CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 4972 | CVE-2002-0581 | Candidate | WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script. | Proposed (20020611) | ACCEPT(1) Frech | NOOP(4) Cole, Cox, Foat, Wall | View | |
| 4973 | CVE-2002-0582 | Candidate | WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote attackers to read the reports by accessing the directory. | Proposed (20020611) | ACCEPT(1) Frech | NOOP(4) Cole, Cox, Foat, Wall | View | |
| 4974 | CVE-2002-0583 | Candidate | WorkforceROI Xpede 4.1 uses a small random namespace (5 alphanumeric characters) for temporary expense claim reports in the /reports/temp directory, which allows remote attackers to read the reports via a brute force attack. | Proposed (20020611) | ACCEPT(1) Frech | NOOP(4) Cole, Cox, Foat, Wall | View | |
| 4975 | CVE-2002-0584 | Candidate | WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the ts_app_process.asp script, which is easily guessable because it is incremented by 1 for each new timesheet. | Proposed (20020611) | ACCEPT(1) Frech | NOOP(4) Cole, Cox, Foat, Wall | View | |
| 4977 | CVE-2002-0586 | Candidate | Format string vulnerability in Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows remote attackers to execute arbitrary code via the Error or Notice parameters. | Proposed (20020611) | ACCEPT(3) Baker, Cole, Frech | NOOP(3) Cox, Foat, Wall | View |
Page 20844 of 20943, showing 5 records out of 104715 total, starting on record 104216, ending on 104220
