CVE-2002-0094

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

config_converters.py in BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bscw.gmd.de/WhatsNew.html
http://www.iss.net/security_center/static/7774.phpPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/248000Patch, Vendor Advisory
http://www.securityfocus.com/bid/3776Patch, Vendor Advisory
http://bscw.gmd.de/WhatsNew.html
http://www.iss.net/security_center/static/7774.phpPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/248000Patch, Vendor Advisory
http://www.securityfocus.com/bid/3776Patch, Vendor Advisory

Timeline

Published: Mar 25, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-00957.5The default configuration of BSCW (Basic Support for Cooperative Work) 3.x and possibly version 4 enables user self registration, which coul CVE-2002-00967.2The installation of Geeklog 1.3 creates an extra group_assignments record which is not properly deleted, which causes the first newly create CVE-2002-00977.5Geeklog 1.3 allows remote attackers to hijack user accounts, including the administrator account, by modifying the UID of a user's permanent CVE-2002-00987.5Buffer overflow in index.cgi administration interface for Boozt! Standard 0.9.8 allows local users to execute arbitrary code via a long name CVE-2002-00995.0Buffer overflow in Michael Lamont Savant Web Server 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP request CVE-2002-01007.5AOL AOLserver 3.4.2 Win32 allows remote attackers to bypass authentication and read password-protected files via a URL that directly referen CVE-2002-01015.0Microsoft Internet Explorer 6.0 and earlier allows local users to cause a denial of service via an infinite loop for modeless dialogs showMo CVE-2002-01025.0Oracle9iAS Web Cache 2.0.0.x allows remote attackers to cause a denial of service via (1) a request to TCP ports 1100, 4000, 4001, and 4002 CVE-2002-01034.6An installer program for Oracle9iAS Web Cache 2.0.0.x creates executable and configuration files with insecure permissions, which allows loc CVE-2002-01045.0AFTPD 5.4.4 allows remote attackers to gain sensitive information via a CD (CWD) ~ (tilde) command, which causes a core dump.CVE-2002-01057.2CDE dtlogin in Caldera UnixWare 7.1.0, and possibly other operating systems, allows local users to gain privileges via a symlink attack on /CVE-2002-01065.0BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an