CVE-2002-1339

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10 follows redirections, which allows remote attackers to determine the existence of local files based on exceptions, or to read WorkSheet XML files.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=101830175621193&w=2
http://security.greymagic.com/adv/gm008-ie/Exploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=101830175621193&w=2
http://security.greymagic.com/adv/gm008-ie/Exploit, Patch, Vendor Advisory

Timeline

Published: Dec 18, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-13405.0The "ConnectionFile" property in the DataSourceControl component in Office Web Components (OWC) 10 allows remote attackers to determine the CVE-2002-13416.8Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert scri CVE-2002-13427.5Unknown vulnerability in smb2www 980804-16 and earlier allows remote attackers to execute arbitrary commands.CVE-2002-13445.0Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filena CVE-2002-13455.0Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files CVE-2002-13479.8Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute a CVE-2002-13485.0w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files CVE-2002-13494.6Buffer overflow in pop3trap.exe for PC-cillin 2000, 2002, and 2003 allows local users to execute arbitrary code via a long input string to T CVE-2002-13507.5The BGP decoding routines in tcpdump 3.6.x before 3.7 do not properly copy data, which allows remote attackers to cause a denial of service CVE-2002-13515.0Buffer overflow in Melange Chat System 1.10 allows remote attackers to cause a denial of service (chat server crash) and possibly execute ar CVE-2002-13525.0Per Magne Knutsen's CartMan shopping cart (cartman.php) 1.04 and earlier allows remote attackers to modify product prices by changing the pr CVE-2002-13535.0LocalWEB2000 HTTP server 2.1.0 stores passwords in plain text under the web document root in users.lst, which allows remote attackers to obt