CVE-2002-0955

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier allows remote attackers to execute arbitrary script as other web site visitors via script in the num parameter, which is not filtered in the resulting error message.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-06/0261.html
http://www.iss.net/security_center/static/9408.phpVendor Advisory
http://www.securityfocus.com/bid/5078Exploit, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-06/0261.html
http://www.iss.net/security_center/static/9408.phpVendor Advisory
http://www.securityfocus.com/bid/5078Exploit, Vendor Advisory

Timeline

Published: Oct 4, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-09567.5BlackICE Agent 3.1.eal does not always reactivate after a system standby, which could allow remote attackers and local users to bypass inten CVE-2002-09575.0The default configuration of BlackICE Agent 3.1.eal and 3.1.ebh has a high tcp.maxconnections setting, which could allow remote attackers to CVE-2002-09587.5Cross-site scripting vulnerability in browse.php for PHP(Reactor) 1.2.7 allows remote attackers to execute script as other users via the go CVE-2002-09597.5Cross-site scripting vulnerability in Splatt Forum 3.0 allows remote attackers to execute arbitrary script as other users via an [img] tag w CVE-2002-09607.5Multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allows remote attackers to execute arbitrary script as o CVE-2002-09617.5Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other users, e.g. by dele CVE-2002-09627.5Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via (1) the url variabl CVE-2002-09635.0SQL injection vulnerability in comment.php for GeekLog 1.3.5 and earlier allows remote attackers to obtain sensitive user information via th CVE-2002-09645.0Half-Life Server 1.1.1.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via multiple responses to th CVE-2002-09657.5Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrar CVE-2002-09667.5Buffer overflow in 4D web server 6.7.3 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long HT CVE-2002-09677.5Buffer overflow in eDonkey 2000 35.16.60 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbit