CVE-2002-1640

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via (1) Text Features in the DHTML UI or (2) the test parameter to the oracle.apps.cz.servlet.UiServlet servlet.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://securitytracker.com/id?1003967Exploit, Patch, Third Party Advisory, VDB Entry
http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.htmlPatch
http://www.securityfocus.com/bid/4430Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/4436Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/8780VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/8781VDB Entry
http://securitytracker.com/id?1003967Exploit, Patch, Third Party Advisory, VDB Entry
http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.htmlPatch
http://www.securityfocus.com/bid/4430Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/4436Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/8780VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/8781VDB Entry

Timeline

Published: Apr 1, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-164110.0Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server (9iAS) allow remote attackers to execute arbitrary code via u CVE-2002-16427.2PostgreSQL 7.2.1 and 7.2.2 allows local users to delete transaction log (pg_clog) data and cause a denial of service (data loss) via the VAC CVE-2002-16437.5Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a CVE-2002-16447.2SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to CVE-2002-164510.0Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbi CVE-2002-16467.5SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure CVE-2002-16475.0The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes i CVE-2002-16487.5Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other u CVE-2002-16494.3Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascri CVE-2002-16507.5The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modifi CVE-2002-16514.3Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive info CVE-2002-16527.5Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary cod