CVE-2002-1567

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-15685.0OpenSSL 0.9.6e uses assertions when detecting buffer overflow attacks instead of less severe mechanisms, which allows remote attackers to ca CVE-2002-15697.5gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for CVE-2002-15707.5Heap-based buffer overflow in snmpnetstat for ucd-snmp 4.2.3 and earlier, and net-snmp, allows remote attackers to execute arbitrary code vi CVE-2002-15712.1The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on proc CVE-2002-157210.0Signed integer overflow in the bttv_read function in the bttv driver (bttv-driver.c) in Linux kernel before 2.4.20 has unknown impact and at CVE-2002-157310.0Unspecified vulnerability in the pcilynx ieee1394 firewire driver (pcilynx.c) in Linux kernel before 2.4.20 has unknown impact and attack ve CVE-2002-15744.6Buffer overflow in the ixj telephony card driver in Linux before 2.4.20 has unknown impact and attack vectors.CVE-2002-15755.0cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline (%0a) characters in parameters such a CVE-2002-15767.2lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to CVE-2002-15777.5SAP R/3 2.0B to 4.6D installs several clients with default users and passwords, which allows remote attackers to gain privileges via the (1)CVE-2002-15787.5The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sensi CVE-2002-15795.0SAP GUI (Sapgui) 4.6D allows remote attackers to cause a denial of service (crash) via a connection to a high-numbered port, which generates