CVE-2002-1286

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context via a URL that contains a colon in the domain portion, which is not properly parsed and loads an applet from a malicious site within the security context of the site that is being visited by the user.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 29, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2002

CVE-2002-12875.0Stack-based buffer overflow in the Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial ofCVE-2002-12885.0The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to determine the current directory of the Internet CVE-2002-12897.5The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial oCVE-2002-12906.4The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read and modify the contents of the Clipboard viCVE-2002-12915.0The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares viCVE-2002-12927.5The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the StanCVE-2002-12937.5The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loaderCVE-2002-12947.5The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows CVE-2002-12957.5The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly cCVE-2002-12967.2Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences inCVE-2002-13067.5Multiple buffer overflows in LISa on KDE 2.x for 2.1 and later, and KDE 3.x before 3.0.4, allow (1) local and possibly remote attackers to eCVE-2002-13076.8Cross-site scripting vulnerability (XSS) in MHonArc 2.5.12 and earlier allows remote attackers to insert script or HTML via an email message
CVE-2002-1286: High severity, CVSS 7.5 | Vulnix