CVE-2002-1647

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2002

CVE-2002-16487.5Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other uCVE-2002-16494.3Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary JavascriCVE-2002-16507.5The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modifiCVE-2002-16514.3Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive infoCVE-2002-16527.5Buffer overflow in cgicso.c for cgiemail 1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary codCVE-2002-16535.0Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encrCVE-2002-16547.5iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic AuthenticatioCVE-2002-16555.0The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of serviceCVE-2002-16567.5X-News (x_news) 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via snifCVE-2002-16577.5PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a bruteCVE-2002-16584.6Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: sinceCVE-2002-165910.0user_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user_id variable.
CVE-2002-1647: Medium severity, CVSS 5.0 | Vulnix