CVE-2002-0257

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields (1) TITLE, (2) DESCTIT, (3) DESC, (4) searchstring, (5) ALIAS, (6) EMAIL, (7) ADDRESS1, (8) ADDRESS2, (9) ADDRESS3, (10) PHONE1, (11) PHONE2, (12) PHONE3, or (13) PHONE4.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=101328880521775&w=2
http://www.iss.net/security_center/static/8161.phpPatch, Vendor Advisory
http://www.netcreations.addr.com/dcforum/DCForumID2/126.html
http://www.securityfocus.com/bid/4069Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=101328880521775&w=2
http://www.iss.net/security_center/static/8161.phpPatch, Vendor Advisory
http://www.netcreations.addr.com/dcforum/DCForumID2/126.html
http://www.securityfocus.com/bid/4069Patch, Vendor Advisory

Timeline

Published: May 29, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-02587.5Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote att CVE-2002-02594.6InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache CVE-2002-02607.5Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name, whic CVE-2002-02617.5Directory traversal vulnerability in InstantServers MiniPortal 1.1.5 and earlier allows remote authenticated users to read arbitrary files v CVE-2002-02625.0Directory traversal vulnerability in netget for Sybex E-Trainer web server allows remote attackers to read arbitrary files via a .. (dot dot CVE-2002-02637.5Buffer overflow in EasyBoard 2000 1.27 (aka EZboard) allows remote attackers to execute arbitrary code via a long boundary value in a multip CVE-2002-02647.5PowerFTP Personal FTP Server 2.03 through 2.10 stores sensitive account information in plaintext in the ftpserver.ini file, which allows att CVE-2002-02654.6Sawmill for Solaris 6.2.14 and earlier creates the AdminPassword file with world-writable permissions, which allows local users to gain priv CVE-2002-02665.0Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which ge CVE-2002-026710.0preferences.php in Simple Internet Publishing System (SIPS) before 0.3.1 allows remote attackers to gain administrative privileges via a lin CVE-2002-02687.2Identix BioLogon 3 allows users with physical access to the system to gain administrative privileges by using CTRL-ALT-DEL and running a "Br CVE-2002-02697.5Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote