CVE-2002-0555

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQL code in a web form even when the developer has attempted to escape it.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-04/0137.htmlVendor Advisory
http://www.iss.net/security_center/static/8827.phpVendor Advisory
http://www.securityfocus.com/bid/4498Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-04/0137.htmlVendor Advisory
http://www.iss.net/security_center/static/8827.phpVendor Advisory
http://www.securityfocus.com/bid/4498Vendor Advisory

Timeline

Published: Jul 3, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-05565.0Directory traversal vulnerability in Quik-Serv HTTP server 1.1B allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.CVE-2002-05577.5Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes (1) rexec or (2) rsh to run another user's shell CVE-2002-05585.0Directory traversal vulnerability in TYPSoft FTP server 0.97.1 and earlier allows a remote authenticated user (possibly anonymous) to list a CVE-2002-05597.5Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or e CVE-2002-05605.0PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA_UTIL sto CVE-2002-05617.5The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authenticatio CVE-2002-05625.0The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which CVE-2002-05635.0The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authent CVE-2002-05647.5PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descr CVE-2002-05655.0Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attac CVE-2002-05665.0PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Aut CVE-2002-05677.5Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrar