CVE-2002-1484

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-09/0201.htmlBroken Link, Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0125.htmlBroken Link, Vendor Advisory
http://www.iss.net/security_center/static/10136.phpBroken Link, Exploit, Vendor Advisory
http://www.securityfocus.com/bid/5725Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-09/0201.htmlBroken Link, Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0125.htmlBroken Link, Vendor Advisory
http://www.iss.net/security_center/static/10136.phpBroken Link, Exploit, Vendor Advisory
http://www.securityfocus.com/bid/5725Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory

Timeline

Published: Apr 22, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-14855.0The AIM component of Trillian 0.73 and 0.74 allows remote attackers to cause a denial of service (crash) via certain strings such as "P > O CVE-2002-14867.5Multiple buffer overflows in the IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service an CVE-2002-14875.0The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) by sending the raw mess CVE-2002-14885.0The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with CVE-2002-14897.5Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a CVE-2002-14902.1NetBSD 1.4 through 1.6 beta allows local users to cause a denial of service (kernel panic) via a series of calls to the TIOCSCTTY ioctl, whi CVE-2002-14915.0The Cisco VPN 5000 Client for MacOS before 5.2.2 records the most recently used login password in plaintext when saving "Default Connection"CVE-2002-14927.2Buffer overflows in the Cisco VPN 5000 Client before 5.2.7 for Linux, and VPN 5000 Client before 5.2.8 for Solaris, allow local users to gai CVE-2002-14934.3Cross-site scripting (XSS) vulnerability in Lycos HTMLGear guestbook allows remote attackers to inject arbitrary script via (1) STYLE attrib CVE-2002-14944.3Cross-site scripting (XSS) vulnerabilities in Aestiva HTML/OS allows remote attackers to insert arbitrary HTML or script by inserting the sc CVE-2002-14954.3Cross-site scripting (XSS) vulnerability in JAWmail 1.0-rc1 allows remote attackers to insert arbitrary script or HTML via (1) attached file CVE-2002-14967.5Heap-based buffer overflow in Null HTTP Server 0.5.0 and earlier allows remote attackers to execute arbitrary code via a negative value in t