVE-2002-0603](https://cve.now/CVE-2002-0603.md): Snapgear Lite+ firewall 1.5.3 allows remote attackers to cause a denial of service (IPSEC crash) via a zero length packet to UDP port 500. (no CVSS)
- [CVE-2002-0604](https://cve.now/CVE-2002-0604.md): Snapgear Lite+ firewall 1.5.3 and 1.5.4 allows remote attackers to cause a denial of service (crash) via a large number of packets with malf (no CVSS)
- [CVE-2002-0606](https://cve.now/CVE-2002-0606.md): Buffer overflow in 3Cdaemon 2.0 FTP server allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code (no CVSS)
- [CVE-2002-0607](https://cve.now/CVE-2002-0607.md): members.asp in Snitz Forums 2000 version 3.3.03 and earlier allows remote attackers to execute arbitrary code via a SQL injection attack on (no CVSS)
- [CVE-2002-0608](https://cve.now/CVE-2002-0608.md): Buffer overflow in Matu FTP client 1.74 allows remote FTP servers to execute arbitrary code via a long "220" banner. (no CVSS)
- [CVE-2002-0609](https://cve.now/CVE-2002-0609.md): Vulnerability in HP MPE/iX 6.0 through 7.0 allows attackers to cause a denial of service (system failure with "SA1457 out of i\_port\_timeout. (no CVSS)
- [CVE-2002-0610](https://cve.now/CVE-2002-0610.md): Vulnerability in FTPSRVR in HP MPE/iX 6.0 through 7.0 does not properly validate certain FTP commands, which allows attackers to gain privil (no CVSS)
- [CVE-2002-0611](https://cve.now/CVE-2002-0611.md): Directory traversal vulnerability in FileSeek.cgi allows remote attackers to read arbitrary files via a ....// (modified dot dot) in the (1) (no CVSS)
- [CVE-2002-0612](https://cve.now/CVE-2002-0612.md): FileSeek.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) head or (2) foot parameters. (no CVSS)
- [CVE-2002-0614](https://cve.now/CVE-2002-0614.md): PHP-Survey 20000615 and earlier stores the global.inc file under the web root, which allows remote attackers to obtain sensitive information (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2002-06-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.