CVE-2002-1078

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Abyss Web Server 1.0.3 allows remote attackers to list directory contents via an HTTP GET request that ends in a large number of / (slash) characters.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0043.html
http://online.securityfocus.com/archive/1/284904
http://www.iss.net/security_center/static/9721.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/5345Exploit, Patch, Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0043.html
http://online.securityfocus.com/archive/1/284904
http://www.iss.net/security_center/static/9721.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/5345Exploit, Patch, Vendor Advisory

Timeline

Published: Oct 4, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-10795.0Directory traversal vulnerability in Abyss Web Server 1.0.3 allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequ CVE-2002-10807.5The Administration console for Abyss Web Server 1.0.3 before Patch 2 allows remote attackers to gain privileges and modify server configurat CVE-2002-10815.0The Administration console for Abyss Web Server 1.0.3 allows remote attackers to read files without providing login credentials via an HTTP CVE-2002-10825.0The Image Upload capability for ezContents 1.40 and earlier allows remote attackers to cause ezContents to perform operations on local files CVE-2002-10835.0Directory traversal vulnerabilities in ezContents 1.41 and earlier allow remote attackers to cause ezContents to (1) create directories usin CVE-2002-10846.4The VerifyLogin function in ezContents 1.41 and earlier does not properly halt program execution if a user fails to log in properly, which a CVE-2002-10857.5Multiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via CVE-2002-10867.5Multiple SQL injection vulnerabilities in ezContents 1.41 and earlier allow remote attackers to conduct unauthorized activities.CVE-2002-10875.0The scripts (1) createdir.php, (2) removedir.php and (3) uploadfile.php for ezContents 1.41 and earlier do not check credentials, which allo CVE-2002-10887.5Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 allows remote attackers to execute arbitrary code via a long RCPT TO command.CVE-2002-10895.0rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote CVE-2002-10907.5Buffer overflow in read_smtp_response of protocol.c in libesmtp before 0.8.11 allows a remote SMTP server to (1) execute arbitrary code via