CVE-2002-0495

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=7Product
http://www.iss.net/security_center/static/8636.phpBroken Link, Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/264169Broken Link, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/4368Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=7Product
http://www.iss.net/security_center/static/8636.phpBroken Link, Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/264169Broken Link, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/4368Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory

Timeline

Published: Aug 12, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-04965.0The HTTP server for SouthWest Talker server 1.0.0 allows remote attackers to cause a denial of service (server crash) via a malformed URL to CVE-2002-04972.1Buffer overflow in mtr 0.46 and earlier, when installed setuid root, allows local users to access a raw socket via a long MTR_OPTIONS enviro CVE-2002-04984.6Etnus TotalView 5.0.0-4 installs certain files with UID 5039 and GID 59, which could allow local users with that UID or GID to modify the fi CVE-2002-04992.1The d_path function in Linux kernel 2.2.20 and earlier, and 2.4.18 and earlier, truncates long pathnames without generating an error, which CVE-2002-05005.0Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc pro CVE-2002-05017.2Format string vulnerability in log_print() function of Posadis DNS server before version m5pre2 allows local users and possibly remote attac CVE-2002-05025.0Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page.CVE-2002-05035.0Directory traversal vulnerability in boilerplate.asp for Citrix NFuse 1.5 allows remote authenticated users to read arbitrary files via a ..CVE-2002-05047.5Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote CVE-2002-05055.0Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote a CVE-2002-05067.2Buffer overflow in newt.c of newt windowing library (libnewt) 0.50.33 and earlier may allow attackers to cause a denial of service or execut CVE-2002-05072.1An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a pre