CVE-2002-0407

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as (1) a request with a .pl or .java extension, or (2) a request containing a large number of periods, which causes htcgibin.exe to leak the pathname in an error message.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=101310812804716&w=2
http://www.iss.net/security_center/static/8160.phpPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/265380
http://www.securityfocus.com/bid/4406Exploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=101310812804716&w=2
http://www.iss.net/security_center/static/8160.phpPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/265380
http://www.securityfocus.com/bid/4406Exploit, Patch, Vendor Advisory

Timeline

Published: Jul 26, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-04085.0htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the CVE-2002-04095.0orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote at CVE-2002-04105.0send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via CVE-2002-04117.5Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user CVE-2002-04127.5Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote attackers to execute arbitrary code by causing format s CVE-2002-04137.5Cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose UR CVE-2002-04147.5KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Poli CVE-2002-04151.7Directory traversal vulnerability in the web server used in RealPlayer 6.0.7, and possibly other versions, may allow local users to read fil CVE-2002-041610.0Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary cod CVE-2002-04175.0Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) and a nu CVE-2002-04185.0Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows CVE-2002-04195.0Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force